@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/compliance/audit-trails/auditable-events.shared.schema.d.ts

@@ -1,8 +1,33 @@
+import { AuditApplicationReadAccess } from './audit-trail-config.shared.schemas';
+import { AuditActorKind } from './audit-actor.shared.schemas';
+import { HumanDecision_Act, HumanDecision_Outcome, HumanDecision_Plane, HumanDecision_RefusalReason, HumanDecision_RequesterKind, HumanDecision_RouteChangeTrigger, HumanDecision_RouteKind, ReviewClockBasis, ReviewDeadlineKind, ReviewDeadlineOutcome, ReviewDeadlineStage, ReviewEscalationActionKind } from '../../flows-actors/human-decision.shared.schemas';
+import { AutonomousPrincipalSource, AutonomousTurnRefusalReason, AutonomousTurnTrigger } from '../../flows-actors/autonomous-agents.shared.schemas';
+import { EvaluationDatasetExportRefusalReason } from '../../flows-actors/agent-work-decisions.shared.schemas';
 import { z } from "zod";
+import '@wildo-ai/zod-decorators';
+import { AuthMethod } from "../../security/authentications/authentication.shared.schemas";
+import { FactorSatisfactionSource } from "../../security/authentications/service-provider-client-authentication.shared.schemas";
+import { ServiceProviderActivityFeedDisclosure, ServiceProviderMfaTrust } from "../../organizations/service-provider-client-controls.shared.schemas";
+import { ServiceProviderActivityFeedStatus } from "../../organizations/service-provider-activity-feed.shared.schemas";
+import { ExternalProvider_Connection_DelegationMode, RateBudgetCounting } from "@wildo-ai/external-connectors-models";
+import { ExternalDataConflictDecisionSource, ExternalDataConflictWinner, ExternalDataOutboundUnknownAnswer, ExternalDataPipelinePassMode, ExternalDataPipelineResetMode } from '../../external-data/external-data-pipeline-pass-mode.shared';
+import { LegalHoldGround, LegalHoldPlacementTier, LegalHoldScopeKind } from "../privacy/legal-holds.shared.schemas";
+import { DataRetentionClass } from "../privacy/retention-schedule.shared.schemas";
+import { RetentionEnforcementOutcome } from "../privacy/retention-enforcement-records.shared.schemas";
+import { SubjectErasureExternalEffectStatus } from "../privacy/subject-erasure.shared.schemas";
+import { SubjectDataRecipientObligation, SubjectDataRecipientReach, SubjectDataRecipientRelevance, SubjectDataRecipientsStatementStatus } from "../privacy/subject-data-recipients.shared.schemas";
+import { RegistrationAcquisitionChannel } from "../../config/entity-identity-config.shared.schemas";
 import { ResourceOperationRiskLevel, ResourceOperationVariantType } from "../../resources/resources.shared.schemas";
 import { CoreResourceOperation } from "../../resources/resources.shared.core.definitions";
 import { PlatformAccessGrantAutoApprovalReason, PlatformAccessGrantLifecycleTransition, PlatformAccessGrantScope, PlatformAccessGrantStatus } from "../../security/authorizations/platform-access-grants.shared.schemas";
+import { SystemOfRecordPartitionAssignmentTransition } from "../../systems-of-record/system-of-record-partition-assignments.shared.schemas";
+import { DelegatedAdministrativeCapability, ServiceProviderCapabilityGrantEndCause } from "../../organizations/service-provider-capability-grants.shared.schemas";
+import { ServiceProviderExpertAdmissionPolicy, ServiceProviderExpertApprovalDenialReason, ServiceProviderRelationshipStatus, ServiceProviderRelationshipTransition } from "../../organizations/service-provider-relationships.shared.schemas";
 import { ExecutionContext_ExecutionType } from "../../runtime/execution-context.shared.schemas";
+import { InboundDeliveryRejectionReason, InboundDeliveryUnroutableReason, InboundResolvedScopeKind, InboundSourceKind } from "../../inbound/inbound-delivery.shared.schemas";
+import { InboundBelowMinimumDisposition, InboundChannelKind, InboundSenderAssurance, ReplyTokenDowngradeReason } from "../../inbound/inbound-channels.shared.schemas";
+import { ReplyTokenRevocationReason } from "../../inbound/conversation-threads.shared.schemas";
+import { InboundEmailLimit, InboundEmailWithheldReason, OrganizationEmailDomainRemovalTrigger, OrganizationEmailDomainStatus, OrganizationEmailDomainSuspensionReason } from "../../notifications/inbound-email/inbound-email.shared.schemas";
 import { AuthScopeType, SsoConnectionType } from "../../security/authentications/authentication.shared.schemas";
 import { WebhookEndpointProbeOutcome } from "../../notifications/m2m/webhook-config.shared.schemas";
 import { ProviderCredentialDeletionReason, ProviderCredentialResolutionSource } from "../../security/connected-accounts/provider-credentials.shared.schemas";
@@ -54,6 +79,11 @@ export declare enum CoreAuditableEventType {
     ORGANIZATION_OWNER_FLOOR_BREACHED = "organization_owner_floor_breached",
     ORGANIZATION_CREATED = "organization_created",
     ORGANIZATION_UPDATED = "organization_updated",
+    /**
+     * The engine assigned an organization its `type`, at boot, with no actor — see
+     * {@link AuditableEvent_Organization_TypeAssignedEventDataSchema} for why this is not an `ORGANIZATION_UPDATED`.
+     */
+    ORGANIZATION_TYPE_ASSIGNED = "organization_type_assigned",
     ORGANIZATION_DELETED = "organization_deleted",
     /** The tenant was MARKED for deletion (soft-delete). Its access dies here; its data dies at the purge. */
     ORGANIZATION_DELETION_REQUESTED = "organization_deletion_requested",
@@ -93,10 +123,42 @@ export declare enum CoreAuditableEventType {
     ORGANIZATION_UNIT_MEMBER_REMOVED = "organization_unit_member_removed",
     USER_SSO_LOGIN = "user_sso_login",
     USER_SSO_LOGIN_FAILED = "user_sso_login_failed",
+    /**
+     * A tenant that mandates its identity provider refused a local sign-in or an acquisition.
+     *
+     * Emitted since #1214/#1242 by `_enforceEnterpriseSsoOnLocalFirstFactor` (every local first-factor
+     * door), by the grace-login gate's three refusal clauses, and by the registration door's
+     * `blockForSSODomains` block. `enforcementPolicy` carries WHICH clause refused, because "the tenant
+     * allows no fallback" and "this account has spent its grace logins" have different remedies and a
+     * bare `sso_required` cannot tell them apart.
+     *
+     * ONE refusal site remains unwired and is tracked on #1242: the SOCIAL-vs-enforcement refusal in
+     * `oauth2-authentication.backend.service.ts`, whose sibling provider-restriction refusal ten lines
+     * below it already emits `logOAuth2ProviderBlocked`.
+     *
+     * Deliberately NOT emitted by the fail-closed refusals that share the same error — a Redis read
+     * that failed, the outer catch. Those are infrastructure outcomes, and recording them as an
+     * enforcement decision would assert a policy judgement nobody made.
+     */
     USER_SSO_ENFORCEMENT_BLOCKED = "user_sso_enforcement_blocked",
     USER_TOKEN_REFRESHED = "user_token_refreshed",
     ORGANIZATION_SSO_CONFIGURATION_CHANGED = "organization_sso_configuration_changed",
+    /** A change to where an organization's security events are exported: enabled, or a field other than the destination edited. INFO. */
     ORGANIZATION_SIEM_EXPORT_CONFIGURED = "organization_siem_export_configured",
+    /**
+     * Security-event export was turned OFF (#986). Its own kind, at CRITICAL, because the envelope's rule
+     * is that severity is a property of the event TYPE and danger rides the row's `riskLevel` — and
+     * `riskLevel` never reaches the SIEM. As one INFO kind, "export disabled" was filtered out by any
+     * organization that raised its severity minimum, on the one destination that most needed it.
+     * Delivered to the destination that STOPPED, as its last event (`dispatchToRetiredSiemSink`).
+     */
+    ORGANIZATION_SIEM_EXPORT_DISABLED = "organization_siem_export_disabled",
+    /**
+     * Security-event export was re-pointed at another destination (#986). WARNING: a destination move is
+     * how an attacker who reached the tenant's administration diverts the trail. Delivered to BOTH the
+     * old and the new destination.
+     */
+    ORGANIZATION_SIEM_EXPORT_DESTINATION_CHANGED = "organization_siem_export_destination_changed",
     ORGANIZATION_PROVIDER_CREDENTIAL_SET = "organization_provider_credential_set",
     ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED = "organization_provider_credential_rotated",
     ORGANIZATION_PROVIDER_CREDENTIAL_USED = "organization_provider_credential_used",
@@ -108,7 +170,29 @@ export declare enum CoreAuditableEventType {
     ORGANIZATION_PROVIDER_CONNECTION_GRANTED = "organization_provider_connection_granted",
     USER_PROVIDER_CONNECTION_GRANTED = "user_provider_connection_granted",
     APPLICATION_AUTH_POLICY_CHANGED = "application_auth_policy_changed",
+    RETENTION_ENFORCEMENT_RECORDED = "retention_enforcement_recorded",
     WEBHOOK_ENDPOINT_TEST_DISPATCHED = "webhook_endpoint_test_dispatched",
+    INBOUND_DELIVERY_REJECTED = "inbound_delivery_rejected",
+    INBOUND_DELIVERY_ACCEPTED = "inbound_delivery_accepted",
+    INBOUND_DELIVERY_UNROUTABLE = "inbound_delivery_unroutable",
+    INBOUND_DELIVERY_PROCESSED = "inbound_delivery_processed",
+    INBOUND_DELIVERY_FAILED = "inbound_delivery_failed",
+    INBOUND_DELIVERY_DEAD = "inbound_delivery_dead",
+    INBOUND_DELIVERY_REPLAYED = "inbound_delivery_replayed",
+    INBOUND_DELIVERY_BELOW_ASSURANCE = "inbound_delivery_below_assurance",
+    INBOUND_REPLY_SENT = "inbound_reply_sent",
+    INBOUND_REPLY_FAILED = "inbound_reply_failed",
+    INBOUND_REPLY_TOKEN_REVOKED = "inbound_reply_token_revoked",
+    INBOUND_REPLY_TOKEN_DOWNGRADED = "inbound_reply_token_downgraded",
+    ORGANIZATION_EMAIL_DOMAIN_CLAIMED = "organization_email_domain_claimed",
+    ORGANIZATION_EMAIL_DOMAIN_OWNERSHIP_VERIFIED = "organization_email_domain_ownership_verified",
+    ORGANIZATION_EMAIL_DOMAIN_VERIFIED = "organization_email_domain_verified",
+    ORGANIZATION_EMAIL_DOMAIN_SUSPENDED = "organization_email_domain_suspended",
+    ORGANIZATION_EMAIL_DOMAIN_REMOVED = "organization_email_domain_removed",
+    CLIENT_MAILBOX_CREATED = "client_mailbox_created",
+    CLIENT_MAILBOX_REMOVED = "client_mailbox_removed",
+    INBOUND_EMAIL_ATTACHMENT_WITHHELD = "inbound_email_attachment_withheld",
+    INBOUND_EMAIL_REJECTED_LIMIT = "inbound_email_rejected_limit",
     SCIM_TOKEN_CREATED = "scim_token_created",
     SCIM_TOKEN_REVOKED = "scim_token_revoked",
     SCIM_TOKEN_GENERATED = "scim_token_generated",
@@ -183,6 +267,15 @@ export declare enum CoreAuditableEventType {
     FILE_UPLOAD_GRANT_ISSUED = "file_upload_grant_issued",
     FILE_UPLOAD_GRANT_REDEEMED = "file_upload_grant_redeemed",
     FILE_UPLOAD_GRANT_REVOKED = "file_upload_grant_revoked",
+    /**
+     * File share links (#1567). A share is a bearer link that serves ONE file to whoever holds it, with no
+     * session at all — the widest disclosure the file plane can make, so minting one is audited like a
+     * grant. `ISSUED` carries the file, its owning record/field binding, the expiry and the use budget —
+     * never the token value. `REVOKED` is "stop sharing this file" (`DELETE /files/:fileId/shares`) and
+     * carries how many live links it ended; a revocation that ended none records nothing.
+     */
+    FILE_SHARE_LINK_ISSUED = "file_share_link_issued",
+    FILE_SHARE_LINKS_REVOKED = "file_share_links_revoked",
     /**
      * A scanner concluded that an uploaded file is INFECTED, and the file was quarantined.
      *
@@ -224,6 +317,126 @@ export declare enum CoreAuditableEventType {
     RESOURCE_OPERATION_DENIED = "resource_operation_denied",
     CROSS_TENANT_ADMINISTRATIVE_ACCESS = "cross_tenant_administrative_access",
     PLATFORM_ACCESS_GRANT_LIFECYCLE = "platform_access_grant_lifecycle",
+    /**
+     * A legal hold was placed (#1634): from this instant every deletion path skips or refuses the held scope.
+     * HIGH — it suspends a tenant's retention schedule and its data subjects' erasures.
+     *
+     * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion suspended under a recorded legal hold.
+     */
+    LEGAL_HOLD_PLACED = "legal_hold_placed",
+    /**
+     * A legal hold was released (#1634): deletion of its scope resumes on the next sweep, purge or erasure.
+     *
+     * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion resumes only on a recorded release.
+     */
+    LEGAL_HOLD_RELEASED = "legal_hold_released",
+    /**
+     * A model-cost period aggregate was linked to the invoice that bills it (#1598). A retention-deciding act: the
+     * link is what keeps the aggregate past its tenant's deletion, for the statutory bookkeeping period.
+     *
+     * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — only an aggregate an invoice bills outlives its tenant.
+     */
+    MODEL_COST_AGGREGATE_INVOICE_LINKED = "model_cost_aggregate_invoice_linked",
+    /**
+     * An organization changed whether it keeps the CONTENT of its experts' corrections to agent work (#1599): the
+     * opt-in, its purpose, its reader role or its narrowing.
+     *
+     * assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — every change to what the tenant keeps of its client material is recorded.
+     */
+    CORRECTION_CAPTURE_SETTING_CHANGED = "correction_capture_setting_changed",
+    /**
+     * An organization recorded, changed or revoked its basis for exporting its experts' corrections as evaluation
+     * data (#1599).
+     *
+     * assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT — the authorisation an export relies on is recorded.
+     */
+    EVALUATION_EXPORT_AUTHORIZATION_CHANGED = "evaluation_export_authorization_changed",
+    /** A tenant's corrections were exported as an evaluation dataset under its recorded authorisation (#1599). */
+    EVALUATION_DATASET_EXPORTED = "evaluation_dataset_exported",
+    /**
+     * An export of a tenant's corrections was REFUSED: no ACTIVE authorisation of that organization (#1599 I7).
+     *
+     * assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT — a refused export is recorded, not only prevented.
+     */
+    EVALUATION_DATASET_EXPORT_REFUSED = "evaluation_dataset_export_refused",
+    /**
+     * A service-provider relationship moved (#1597) — proposed, accepted, declined, suspended, resumed,
+     * scope amended, terminated, withdrawn or expired. ONE event for the relationship's whole life with a
+     * {@link ServiceProviderRelationshipTransition} field (the `platformAccessGrants` shape), written to
+     * BOTH the client's and the firm's trail so each reads the relationship's timeline in its own.
+     */
+    SERVICE_PROVIDER_RELATIONSHIP_LIFECYCLE = "service_provider_relationship_lifecycle",
+    /** A firm-owned OAuth client was admitted into, or removed from, a client organization (#1597, S3). */
+    SERVICE_PROVIDER_MACHINE_CLIENT_ADMISSION_CHANGED = "service_provider_machine_client_admission_changed",
+    /** A firm assigned one of its experts to serve a client relationship (#1597). */
+    SERVICE_PROVIDER_EXPERT_ASSIGNED = "service_provider_expert_assigned",
+    /** A firm ended an expert's assignment to a client relationship (#1597). */
+    SERVICE_PROVIDER_EXPERT_UNASSIGNED = "service_provider_expert_unassigned",
+    /**
+     * A firm assigned an expert under a relationship whose client approves each expert, so the assignment now waits
+     * for the client's administrators (#1612). The approval is a human decision; this row carries its `decisionRef`,
+     * so it joins that decision's own REQUESTED / RESOLVED rows rather than duplicating them. Both organizations' trails.
+     */
+    SERVICE_PROVIDER_EXPERT_APPROVAL_REQUESTED = "service_provider_expert_approval_requested",
+    /** The client approved the expert and the expert was admitted — a provider membership now exists (#1612). Both trails. */
+    SERVICE_PROVIDER_EXPERT_APPROVAL_GRANTED = "service_provider_expert_approval_granted",
+    /**
+     * The expert was NOT admitted (#1612): the client refused, or approved when the relationship, the expert's firm
+     * membership or the (person, client) slot no longer allowed it. `denialReason` says which. Both trails.
+     */
+    SERVICE_PROVIDER_EXPERT_APPROVAL_DENIED = "service_provider_expert_approval_denied",
+    /** Nobody in the client answered before the approval's lapse; nothing was created (#1612). Both trails. */
+    SERVICE_PROVIDER_EXPERT_APPROVAL_LAPSED = "service_provider_expert_approval_lapsed",
+    /**
+     * A client lent a service firm's experts a named administrative capability, until a stated end (#1631). HIGH, CRITICAL
+     * for a security-critical capability. Written to both organizations' trails.
+     */
+    SERVICE_PROVIDER_CAPABILITY_GRANTED = "service_provider_capability_granted",
+    /** A client revoked a lent capability — or the relationship ended, which revokes them all (#1631). Both trails. */
+    SERVICE_PROVIDER_CAPABILITY_REVOKED = "service_provider_capability_revoked",
+    /**
+     * A client organization changed whether it trusts the firm's own identity provider's MFA on one relationship
+     * (#1633). HIGH: turning it on lets a proof made outside this application satisfy the client's authentication
+     * policy for the firm's experts. Written to the client's trail and the firm's.
+     */
+    SERVICE_PROVIDER_MFA_TRUST_CHANGED = "service_provider_mfa_trust_changed",
+    /**
+     * A firm's expert satisfied a CLIENT organization's authentication policy (#1633): a factor was recorded on the
+     * session for that client, with where it came from — a step-up answered here, or the firm's trusted identity
+     * provider. The client's answer to "was this expert's work MFA-protected, and by whom?". Client trail only.
+     */
+    SERVICE_PROVIDER_CLIENT_AUTHENTICATION_SATISFIED = "service_provider_client_authentication_satisfied",
+    /**
+     * A firm switched its expert-activity feed on or off (#1632). The record of a worker-monitoring decision: who,
+     * when, and whether the consultation notice was acknowledged. Firm trail.
+     */
+    SERVICE_PROVIDER_ACTIVITY_FEED_DECIDED = "service_provider_activity_feed_decided",
+    /**
+     * A client organization changed how much a firm's activity feed may say about work done in it (#1632). Written to
+     * the client's trail and the firm's, so the firm sees why its feed went quiet.
+     */
+    SERVICE_PROVIDER_ACTIVITY_FEED_DISCLOSURE_CHANGED = "service_provider_activity_feed_disclosure_changed",
+    /**
+     * A remote partition of a system of record was assigned to, moved between, or removed from an
+     * organization unit.
+     *
+     * ONE event for the whole life of the edge, with a {@link SystemOfRecordPartitionAssignmentTransition}
+     * field — the `platformAccessGrants` shape rather than three event types. Three types would put the
+     * same row's timeline in three buckets a reviewer has to reassemble, and the questions an auditor
+     * actually asks ("who has been able to see the German company, and since when?") are answered by
+     * reading one bucket in order.
+     *
+     * ## Why this exists beside the automatic row
+     *
+     * All three write verbs are HIGH, which is inside `AUTOMATIC_AUDIT_RISK_FLOOR`, so
+     * `RESOURCE_OPERATION_PERFORMED` already fires for each. What that row cannot carry is the thing a
+     * reviewer needs: which unit, and — on a move — which unit it was BEFORE. A generic operation row
+     * says an assignment changed; this one says what it changed from and to.
+     *
+     * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the reach of each remote partition is recorded.
+     * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of the full life of that reach.
+     */
+    SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_LIFECYCLE = "system_of_record_partition_assignment_lifecycle",
     /**
      * An operator enumerated an APPLICATION-WIDE directory — a collection read that is deliberately
      * not confined to any one tenant.
@@ -264,15 +477,70 @@ export declare enum CoreAuditableEventType {
     PLATFORM_DIRECTORY_ACCESS = "platform_directory_access",
     SYSTEM_CONTEXT_READ = "system_context_read",
     SYSTEM_CONTEXT_WRITE = "system_context_write",
+    /** Platform owner publication of application/service configuration; safe field names, caller and outcome only. */
+    PLATFORM_CONFIGURATION_PUBLICATION = "platform_configuration_publication",
     RETAINED_DATA_ACCESS = "retained_data_access",
+    GOVERNED_DOCUMENT_INTERACTION_RECORDED = "governed_document_interaction_recorded",
     SUBJECT_DATA_EXPORT = "subject_data_export",
     COLLECTION_DATA_EXPORT = "collection_data_export",
     HTTP_API_READ_THROUGH_ACCESS = "http_api_read_through_access",
+    HTTP_API_WRITE_THROUGH = "http_api_write_through",
+    SYSTEM_OF_RECORD_ACTION_EXECUTED = "system_of_record_action_executed",
+    SYSTEM_OF_RECORD_ACTION_REFUSED = "system_of_record_action_refused",
+    EXTERNAL_DATA_PIPELINE_RESET = "external_data_pipeline_reset",
+    EXTERNAL_DATA_OUTBOUND_UNKNOWN_RESOLVED = "external_data_outbound_unknown_resolved",
+    EXTERNAL_DATA_CONFLICT_RESOLVED = "external_data_conflict_resolved",
     HTTP_API_EXTERNAL_ERASURE = "http_api_external_erasure",
     HTTP_API_NON_ERASURE_ACKNOWLEDGED = "http_api_non_erasure_acknowledged",
+    SUBJECT_ERASURE_RECIPIENT_OUTCOME = "subject_erasure_recipient_outcome",
     PROVIDER_OPERATION_CALL = "provider_operation_call",
+    PROVIDER_OPERATION_DENIED = "provider_operation_denied",
     MCP_TOOL_CALL = "mcp_tool_call",
-    AGENT_TOOL_APPROVAL_MODIFIED = "agent_tool_approval_modified",
+    PROVIDER_CAPABILITY_CALL = "provider_capability_call",
+    /** A decision was raised and is waiting. Actor: the requester's principal, with the agent. */
+    HUMAN_DECISION_REQUESTED = "human_decision_requested",
+    /**
+     * A decision ended — answered, lapsed, withdrawn, or its requester's authority lapsed. Exactly one
+     * per `decisionRef`, written only by whoever won the compare-and-swap that released the pause.
+     * `outcome` says which; a SIEM that wants modified approvals filters on it.
+     *
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — every human decision on an agent's action is recorded once, with its decider and outcome.
+     */
+    HUMAN_DECISION_RESOLVED = "human_decision_resolved",
+    /** A decision was moved to another person (an answerer's handover, or a supervisor's takeover). */
+    HUMAN_DECISION_REASSIGNED = "human_decision_reassigned",
+    /** A decision was escalated — moved up, never denied. */
+    HUMAN_DECISION_ESCALATED = "human_decision_escalated",
+    /** A role-routed decision was claimed by one holder, or given back to the role (`claimed: false`). */
+    HUMAN_DECISION_CLAIMED = "human_decision_claimed",
+    /** Someone tried to act on a decision and the predicate refused them. WARNING: the refusal is the evidence. */
+    HUMAN_DECISION_ANSWER_REFUSED = "human_decision_answer_refused",
+    /** A decision's CLAIM or DECISION deadline passed with nobody having taken or answered it. Actor: the application. */
+    HUMAN_DECISION_DEADLINE_MISSED = "human_decision_deadline_missed",
+    /**
+     * A deadline stage's escalation rule fired: who was notified, and — for a REASSIGN rule — whether its
+     * target resolved and could answer. Actor: the application.
+     *
+     * assurance-control: WILDO.AUDIT.SECURITY_EVENT — every rule-driven change to who is asked about an agent's action is recorded, including a reassignment refused because its target could not answer.
+     */
+    HUMAN_DECISION_ESCALATION_FIRED = "human_decision_escalation_fired",
+    /** A person admitted to answer stopped the decision's CLAIM and DECISION clocks, naming a declared pause state. */
+    HUMAN_DECISION_CLOCK_PAUSED = "human_decision_clock_paused",
+    /** A person admitted to answer restarted the clocks; the paused time was added to both deadlines. */
+    HUMAN_DECISION_CLOCK_RESUMED = "human_decision_clock_resumed",
+    /**
+     * An autonomous agent may now run in an organization: a client of that organization was bound to it,
+     * or a firm's client that runs it was admitted by the organization's service-provider relationship.
+     *
+     * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — granting an agent standing authority to act unattended is recorded.
+     */
+    AUTONOMOUS_AGENT_BOUND = "autonomous_agent_bound",
+    /** An autonomous agent may no longer run in an organization: its binding or its admission was removed. */
+    AUTONOMOUS_AGENT_UNBOUND = "autonomous_agent_unbound",
+    /** The autonomous entry point opened a turn. Actor: the machine principal it resolved. */
+    AUTONOMOUS_AGENT_TURN_STARTED = "autonomous_agent_turn_started",
+    /** The autonomous entry point refused to open a turn, and created nothing. WARNING: `reason` says why. */
+    AUTONOMOUS_AGENT_TURN_REFUSED = "autonomous_agent_turn_refused",
     /** A user-delegated `authorization_code` access token was minted for a third-party client
      *  (the client may now act AS the user at the bound A2A/MCP resource) — the flagship grant. */
     OAUTH_DELEGATED_TOKEN_ISSUED = "oauth_delegated_token_issued",
@@ -382,6 +650,108 @@ export declare function describeAuditVocabulary(lead: string, meanings: Readonly
     readonly name: string;
     readonly meaning: string;
 }>>): string;
+/**
+ * Why the browser door to a provider operation refused a request (#367). A CLOSED vocabulary: the door
+ * resolves exactly one of these per refusal, in the order listed, and a reviewer groups by it.
+ *
+ * Deliberately NOT a reuse of {@link ResourceOperationDenialReason}. The two doors ask different
+ * questions of different declarations — that one checks an operation variant's roles and a row's scope,
+ * this one checks an application's browser-reachability policy and whose third-party account is named —
+ * and sharing members would make "insufficient roles" mean two things in one column.
+ */
+/**
+ * What a provider operation's `requiredScopes` check concluded for one call (#979).
+ *
+ * Carried on {@link AuditableEvent_ProviderOperationCall_EventDataSchema} only when the operation declares required
+ * scopes; an operation declaring none carries no scope field at all, rather than a verdict about nothing.
+ */
+export declare enum ProviderOperationScopeCheck {
+    /** The grant recorded its scopes and every required one is among them. The call proceeded. */
+    VERIFIED = "verified",
+    /**
+     * The spent credential records no granted scopes — a pasted key, the application's own credential, or a vendor
+     * that did not echo `scope`. The call proceeded UNCHECKED, and this row is what says so.
+     */
+    NOT_RECORDED = "not_recorded",
+    /** The grant recorded its scopes and lacks at least one required scope. The call was refused before any request. */
+    MISSING = "missing"
+}
+/**
+ * WHICH engine capability an outbound capability call discharged (#1712) — the egress, not the vendor.
+ *
+ * Deliberately not {@link EngineCapability}: file storage is not an engine capability (a storage is selected
+ * per field, not per application), and email is two capabilities (transactional and marketing) with one
+ * egress. The finer engine capability, where one exists, rides `engineCapability` beside it.
+ */
+export declare enum ProviderCapabilityEgress {
+    EMAIL = "email",
+    SMS = "sms",
+    BILLING = "billing",
+    FILE_STORAGE = "file_storage",
+    /** A captcha vendor's backend verification of a token a public form submitted (#1735). */
+    CAPTCHA = "captcha"
+}
+/** WHAT a capability call did (#1712). One member per act the egress performs; billing names its adapter method apart. */
+export declare enum ProviderCapabilityCallAction {
+    EMAIL_SEND = "email_send",
+    SMS_SEND = "sms_send",
+    /** One call of the billing adapter; `billingOperation` names which. */
+    BILLING_OPERATION = "billing_operation",
+    FILE_STORAGE_UPLOAD = "file_storage_upload",
+    FILE_STORAGE_DOWNLOAD = "file_storage_download",
+    FILE_STORAGE_READ_METADATA = "file_storage_read_metadata",
+    FILE_STORAGE_DELETE = "file_storage_delete",
+    /** One token sent to a captcha vendor's verification endpoint (reCAPTCHA `siteverify`). */
+    CAPTCHA_VERIFY = "captcha_verify"
+}
+/**
+ * How ONE capability call ended, as far as the application can know (#1712).
+ *
+ * Three members, not two, because a call can leave and never be answered: an email whose transport timed out after
+ * the request was sent may or may not have been accepted. Reporting that as a failure would invite a resend the
+ * vendor may already have honoured; reporting it as a success would claim what nobody observed.
+ */
+export declare enum ProviderCapabilityCallOutcome {
+    /** The vendor answered and accepted the call. */
+    SUCCEEDED = "succeeded",
+    /** The call was refused — by the vendor, or before it left (a missing credential, a refused request). */
+    FAILED = "failed",
+    /** The call left and its result was not observed (a timeout or a broken connection after sending). */
+    OUTCOME_UNKNOWN = "outcome_unknown"
+}
+export declare enum ProviderOperationDenialReason {
+    /**
+     * The caller authenticated without a person — an application API key, a machine identity. This door
+     * exists for a signed-in person's browser, and the policy's roles and the target-authorization port
+     * both reason about a person; a backend caller has the executor and the typed client instead.
+     */
+    MISSING_USER_SESSION = "missing_user_session",
+    /**
+     * The application's `providers.browserOperations` names no policy for this provider and operation.
+     * The fail-closed default: nothing is reachable from a browser unless declared. Also the answer for an
+     * operation that does not exist, so a refusal never reveals what a catalogue contains.
+     */
+    NOT_BROWSER_REACHABLE = "not_browser_reachable",
+    /** The request names a connection shape — owner scope × delegation — the operation's policy does not admit. */
+    CONNECTION_NOT_ADMITTED = "connection_not_admitted",
+    /**
+     * The policy declares roles and the target is the caller's OWN user account, over which nobody holds a
+     * role. A policy mistake rather than a caller's, recorded as its own reason so it is not read as a
+     * person lacking a role they could be granted.
+     */
+    ROLES_NOT_APPLICABLE_TO_TARGET = "roles_not_applicable_to_target",
+    /**
+     * The target-authorization port refused: the caller named an organization they do not belong to
+     * organization-wide, or a user account that is not their own.
+     */
+    TARGET_NOT_AUTHORIZED = "target_not_authorized",
+    /**
+     * The caller may act for the account, and holds none of the policy's roles — after hierarchy
+     * expansion, in the scope of that account. Checked AFTER {@link TARGET_NOT_AUTHORIZED}, so a person
+     * naming a tenant they do not belong to is recorded as that, not as a person short of a role.
+     */
+    INSUFFICIENT_ROLES = "insufficient_roles"
+}
 /**
  * Why the authorizer refused an operation. A CLOSED vocabulary — the authorizer resolves exactly
  * one of these per refusal, and a SOC dashboard groups by it.
@@ -392,6 +762,20 @@ export declare function describeAuditVocabulary(lead: string, meanings: Readonly
  * enumeration.
  */
 export declare enum ResourceOperationDenialReason {
+    /**
+     * The application requires consent purposes before it may be used
+     * (`compliance.serviceConsentRequirement`), and this person has not granted them (#534). The person is
+     * authenticated and may hold every role the operation needs; what is missing is their own decision.
+     * Distinct from every role/scope reason, because the remedy is the person's choice, not an administrator's.
+     */
+    SERVICE_CONSENT_REQUIRED = "service_consent_required",
+    /**
+     * ONE operation declared the purpose its own processing rests on
+     * (`ResourceOperationConsentGateDeclaration`), and this person has not granted it (#1258 Step 3).
+     * Distinct from {@link SERVICE_CONSENT_REQUIRED}: only this operation was refused, never the whole
+     * application.
+     */
+    CAPABILITY_CONSENT_REQUIRED = "capability_consent_required",
     /**
      * No initiator identity or roles on the execution context. Fail-closed: the authorizer refuses
      * rather than assuming an anonymous caller.
@@ -457,7 +841,82 @@ export declare enum ResourceOperationDenialReason {
      *
      * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
      */
-    APPLICATION_WIDE_ELEVATION_MISSING = "application_wide_elevation_missing"
+    APPLICATION_WIDE_ELEVATION_MISSING = "application_wide_elevation_missing",
+    /**
+     * The caller tried to GRANT authority it does not itself hold — a privilege-escalation attempt,
+     * refused by the role-ceiling gate (`assertRequestedRolesWithinCallerCeiling`).
+     *
+     * Its own member rather than {@link INSUFFICIENT_ROLES}, for the same reason
+     * {@link APPLICATION_WIDE_ELEVATION_MISSING} is: the caller PASSED the operation's role check —
+     * an `ORG_ADMIN` really may update a membership — and was refused on the CONTENT of the write.
+     * Folding the two together would make the single refusal an access review most wants to see
+     * indistinguishable from the everyday "you are not an admin", and a reviewer asking "has anyone
+     * tried to escalate?" would have nothing to count.
+     *
+     * Uniquely among the members here, the row carries {@link
+     * AuditableEvent_ResourceOperationDenied_EventDataSchema.escalatedRoles} — the roles that were
+     * actually asked for. `requiredRoles` and `initiatorRoles` cannot express it: neither is the set
+     * the caller tried to confer on somebody else.
+     *
+     * Raised OUTSIDE the authorization phase — the gate runs in custom-implementation prefixes, after
+     * the authorizer has returned — so it does not reach `classifyAuthorizationDenial`. The gate emits
+     * it directly through the same chokepoint, keeping the dedup window, the logarithmic escalation
+     * ladder and the loss counters.
+     *
+     * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — an attempt to grant authority the caller does
+     * not hold is refused AND recorded.
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+     */
+    ROLE_CEILING_EXCEEDED = "role_ceiling_exceeded",
+    /**
+     * A high-impact action was refused because the operation ITSELF demands a fresh re-proof of
+     * identity (`requiresStepUpAuthentication`), and the caller presented none.
+     *
+     * The caller is authenticated and may hold every role the operation needs. What is missing is a
+     * ceremony, so this belongs with {@link SERVICE_CONSENT_REQUIRED} rather than with
+     * {@link INSUFFICIENT_ROLES}: the remedy is an act by the same person, not a grant by an
+     * administrator.
+     *
+     * Paired with {@link STEP_UP_REQUIRED_BY_FRESHNESS} for the reason the two consent members are
+     * paired — the missing thing is the same and the party that DEMANDED it is not, and the two read
+     * very differently in a review. A burst of these is somebody repeatedly attempting an action the
+     * application has declared dangerous; a burst of the other is sessions ageing out.
+     *
+     * Raised OUTSIDE the authorization phase, like {@link ROLE_CEILING_EXCEEDED}: the step-up gate is
+     * a private check at the services-registry tier that throws without passing through the
+     * authorizer, so it reaches no `classifyAuthorizationDenial`. It emits through the same chokepoint
+     * instead, keeping the dedup window, the escalation ladder and the loss counters.
+     *
+     * assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — a refused high-impact action is
+     * recorded, not merely refused.
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+     */
+    STEP_UP_REQUIRED_BY_OPERATION = "step_up_required_by_operation",
+    /**
+     * The same refusal, demanded by the USER TYPE's freshness policy (`UserTypeAuthPolicy.stepUpAuth`)
+     * rather than by the operation: the caller's authentication is older than the declared maximum age.
+     *
+     * Distinct from {@link STEP_UP_REQUIRED_BY_OPERATION} because the two send a reviewer to different
+     * places — one to the operation's own declaration, the other to the user-type policy — and because
+     * only this one varies with how long a person has been signed in. The refusal's own error context
+     * already carried the distinction before either was audited; this keeps it in the durable record.
+     *
+     * assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+     */
+    STEP_UP_REQUIRED_BY_FRESHNESS = "step_up_required_by_freshness",
+    /**
+     * A service firm's expert was refused in a CLIENT organization because the client organization type's
+     * authentication policy asks for a factor the session has not satisfied FOR THAT CLIENT (#1633).
+     *
+     * Distinct from the two above because the party that demanded the proof is a third one: not the operation, not the
+     * expert's own user type, but the TENANT the expert is working in. A reviewer reading the client's trail sees its
+     * own policy being enforced on outside staff; the row carries the relationship through the usual attribution.
+     *
+     * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the resource tenant's authentication policy is enforced on external experts, per request.
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+     */
+    STEP_UP_REQUIRED_BY_CLIENT_ORGANIZATION_POLICY = "step_up_required_by_client_organization_policy"
 }
 /** SSO configuration change type. */
 export declare enum SsoConfigChangeType {
@@ -521,8 +980,26 @@ export declare enum MachineAccessOperation {
      */
     A2A_TASKS_LIST = "a2a_tasks_list",
     MCP_TOOLS_LIST = "mcp_tools_list",
-    MCP_TOOLS_CALL = "mcp_tools_call"
+    MCP_TOOLS_CALL = "mcp_tools_call",
+    /**
+     * A MACHINE principal's READ / LIST / SEARCH on a DECLARED cross-tenant REST door
+     * (`admitsCrossTenantPlatformAdministration`) — today the application audit-log door.
+     *
+     * Deliberately NOT every REST call a machine makes: the plain resource API is audited per operation
+     * through `RESOURCE_OPERATION_PERFORMED`, which carries `machineCredentialId`. These three exist because a
+     * declared crossing's only other row, `CROSS_TENANT_ADMINISTRATIVE_ACCESS`, is written per TENANT REACHED —
+     * so a machine read returning only application-wide rows, or nothing, left no row naming who read (#297).
+     * One member per verb, like the A2A task members: a LIST enumerates, a READ fetches a row somebody named.
+     */
+    API_READ = "api_read",
+    API_LIST = "api_list",
+    API_SEARCH = "api_search"
 }
+/**
+ * The MACHINE_ACCESS identifier for an executed REST read, or `undefined` for any verb that is not one.
+ * The one place the core-operation → audit-vocabulary mapping lives, so a recorder never spells it.
+ */
+export declare function resolveApiReadMachineAccessOperation(operation: CoreResourceOperation | undefined): MachineAccessOperation | undefined;
 export declare const AuditableEventTypeSchema: z.ZodUnion<readonly [z.ZodEnum<typeof CoreAuditableEventType>, z.ZodString]>;
 export declare const AuditableEvent_User_LoginEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_LOGIN>;
@@ -836,6 +1313,7 @@ export declare const AuditableEvent_OrganizationMember_RoleChangedEventDataSchem
     requestedRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
     operation: z.ZodString;
     changedBy: z.ZodString;
+    justification: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /**
  * Per-unit role assignment on an `ORGANIZATION_UNIT_MEMBERS` row.
@@ -973,6 +1451,85 @@ export declare const AuditableEvent_Organization_UpdatedEventDataSchema: z.ZodOb
     changes: z.ZodRecord<z.ZodString, z.ZodAny>;
     updatedBy: z.ZodString;
 }, z.core.$strip>;
+/**
+ * WHY an organization was assigned the type it now carries, when no person chose it.
+ *
+ * A closed vocabulary, deliberately named rather than implied: the assignment is only defensible because the answer
+ * was DERIVED, and a reader of the audit row must be able to see which derivation produced it without re-deriving
+ * the application's configuration — or its membership rows — as they stood at that boot. The two members answer
+ * from different evidence, which is exactly why a single "derived" value would not do: one is a fact about the
+ * DECLARATION and stays true however the tenant changes, the other is a fact about the ORGANIZATION on one day.
+ */
+export declare enum OrganizationTypeAssignmentBasis {
+    /**
+     * The application declares exactly one organization type, so an organization whose type resolves to nothing —
+     * none stored, or one the declaration no longer carries — can only be that type: it is the only policy the
+     * application has. Nothing is guessed, and nothing about the organization was read.
+     */
+    SOLE_DECLARED_TYPE = "sole_declared_type",
+    /**
+     * The application declares several organization types, and exactly one of them covers every user type held by
+     * this organization's own members — so the others are types this organization cannot be. Nothing is guessed: it
+     * is the coverage test the first-administrator organization's type is already derived by, asked of the members.
+     *
+     * Narrower than {@link SOLE_DECLARED_TYPE} in what it proves. It reports the answer for the membership as it
+     * stood at that boot; an organization whose members later span two declared types would not derive again. That is
+     * why the row records the basis rather than only the outcome — a reviewer asking "could this have been wrong?"
+     * needs to know which question was answered.
+     */
+    MEMBER_USER_TYPES = "member_user_types",
+    /**
+     * An operator promoted this organization to the one that OWNS the application, through
+     * `organizations.promoteToOwnerOrganization` (#1054).
+     *
+     * The odd one out of the three, and deliberately kept in the same event rather than given its own.
+     * What the event records is "this organization's `type` changed, and here is what decided it" — true
+     * of all three — and an access reviewer asking "how did this tenant come to be typed this way?" must
+     * find one row wherever the answer lies, not two events they have to know to look for separately.
+     *
+     * What differs is everything a derivation does not have: there IS an actor (the audit row carries
+     * them, and {@link AuditableEvent_Organization_TypeAssignedEventData.justification} carries their
+     * stated reason), the previous type is always present, and the decision was a human's. A row
+     * carrying this basis is the only one on which `justification` may appear — the other two are
+     * derivations, and a derivation has nothing to justify.
+     */
+    OPERATOR_PROMOTION = "operator_promotion"
+}
+/**
+ * An organization whose type resolved to nothing — none stored, or one no longer declared — was assigned one by the
+ * engine at boot.
+ *
+ * ## Why this is its own event rather than an `ORGANIZATION_UPDATED`
+ *
+ * An organization's type is not a label. It decides which user types its members hold, which authentication
+ * methods they may use, and which step-up policy applies to them — so assigning one changes what every member of
+ * that tenant can do at sign-in. Folded into a generic `changes` map it would be an authentication-relevant
+ * change with no actor, filed where an access review does not look.
+ *
+ * ## Who the actor is, per basis
+ *
+ * For the two DERIVATIONS there is none, and that is the point: organizations minted before the type was required
+ * (the platform's own seeds, the first-administrator bootstrap) were typeless, and the engine repairs them before
+ * the first read that would refuse them. `basis` is what makes that repair legible as a derivation instead of a
+ * write nobody made, and those rows carry no `userId` because the application-scope repair has no initiator.
+ *
+ * For {@link OrganizationTypeAssignmentBasis.OPERATOR_PROMOTION} there IS one. It rides where every other
+ * operator action's actor does — on the audit ROW, resolved from the execution context — rather than as a field
+ * here, so an access review reads it the same way it reads a suspension or an ownership grant. What this schema
+ * adds for that basis is the one thing the row cannot carry: the operator's stated REASON (`RESOURCE_OPERATION_PERFORMED`
+ * carries no request payload, which is how `grantOwnership`'s required justification went unrecorded for months — #593).
+ *
+ * assurance-control: WILDO.AUDIT.SECURITY_EVENT — an authentication-relevant attribute of a tenant changed, and the
+ * record says what decided it and, when a person did, who and why.
+ */
+export declare const AuditableEvent_Organization_TypeAssignedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_TYPE_ASSIGNED>;
+    organizationId: z.ZodString;
+    organizationType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    previousType: z.ZodOptional<z.ZodString>;
+    basis: z.ZodEnum<typeof OrganizationTypeAssignmentBasis>;
+    justification: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 export declare const AuditableEvent_Organization_DeletedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_DELETED>;
     organizationId: z.ZodString;
@@ -1101,13 +1658,14 @@ export declare const AuditableEvent_Organization_ActivatedEventDataSchema: z.Zod
  */
 export declare const ApplicationAuthPolicySnapshotSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
 /**
- * The application's authored authentication policy changed between two boots.
+ * The application's authored authentication or audit-viewer admission policy changed between two boots.
  *
  * The per-user-type authentication policy (`userTypes.<type>.auth` — MFA, password, and lockout
  * requirements) is STATIC application configuration authored in code and taken into effect at backend
  * startup. A change to it — most consequentially a WEAKENING such as turning MFA off — is a
  * security-posture decision that, before this event, left no product-side record: only the source
- * history showed it. This event closes that gap.
+ * history showed it. This event closes that gap. The effective `auditTrail.applicationReadAccess`
+ * posture is recorded separately from the user-type snapshots and compared independently.
  *
  * It is emitted at boot, by the system, when the resolved policy snapshot differs from the last one
  * recorded in the trail (detected by comparing against the most recent event of this type for the
@@ -1129,6 +1687,10 @@ export declare const AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema
     snapshotDigest: z.ZodString;
     before: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
     after: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    auditApplicationReadAccess: z.ZodOptional<z.ZodObject<{
+        before: z.ZodNullable<z.ZodEnum<typeof AuditApplicationReadAccess>>;
+        after: z.ZodEnum<typeof AuditApplicationReadAccess>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 /**
  * A governed lifecycle transition changed a subject's `status`.
@@ -1188,6 +1750,11 @@ export declare const AuditableEvent_OrganizationUnit_UpdatedEventDataSchema: z.Z
     updatedBy: z.ZodString;
 }, z.core.$strip>;
 export declare const AuditableEvent_User_SSOLoginEventDataSchema: z.ZodObject<{
+    assurance: z.ZodOptional<z.ZodObject<{
+        decision: z.ZodEnum<typeof import("../..").ExternalAssuranceDecision>;
+        reason: z.ZodEnum<typeof import("../..").ExternalAssuranceReason>;
+        enforcement: z.ZodEnum<typeof import("../..").ExternalAssuranceEnforcement>;
+    }, z.core.$strip>>;
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_SSO_LOGIN>;
     userId: z.ZodString;
     email: z.ZodEmail;
@@ -1202,6 +1769,11 @@ export declare const AuditableEvent_User_SSOLoginEventDataSchema: z.ZodObject<{
     sessionId: z.ZodString;
 }, z.core.$strip>;
 export declare const AuditableEvent_User_SSOLoginFailedEventDataSchema: z.ZodObject<{
+    assurance: z.ZodOptional<z.ZodObject<{
+        decision: z.ZodEnum<typeof import("../..").ExternalAssuranceDecision>;
+        reason: z.ZodEnum<typeof import("../..").ExternalAssuranceReason>;
+        enforcement: z.ZodEnum<typeof import("../..").ExternalAssuranceEnforcement>;
+    }, z.core.$strip>>;
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_SSO_LOGIN_FAILED>;
     email: z.ZodOptional<z.ZodEmail>;
     providerRef: z.ZodOptional<z.ZodString>;
@@ -1214,12 +1786,29 @@ export declare const AuditableEvent_User_SSOLoginFailedEventDataSchema: z.ZodObj
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
 }, z.core.$strip>;
+/**
+ * A sign-in was refused because the claiming scope requires SSO (#1242).
+ *
+ * `organizationId` was REQUIRED here, and that is what made the event unemittable at half its own
+ * refusal sites: `enforcement.requireSSO` lives on the POLYMORPHIC SSO config, so an APPLICATION-scope
+ * policy refuses sign-ins for the application itself and there is no organization to name. Requiring
+ * one would have left exactly those refusals with no trail — the outcome this CRITICAL event exists to
+ * prevent. It now carries either scope and refuses anything but exactly one, following
+ * `EMERGENCY_ACCESS_USED`, which was widened for the same reason on the same config.
+ *
+ * `attemptedProviderRef` and `attemptedConnectionType` are OPTIONAL because two of the four refusal
+ * sites have no attempted provider at all: a password sign-in and a registration are refused BECAUSE
+ * no SSO was attempted. Requiring them would have forced a placeholder, and a placeholder in an
+ * audit row is worse than an absent field — it is a fact nobody can distinguish from a real one.
+ */
 export declare const AuditableEvent_User_SSOEnforcementBlockedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED>;
     email: z.ZodEmail;
-    attemptedProviderRef: z.ZodString;
-    attemptedConnectionType: z.ZodEnum<typeof SsoConnectionType>;
-    organizationId: z.ZodString;
+    attemptedProviderRef: z.ZodOptional<z.ZodString>;
+    attemptedConnectionType: z.ZodOptional<z.ZodEnum<typeof SsoConnectionType>>;
+    scopeType: z.ZodEnum<typeof AuthScopeType>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    applicationId: z.ZodOptional<z.ZodString>;
     enforcementPolicy: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
@@ -1240,12 +1829,33 @@ export declare const AuditableEvent_Organization_SSOConfigurationChangedEventDat
     changes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
 }, z.core.$strip>;
 export declare const AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema: z.ZodObject<{
+    organizationId: z.ZodString;
+    changedBy: z.ZodString;
+    changeType: z.ZodEnum<typeof SiemExportChangeType>;
+    webhookUrlDomain: z.ZodOptional<z.ZodString>;
+    eventFormatConfigured: z.ZodOptional<z.ZodString>;
+    changedFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED>;
+}, z.core.$strip>;
+/** Export turned OFF (#986). Same fields; its own kind so it classifies CRITICAL. */
+export declare const AuditableEvent_Organization_SIEMExportDisabledEventDataSchema: z.ZodObject<{
+    organizationId: z.ZodString;
+    changedBy: z.ZodString;
+    changeType: z.ZodEnum<typeof SiemExportChangeType>;
+    webhookUrlDomain: z.ZodOptional<z.ZodString>;
+    eventFormatConfigured: z.ZodOptional<z.ZodString>;
+    changedFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_DISABLED>;
+}, z.core.$strip>;
+/** Export re-pointed at another destination (#986). Same fields; its own kind so it classifies WARNING. */
+export declare const AuditableEvent_Organization_SIEMExportDestinationChangedEventDataSchema: z.ZodObject<{
     organizationId: z.ZodString;
     changedBy: z.ZodString;
     changeType: z.ZodEnum<typeof SiemExportChangeType>;
     webhookUrlDomain: z.ZodOptional<z.ZodString>;
     eventFormatConfigured: z.ZodOptional<z.ZodString>;
+    changedFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_DESTINATION_CHANGED>;
 }, z.core.$strip>;
 /**
  * A tenant granted this application authority to act as it toward a third party.
@@ -1257,6 +1867,7 @@ export declare const AuditableEvent_OrganizationProviderCredential_SetEventDataS
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET>;
     organizationId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     setBy: z.ZodOptional<z.ZodString>;
     credentialId: z.ZodString;
@@ -1274,6 +1885,7 @@ export declare const AuditableEvent_OrganizationProviderCredential_RotatedEventD
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED>;
     organizationId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     rotatedBy: z.ZodOptional<z.ZodString>;
     credentialId: z.ZodString;
@@ -1295,9 +1907,12 @@ export declare const AuditableEvent_OrganizationProviderCredential_UsedEventData
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED>;
     organizationId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
+    providerPackageName: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     resolvedFrom: z.ZodEnum<typeof ProviderCredentialResolutionSource>;
     credentialId: z.ZodOptional<z.ZodString>;
+    credentialSetByUserId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /**
  * The grant ended — by the tenant removing it, or by the tenant itself being purged.
@@ -1312,10 +1927,12 @@ export declare const AuditableEvent_OrganizationProviderCredential_DeletedEventD
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED>;
     organizationId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     deletedBy: z.ZodOptional<z.ZodString>;
     credentialId: z.ZodString;
     reason: z.ZodEnum<typeof ProviderCredentialDeletionReason>;
+    vendorRevocation: z.ZodOptional<z.ZodEnum<typeof import("../..").ProviderOAuth2RevocationOutcome>>;
 }, z.core.$strip>;
 /**
  * A PERSON connected their own account at a third party to this application.
@@ -1338,6 +1955,7 @@ export declare const AuditableEvent_UserProviderCredential_SetEventDataSchema: z
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_SET>;
     userId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     credentialId: z.ZodString;
 }, z.core.$strip>;
@@ -1349,9 +1967,12 @@ export declare const AuditableEvent_UserProviderCredential_SetEventDataSchema: z
  *
  * `grantedScopes` is what the VENDOR said it issued, not what was asked for. The two differ often
  * enough to matter: a vendor may narrow a request against what the account is permitted, and the
- * answer to "what could this application actually do as them" is the granted set. Optional because
- * several vendors return no scope at all on a token response, and an empty array would assert
- * something stronger than silence.
+ * answer to "what could this application actually do as them" is the granted set. Since #1671 it is the
+ * set the stored grant RECORDS after this authorization: a token answer without `scope` granted what was
+ * requested (RFC 6749 §5.1), and a re-authorization of a vendor that accumulates consent unites the new
+ * answer with the previous consent (`consentAccumulated`). Optional because a grant may record none, and an
+ * empty array would assert something stronger than silence.
+ * spec-cite: RFC 6749 §5.1 (the `scope` row of the access token response).
  *
  * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — a user authorizes third-party
  * delegated access, and the authorization's extent is recorded with it.
@@ -1360,11 +1981,17 @@ export declare const AuditableEvent_UserProviderConnection_GrantedEventDataSchem
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PROVIDER_CONNECTION_GRANTED>;
     userId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
+    providerPackageName: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     credentialId: z.ZodString;
     grantedScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
     accountRef: z.ZodOptional<z.ZodString>;
     replacedExistingConnection: z.ZodBoolean;
+    addedScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    addedForOperationId: z.ZodOptional<z.ZodString>;
+    addedForPackageName: z.ZodOptional<z.ZodString>;
+    consentAccumulated: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 /**
  * An ORGANIZATION's delegated authorization toward a vendor was granted.
@@ -1383,12 +2010,20 @@ export declare const AuditableEvent_OrganizationProviderConnection_GrantedEventD
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CONNECTION_GRANTED>;
     organizationId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
+    providerPackageName: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     credentialId: z.ZodString;
     grantedByUserId: z.ZodOptional<z.ZodString>;
     grantedScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
     accountRef: z.ZodOptional<z.ZodString>;
     replacedExistingConnection: z.ZodBoolean;
+    delegation: z.ZodOptional<z.ZodEnum<typeof ExternalProvider_Connection_DelegationMode>>;
+    organizationWideUseAcknowledged: z.ZodOptional<z.ZodBoolean>;
+    addedScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    addedForOperationId: z.ZodOptional<z.ZodString>;
+    addedForPackageName: z.ZodOptional<z.ZodString>;
+    consentAccumulated: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 /**
  * The stored VALUE changed for a person's credential that already existed.
@@ -1404,6 +2039,7 @@ export declare const AuditableEvent_UserProviderCredential_RotatedEventDataSchem
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_ROTATED>;
     userId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     credentialId: z.ZodString;
     previousSecretSetAt: z.ZodOptional<z.ZodString>;
@@ -1423,30 +2059,42 @@ export declare const AuditableEvent_UserProviderCredential_UsedEventDataSchema:
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_USED>;
     userId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
+    providerPackageName: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     resolvedFrom: z.ZodEnum<typeof ProviderCredentialResolutionSource>;
     credentialId: z.ZodString;
 }, z.core.$strip>;
 /**
- * The person's grant ended — by them removing it, or by their own erasure.
+ * The person's grant ended — by them removing it, by their own erasure, or by their account being deleted.
  *
  * `reason` matters more here than on the organization sibling. A credential removed by a cascade
  * from a subject-erasure request is EVIDENCE that the erasure reached this store, and it is the
  * evidence an operator produces when asked whether a person's third-party keys were destroyed. The
  * row itself is gone by then, so the event is all that remains.
  *
+ * `deletedBy` exists for the one reason whose actor is NOT the person: `reason: USER_DELETED`, an
+ * account deletion (#1016) — an administrator's hard delete or the invitation sweep reaping a pending
+ * user — where it names the deleting principal (the administrator's user id, or the `SYSTEM` sentinel).
+ * Absent on the owner's own revoke, whose actor is `userId` by construction.
+ *
  * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — evidence that delegated authority
  * was withdrawn.
- * assurance-control: WILDO.PRIVACY.ERASURE — evidence that erasure destroyed the subject's
- * third-party credentials.
+ * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — evidence that erasure destroyed the
+ * subject's third-party credentials: one row per destroyed credential with `reason: USER_ERASED`,
+ * written by the credential resource's parent-cascade removal observer because the erasure cascade
+ * removes these rows through the raw repository (#975).
  */
 export declare const AuditableEvent_UserProviderCredential_DeletedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED>;
     userId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
+    deletedBy: z.ZodOptional<z.ZodString>;
     credentialId: z.ZodString;
     reason: z.ZodEnum<typeof ProviderCredentialDeletionReason>;
+    vendorRevocation: z.ZodOptional<z.ZodEnum<typeof import("../..").ProviderOAuth2RevocationOutcome>>;
 }, z.core.$strip>;
 /**
  * One `webhookConfig.testEndpoint` attempt — an admin causing the platform to open an
@@ -1474,6 +2122,184 @@ export declare const AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchem
     durationMs: z.ZodNumber;
     signatureJti: z.ZodString;
 }, z.core.$strip>;
+export declare const AuditableEvent_InboundDelivery_RejectedEventDataSchema: z.ZodObject<{
+    reason: z.ZodEnum<typeof InboundDeliveryRejectionReason>;
+    refusalCount: z.ZodNumber;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_REJECTED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundDelivery_AcceptedEventDataSchema: z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    resolvedScopeKind: z.ZodEnum<typeof InboundResolvedScopeKind>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    channel: z.ZodEnum<typeof InboundChannelKind>;
+    senderAssurance: z.ZodEnum<typeof InboundSenderAssurance>;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_ACCEPTED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundDelivery_UnroutableEventDataSchema: z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    reason: z.ZodEnum<typeof InboundDeliveryUnroutableReason>;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_UNROUTABLE>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundDelivery_ProcessedEventDataSchema: z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    attempt: z.ZodNumber;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_PROCESSED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundDelivery_FailedEventDataSchema: z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    attempt: z.ZodNumber;
+    errorCode: z.ZodString;
+    nextAttemptAt: z.ZodDate;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_FAILED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundDelivery_DeadEventDataSchema: z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    attempts: z.ZodNumber;
+    errorCode: z.ZodString;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_DEAD>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundDelivery_ReplayedEventDataSchema: z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    replayedBy: z.ZodString;
+    justification: z.ZodString;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_REPLAYED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundDelivery_BelowAssuranceEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_BELOW_ASSURANCE>;
+    channel: z.ZodEnum<typeof InboundChannelKind>;
+    handlerRef: z.ZodString;
+    senderAssurance: z.ZodEnum<typeof InboundSenderAssurance>;
+    minimumSenderAssurance: z.ZodEnum<typeof InboundSenderAssurance>;
+    disposition: z.ZodEnum<typeof InboundBelowMinimumDisposition>;
+    belowMinimumHandlerRef: z.ZodOptional<z.ZodString>;
+    inboundDeliveryId: z.ZodOptional<z.ZodString>;
+    channelMessageId: z.ZodString;
+    organizationId: z.ZodString;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundReply_SentEventDataSchema: z.ZodObject<{
+    templateRef: z.ZodString;
+    recipientCount: z.ZodNumber;
+    deduplicated: z.ZodBoolean;
+    channel: z.ZodEnum<typeof InboundChannelKind>;
+    threadId: z.ZodString;
+    conversationMessageId: z.ZodString;
+    submissionId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_REPLY_SENT>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundReply_FailedEventDataSchema: z.ZodObject<{
+    failureCode: z.ZodString;
+    channel: z.ZodEnum<typeof InboundChannelKind>;
+    threadId: z.ZodString;
+    conversationMessageId: z.ZodString;
+    submissionId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_REPLY_FAILED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundReplyToken_RevokedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_REPLY_TOKEN_REVOKED>;
+    threadId: z.ZodString;
+    replyTokenId: z.ZodString;
+    reason: z.ZodEnum<typeof ReplyTokenRevocationReason>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundReplyToken_DowngradedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_REPLY_TOKEN_DOWNGRADED>;
+    threadId: z.ZodString;
+    replyTokenId: z.ZodString;
+    reason: z.ZodEnum<typeof ReplyTokenDowngradeReason>;
+    derivedAssurance: z.ZodEnum<typeof InboundSenderAssurance>;
+}, z.core.$strip>;
+export declare const AuditableEvent_OrganizationEmailDomain_ClaimedEventDataSchema: z.ZodObject<{
+    sending: z.ZodBoolean;
+    receiving: z.ZodBoolean;
+    organizationId: z.ZodString;
+    organizationEmailDomainId: z.ZodString;
+    domain: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_CLAIMED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_OrganizationEmailDomain_OwnershipVerifiedEventDataSchema: z.ZodObject<{
+    providerRef: z.ZodString;
+    providerDomainId: z.ZodString;
+    organizationId: z.ZodString;
+    organizationEmailDomainId: z.ZodString;
+    domain: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_OWNERSHIP_VERIFIED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_OrganizationEmailDomain_VerifiedEventDataSchema: z.ZodObject<{
+    status: z.ZodEnum<typeof OrganizationEmailDomainStatus>;
+    organizationId: z.ZodString;
+    organizationEmailDomainId: z.ZodString;
+    domain: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_VERIFIED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_OrganizationEmailDomain_SuspendedEventDataSchema: z.ZodObject<{
+    reason: z.ZodEnum<typeof OrganizationEmailDomainSuspensionReason>;
+    organizationId: z.ZodString;
+    organizationEmailDomainId: z.ZodString;
+    domain: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_SUSPENDED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_OrganizationEmailDomain_RemovedEventDataSchema: z.ZodObject<{
+    trigger: z.ZodEnum<typeof OrganizationEmailDomainRemovalTrigger>;
+    providerDomainDeleted: z.ZodBoolean;
+    organizationId: z.ZodString;
+    organizationEmailDomainId: z.ZodString;
+    domain: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_REMOVED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_ClientMailbox_CreatedEventDataSchema: z.ZodObject<{
+    organizationId: z.ZodString;
+    clientMailboxId: z.ZodString;
+    address: z.ZodString;
+    emailDomainId: z.ZodString;
+    serviceProviderRelationshipId: z.ZodString;
+    firmOrganizationId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.CLIENT_MAILBOX_CREATED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_ClientMailbox_RemovedEventDataSchema: z.ZodObject<{
+    organizationId: z.ZodString;
+    clientMailboxId: z.ZodString;
+    address: z.ZodString;
+    emailDomainId: z.ZodString;
+    serviceProviderRelationshipId: z.ZodString;
+    firmOrganizationId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.CLIENT_MAILBOX_REMOVED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundEmail_AttachmentWithheldEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_EMAIL_ATTACHMENT_WITHHELD>;
+    organizationId: z.ZodString;
+    inboundEmailId: z.ZodString;
+    reason: z.ZodEnum<typeof InboundEmailWithheldReason>;
+    fileId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundEmail_RejectedLimitEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_EMAIL_REJECTED_LIMIT>;
+    organizationId: z.ZodString;
+    inboundEmailId: z.ZodString;
+    limit: z.ZodEnum<typeof InboundEmailLimit>;
+    sizeBytes: z.ZodNumber;
+    attachmentCount: z.ZodNumber;
+}, z.core.$strip>;
 export declare const AuditableEvent_SCIM_TokenCreatedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.SCIM_TOKEN_CREATED>;
     organizationId: z.ZodString;
@@ -1553,6 +2379,8 @@ export declare const AuditableEvent_User_RegisteredEventDataSchema: z.ZodObject<
     email: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
+    acquisitionChannel: z.ZodOptional<z.ZodEnum<typeof RegistrationAcquisitionChannel>>;
+    providerRef: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const AuditableEvent_User_EmailVerifiedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_EMAIL_VERIFIED>;
@@ -1859,7 +2687,8 @@ export declare const AuditableEvent_FieldAccess_EventDataSchema: z.ZodObject<{
  *
  * ## Correlation across a cascade
  *
- * Every execution surface emits — API, internal call, and repository-only — so one tenant deletion
+ * The framework-managed lane covers API, internal call and repository-only writes; OVERRIDE_ALL
+ * implementations own their committed emission. A framework-managed tenant deletion
  * produces one row per cascaded child. The top-level `correlationId` is inherited by every sub-call
  * context and preserved across mid-flight operation corrections, so it groups the whole fan-out to one request;
  * `subCallDepth` separates the initiating operation (0) from what it cascaded into.
@@ -1868,7 +2697,8 @@ export declare const AuditableEvent_FieldAccess_EventDataSchema: z.ZodObject<{
  *
  * `changedFields` names every field the write touched — a field NAME is not personal data, so it is
  * always safe and always recorded. `fieldEvidence` carries before/after VALUES only for fields the
- * schema marks `.isAuditEvidence()`.
+ * schema marks `.isAuditEvidence()`. The separate `reason` records an explicitly selected operator
+ * justification, not an arbitrary request payload or a copy of a mutable resource reason field.
  *
  * Values are limited on purpose: audit rows replicate to the per-org SIEM and to the immutable
  * ledger, and **the immutable ledger cannot be scrubbed** — so copying arbitrary personal data into
@@ -1889,126 +2719,102 @@ export declare const AuditableEvent_ResourceOperationPerformed_EventDataSchema:
     isBulkOperation: z.ZodOptional<z.ZodBoolean>;
     resourceId: z.ZodOptional<z.ZodString>;
     affectedRecordCount: z.ZodOptional<z.ZodNumber>;
+    affectedResourceIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
     initiatorRoles: z.ZodArray<z.ZodString>;
     executionType: z.ZodEnum<typeof ExecutionContext_ExecutionType>;
     machineCredentialAuthMethod: z.ZodOptional<z.ZodString>;
     machineCredentialId: z.ZodOptional<z.ZodString>;
     subCallDepth: z.ZodNumber;
+    reason: z.ZodOptional<z.ZodString>;
     changedFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
     fieldEvidence: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         before: z.ZodOptional<z.ZodUnknown>;
         after: z.ZodOptional<z.ZodUnknown>;
     }, z.core.$strip>>>;
 }, z.core.$strip>;
+/** A legal hold was placed (#1634). */
+export declare const AuditableEvent_LegalHoldPlaced_EventDataSchema: z.ZodObject<{
+    placedByUserId: z.ZodString;
+    holdId: z.ZodString;
+    heldOrganizationId: z.ZodString;
+    scopeKind: z.ZodEnum<typeof LegalHoldScopeKind>;
+    legalGround: z.ZodEnum<typeof LegalHoldGround>;
+    placementTier: z.ZodEnum<typeof LegalHoldPlacementTier>;
+    heldResourceType: z.ZodOptional<z.ZodString>;
+    heldRowCount: z.ZodOptional<z.ZodNumber>;
+    subjectUserId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.LEGAL_HOLD_PLACED>;
+}, z.core.$strip>;
 /**
- * An operation the authorizer REFUSED. The other half of "record access decisions" — the negative
- * decision, which until now left no trace anywhere in the framework.
- *
- * ## Emitted pre-dispatch, from the one funnel
- *
- * Every public entry point of `AuthorizationsBackendService` converges on the same two inner phase
- * runners — `authorizeInController` (HTTP controller, MCP, WebSocket, queue, field validation),
- * `authorizeInProgrammaticSurface` (a non-controller surface that faces an external caller), and
- * `authorizeInRepositoryAndService`, which has exactly one caller — `authorizeInController` itself.
- * So a single instrumentation point observes every refusal THE AUTHORIZER MAKES, with the operation
- * and execution context both in scope. No mutation has occurred when this row is written; nothing is
- * rolled back by it.
- *
- * **The scope of that claim, stated because an earlier revision overstated it.** It used to read
- * "the sole production entry point for every execution surface", which asserts something stronger
- * and false: that every execution surface passes the role gate. A programmatic operation entering at
- * the SERVICE tier (`ServicesRegistryHandlerBackendService.read` / `list` / …) reaches no authorizer
- * at all — deliberately, because that population includes the reads that ESTABLISH identity before a
- * role-bearing principal exists. So the absence of a row here means "the authorizer refused nothing",
- * never "nothing was read". See `AuthorizationsBackendService.authorizeInProgrammaticSurface` for the
- * layering decision and the door.
- *
- * ## What it is NOT
- *
- * - **Not an authentication failure.** `USER_LOGIN_FAILED` / `MACHINE_AUTH_FAILED` say "you are not
- *   who you claim to be". This says "you are, and you may not do this". Distinct types, distinct
- *   categories, neither overloaded.
- * - **Not an `outcome: 'denied'` variant of {@link AuditableEvent_ResourceOperationPerformed_EventDataSchema}.**
- *   That event is emitted from the post-commit lane, which by construction can only observe
- *   operations that already took effect. A refusal never reaches it.
- *
- * ## Volume: bounded by dedup, NOT by a risk floor
- *
- * Denial volume is attacker-drivable in a way the success path's never is. A risk floor was
- * considered and rejected as the control: it would exclude 100% of denied READS (zero of the
- * catalogue's HIGH/CRITICAL variants are reads, while 371 of 551 API-reachable variants are) —
- * discarding the canonical reconnaissance signal — while not capping the adversarial worst case at
- * all, since the attacker chooses which endpoint to hammer.
- *
- * The actual bound is a per-principal / per-operation / per-reason dedup window. Rather than
- * suppressing repeats outright (which would erase the storm — the very signal a security-operations team wants),
- * emission escalates on a LOGARITHMIC ladder: the 1st, 10th, 100th, … refusal in the window each
- * emit one row carrying {@link occurrenceCount}. A burst of 10 000 identical denials therefore
- * costs 5 rows and remains legible as a burst.
- *
- * Dedup is best-effort and FAILS OPEN (emit) when the counter store is unavailable — a fail-closed
- * cooldown would let an attacker blind the audit trail by taking Redis down.
- *
- * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
- */
-/**
- * A platform operator acted on a row belonging to a tenant they are not a member of.
- *
- * ## Why this event exists
- *
- * Wildo's answer to "may a platform super-administrator administer any tenant?" is YES — the same
- * answer most mature B2B platforms give, because support and incident response genuinely need it.
- * What those platforms do NOT do is leave the reach implicit. Support access is a named, logged
- * event, because the difference between legitimate operator work and quiet snooping is not the
- * capability — both use the identical capability — it is whether anyone can tell afterwards.
- *
- * Until 2026-08-05 Wildo had the capability with none of the visibility, and by accident rather than
- * declaration: per-instance org-scoped requests are checked by `authorizeOrganizations`, which
- * compares the fetched row's organization against a scope the SAME REQUEST supplied through its URL.
- * A non-member operator therefore passed it silently. Measured over real HTTP by
- * `organization-ownership-grant-hostile.e2e.ts` probe F-1a, which deleted a membership row in
- * another tenant and got a 200.
- *
- * This event is the visibility half, and it is NOT the refusal. The refusal shipped separately and
- * lives in `authorizeOrganizations`: an undeclared crossing is no longer admitted, and the caller is
- * answered as not-found so the response cannot be used as an existence oracle. Emission here stays
- * best-effort and never blocks the request: an operator action must not fail because the audit sink
- * is down, and a fail-closed variant would let anyone disable operator support by breaking the sink.
- * The observation is taken BEFORE the admission decision, on purpose, so a sanctioned crossing is
- * recorded too.
- *
- * ## Reading the event
- *
- * {@link admissionDeclared} is the field that matters most. `true` means the operation VARIANT
- * declared `admitsCrossTenantPlatformAdministration` — an intended, reviewed crossing such as
- * `organizationMembers.grantOwnership`, which additionally requires a usable platform access grant.
- * `false` now means an ATTEMPTED undeclared crossing, which was refused: still the population to
- * watch, because it is reach nobody declared and no specification describes.
- *
- * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — platform-tier access to a tenant the
- * principal does not belong to.
- * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
- */
-/**
- * One transition in the life of a platform access grant.
- *
- * The crossing itself is recorded by {@link CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS}.
- * This is the other half, and a reviewer needs both: that event answers "an operator reached into
- * this tenant", this one answers "on what authority, asked for when, and who agreed".
- *
- * Deliberately two events rather than one enriched one. A grant is requested once and may authorise
- * many crossings across its window, so folding them together would either duplicate the grant's
- * details onto every access or lose the request/decision timeline entirely.
- *
- * {@link autoApprovalReason} is the field a customer audit turns on. Its ABSENCE on an approved grant
- * means a human in the tenant said yes. `TENANT_APPROVAL_NOT_REQUIRED` means the tenant had not opted
- * into approval. `TENANT_CANNOT_APPROVE` means the tenant had no administratively usable owner and
- * could not consent — the one path where operator access proceeds against a tenant that never agreed
- * and never could, which is why the emitter carries it at a higher risk level.
- *
- * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION
- * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of a privileged assignment's full life.
+ * A model-cost period aggregate was linked to its invoice (#1598). Identifiers, the period and the currency
+ * only: no amount (the aggregate row holds it), no personal data.
  */
+export declare const AuditableEvent_ModelCostAggregateInvoiceLinked_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.MODEL_COST_AGGREGATE_INVOICE_LINKED>;
+    aggregateId: z.ZodString;
+    billedOrganizationId: z.ZodString;
+    periodStart: z.ZodString;
+    currency: z.ZodString;
+    organizationInvoiceRefId: z.ZodString;
+    linkedByUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** An organization's content-capture setting changed (#1599). The setting, never any content. */
+export declare const AuditableEvent_CorrectionCaptureSettingChanged_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.CORRECTION_CAPTURE_SETTING_CHANGED>;
+    settingOrganizationId: z.ZodString;
+    previousContentCapture: z.ZodOptional<z.ZodString>;
+    contentCapture: z.ZodString;
+    purposeStated: z.ZodBoolean;
+    contentReaderRole: z.ZodOptional<z.ZodString>;
+    narrowedToCaseCount: z.ZodNumber;
+    changedByUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** An organization's evaluation-export authorisation changed (#1599). The basis and counts, never case identities. */
+export declare const AuditableEvent_EvaluationExportAuthorizationChanged_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EVALUATION_EXPORT_AUTHORIZATION_CHANGED>;
+    authorizationOrganizationId: z.ZodString;
+    status: z.ZodString;
+    previousStatus: z.ZodOptional<z.ZodString>;
+    basis: z.ZodOptional<z.ZodString>;
+    clientConsentCount: z.ZodNumber;
+    excludedCaseCount: z.ZodNumber;
+    changedByUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** An evaluation dataset was exported (#1599). The ledger row names every record; the trail names the export. */
+export declare const AuditableEvent_EvaluationDatasetExported_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EVALUATION_DATASET_EXPORTED>;
+    exportId: z.ZodString;
+    exportOrganizationId: z.ZodString;
+    agentRef: z.ZodString;
+    basis: z.ZodString;
+    recordCount: z.ZodNumber;
+    windowFrom: z.ZodString;
+    windowTo: z.ZodString;
+    destination: z.ZodString;
+    exportedByUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** An evaluation-dataset export was refused (#1599 I7). */
+export declare const AuditableEvent_EvaluationDatasetExportRefused_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EVALUATION_DATASET_EXPORT_REFUSED>;
+    exportOrganizationId: z.ZodString;
+    agentRef: z.ZodString;
+    reason: z.ZodEnum<typeof EvaluationDatasetExportRefusalReason>;
+    attemptedByUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** A legal hold was released (#1634). */
+export declare const AuditableEvent_LegalHoldReleased_EventDataSchema: z.ZodObject<{
+    releasedByUserId: z.ZodString;
+    heldForSeconds: z.ZodNumber;
+    holdId: z.ZodString;
+    heldOrganizationId: z.ZodString;
+    scopeKind: z.ZodEnum<typeof LegalHoldScopeKind>;
+    legalGround: z.ZodEnum<typeof LegalHoldGround>;
+    placementTier: z.ZodEnum<typeof LegalHoldPlacementTier>;
+    heldResourceType: z.ZodOptional<z.ZodString>;
+    heldRowCount: z.ZodOptional<z.ZodNumber>;
+    subjectUserId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.LEGAL_HOLD_RELEASED>;
+}, z.core.$strip>;
 export declare const AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE>;
     transition: z.ZodEnum<typeof PlatformAccessGrantLifecycleTransition>;
@@ -2022,11 +2828,213 @@ export declare const AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema
     autoApprovalReason: z.ZodOptional<z.ZodEnum<typeof PlatformAccessGrantAutoApprovalReason>>;
     decidedByUserId: z.ZodOptional<z.ZodString>;
     decisionReason: z.ZodOptional<z.ZodString>;
+    grantedMachineCredential: z.ZodOptional<z.ZodObject<{
+        authMethod: z.ZodEnum<typeof import("../..").MachineAuthMethod>;
+        credentialId: z.ZodString;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
-export declare const AuditableEvent_CrossTenantAdministrativeAccess_EventDataSchema: z.ZodObject<{
-    eventType: z.ZodLiteral<CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS>;
-    targetOrganizationId: z.ZodString;
-    resourceType: z.ZodString;
+/**
+ * One transition in the life of a service-provider relationship (#1597).
+ *
+ * Read it to answer "which firm could reach this tenant, under what scope, since when — and who decided".
+ * Written once to the CLIENT's trail and once to the FIRM's: the same facts, each organization reading
+ * them in its own tenant. `purpose` and `decisionReason` are free text people typed, so they are carried
+ * for the tenants' own trails and are NOT exported to a SIEM by default.
+ *
+ * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
+ * assurance-control: WILDO.PRIVACY.THIRD_PARTY_PROCESSING
+ */
+export declare const AuditableEvent_ServiceProviderRelationshipLifecycle_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_RELATIONSHIP_LIFECYCLE>;
+    transition: z.ZodEnum<typeof ServiceProviderRelationshipTransition>;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    resultingStatus: z.ZodEnum<typeof ServiceProviderRelationshipStatus>;
+    role: z.ZodString;
+    organizationUnitIds: z.ZodArray<z.ZodString>;
+    endsAt: z.ZodOptional<z.ZodDate>;
+    proposedByOrganizationId: z.ZodString;
+    actorUserId: z.ZodOptional<z.ZodString>;
+    actorOrganizationId: z.ZodOptional<z.ZodString>;
+    purpose: z.ZodOptional<z.ZodString>;
+    decisionReason: z.ZodOptional<z.ZodString>;
+    expertAdmissionPolicy: z.ZodOptional<z.ZodEnum<typeof ServiceProviderExpertAdmissionPolicy>>;
+}, z.core.$strip>;
+/** A firm machine client admitted into / removed from a client organization under a relationship (#1597, S3). */
+export declare const AuditableEvent_ServiceProviderMachineClientAdmissionChanged_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_MACHINE_CLIENT_ADMISSION_CHANGED>;
+    admitted: z.ZodBoolean;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    oauthClientId: z.ZodString;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** An expert assigned to a client relationship by their firm (#1597). */
+export declare const AuditableEvent_ServiceProviderExpertAssigned_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_ASSIGNED>;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** An expert's assignment to a client relationship ended by their firm (#1597). */
+export declare const AuditableEvent_ServiceProviderExpertUnassigned_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_UNASSIGNED>;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** A firm's assignment now waits for the client's approval (#1612). Actor: the firm administrator who assigned. */
+export declare const AuditableEvent_ServiceProviderExpertApprovalRequested_EventDataSchema: z.ZodObject<{
+    expertAdmissionPolicy: z.ZodEnum<typeof ServiceProviderExpertAdmissionPolicy>;
+    role: z.ZodString;
+    actorUserId: z.ZodOptional<z.ZodString>;
+    decisionRef: z.ZodString;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_REQUESTED>;
+}, z.core.$strip>;
+/** The client approved, and the expert was admitted (#1612). */
+export declare const AuditableEvent_ServiceProviderExpertApprovalGranted_EventDataSchema: z.ZodObject<{
+    role: z.ZodString;
+    decisionRef: z.ZodString;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_GRANTED>;
+}, z.core.$strip>;
+/** The expert was not admitted (#1612). */
+export declare const AuditableEvent_ServiceProviderExpertApprovalDenied_EventDataSchema: z.ZodObject<{
+    denialReason: z.ZodEnum<typeof ServiceProviderExpertApprovalDenialReason>;
+    decisionRef: z.ZodString;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_DENIED>;
+}, z.core.$strip>;
+/** Nobody answered in time (#1612). */
+export declare const AuditableEvent_ServiceProviderExpertApprovalLapsed_EventDataSchema: z.ZodObject<{
+    decisionRef: z.ZodString;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_LAPSED>;
+}, z.core.$strip>;
+/** A capability was lent (#1631). */
+export declare const AuditableEvent_ServiceProviderCapabilityGranted_EventDataSchema: z.ZodObject<{
+    grantId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    capability: z.ZodEnum<typeof DelegatedAdministrativeCapability>;
+    securityCritical: z.ZodBoolean;
+    endsAt: z.ZodDate;
+    actorUserId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_GRANTED>;
+}, z.core.$strip>;
+/** A lent capability was revoked (#1631). */
+export declare const AuditableEvent_ServiceProviderCapabilityRevoked_EventDataSchema: z.ZodObject<{
+    byRelationshipEnd: z.ZodBoolean;
+    endCause: z.ZodOptional<z.ZodEnum<typeof ServiceProviderCapabilityGrantEndCause>>;
+    endedCredentials: z.ZodOptional<z.ZodNumber>;
+    grantId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    capability: z.ZodEnum<typeof DelegatedAdministrativeCapability>;
+    securityCritical: z.ZodBoolean;
+    endsAt: z.ZodDate;
+    actorUserId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_REVOKED>;
+}, z.core.$strip>;
+/** A client's decision about trusting a firm's identity provider's MFA on one relationship (#1633). */
+export declare const AuditableEvent_ServiceProviderMfaTrustChanged_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_MFA_TRUST_CHANGED>;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    previousProviderMfaTrust: z.ZodEnum<typeof ServiceProviderMfaTrust>;
+    providerMfaTrust: z.ZodEnum<typeof ServiceProviderMfaTrust>;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * A factor recorded on an expert's session for one client organization (#1633).
+ *
+ * Names the factor and its SOURCE, never the proof itself. `identityProviderOrganizationId` is present exactly when
+ * the source is the firm's trusted identity provider.
+ *
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the resource tenant's authentication policy is enforced on external experts, per request.
+ */
+export declare const AuditableEvent_ServiceProviderClientAuthenticationSatisfied_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_CLIENT_AUTHENTICATION_SATISFIED>;
+    organizationId: z.ZodString;
+    relationshipId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    factor: z.ZodEnum<typeof AuthMethod>;
+    source: z.ZodEnum<typeof FactorSatisfactionSource>;
+    identityProviderOrganizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** A firm's decision about collecting activity metadata on its own experts' client work (#1632). */
+export declare const AuditableEvent_ServiceProviderActivityFeedDecided_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DECIDED>;
+    providerOrganizationId: z.ZodString;
+    previousStatus: z.ZodEnum<typeof ServiceProviderActivityFeedStatus>;
+    status: z.ZodEnum<typeof ServiceProviderActivityFeedStatus>;
+    acknowledgedWorkerConsultationNotice: z.ZodBoolean;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** A client's decision about how much a firm's activity feed may say about work in it (#1632). */
+export declare const AuditableEvent_ServiceProviderActivityFeedDisclosureChanged_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DISCLOSURE_CHANGED>;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    previousActivityFeedDisclosure: z.ZodEnum<typeof ServiceProviderActivityFeedDisclosure>;
+    activityFeedDisclosure: z.ZodEnum<typeof ServiceProviderActivityFeedDisclosure>;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * One transition in the life of a system-of-record partition assignment.
+ *
+ * Read it to answer "who could see this remote company, and when did that start or stop". The row
+ * names both units on a move, so a timeline reconstructed from these events is complete without
+ * joining anything: each row carries the state it left as well as the state it reached.
+ *
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE
+ * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
+ */
+export declare const AuditableEvent_SystemOfRecordPartitionAssignmentLifecycle_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_LIFECYCLE>;
+    transition: z.ZodEnum<typeof SystemOfRecordPartitionAssignmentTransition>;
+    assignmentId: z.ZodString;
+    system: z.ZodString;
+    remoteKey: z.ZodString;
+    organizationUnitId: z.ZodOptional<z.ZodString>;
+    previousOrganizationUnitId: z.ZodOptional<z.ZodString>;
+    justification: z.ZodOptional<z.ZodString>;
+    assignedByUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const AuditableEvent_CrossTenantAdministrativeAccess_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS>;
+    targetOrganizationId: z.ZodString;
+    resourceType: z.ZodString;
     operationIdentifier: z.ZodString;
     variantType: z.ZodEnum<typeof ResourceOperationVariantType>;
     variantKey: z.ZodOptional<z.ZodString>;
@@ -2036,6 +3044,10 @@ export declare const AuditableEvent_CrossTenantAdministrativeAccess_EventDataSch
     admissionDeclared: z.ZodBoolean;
     initiatorRoles: z.ZodArray<z.ZodString>;
     executionType: z.ZodEnum<typeof ExecutionContext_ExecutionType>;
+    machineCredential: z.ZodOptional<z.ZodObject<{
+        authMethod: z.ZodEnum<typeof import("../..").MachineAuthMethod>;
+        credentialId: z.ZodString;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 /**
  * An application-wide directory enumeration.
@@ -2067,6 +3079,8 @@ export declare const AuditableEvent_ResourceOperationDenied_EventDataSchema: z.Z
     isBulkOperation: z.ZodOptional<z.ZodBoolean>;
     attemptedResourceIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
     requiredRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    escalatedRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    refusedSurface: z.ZodOptional<z.ZodString>;
     initiatorRoles: z.ZodArray<z.ZodString>;
     executionType: z.ZodEnum<typeof ExecutionContext_ExecutionType>;
     machineCredentialAuthMethod: z.ZodOptional<z.ZodString>;
@@ -2109,6 +3123,44 @@ export declare const AuditableEvent_RetainedDataAccess_EventDataSchema: z.ZodObj
     organizationId: z.ZodOptional<z.ZodString>;
     ipAddress: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/**
+ * A person met a governed document, and this is the release they met.
+ *
+ * `interaction` is the composed record from `composeGovernedDocumentInteraction`, which has already
+ * refused anything the release does not permit and marked anything the workflow has not finished.
+ * It is nested rather than flattened so there is ONE shape for a governed-document interaction — a
+ * second, flatter copy here would be a second thing to keep in step with the release vocabulary.
+ *
+ * The SUBJECT is the audit envelope's own actor attribution plus `userId` here, never a third
+ * spelling inside the record; see the interaction schema's JSDoc for why.
+ *
+ * assurance-control: WILDO.PRIVACY.CONSENT_RECORD
+ */
+export declare const AuditableEvent_GovernedDocument_InteractionRecordedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.GOVERNED_DOCUMENT_INTERACTION_RECORDED>;
+    userId: z.ZodOptional<z.ZodString>;
+    anonymousUserId: z.ZodOptional<z.ZodString>;
+    interaction: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        interactionKind: z.ZodEnum<typeof import("../..").GovernedDocumentInteractionKind>;
+        release: z.ZodObject<{
+            document: z.ZodObject<{
+                documentRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                documentVersion: z.ZodNumber;
+            }, z.core.$strict>;
+            releaseId: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+            releaseVersion: z.ZodNumber;
+        }, z.core.$strict>;
+        documentClass: z.ZodEnum<typeof import("../..").GovernedDocumentClass>;
+        locale: z.ZodString;
+        jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
+        releaseApprovalState: z.ZodEnum<typeof import("../..").GovernedDocumentReleaseApprovalState>;
+        acceptanceMode: z.ZodOptional<z.ZodEnum<typeof import("../..").GovernedDocumentAcceptanceMode>>;
+        occurredAt: z.ZodISODateTime;
+    }, z.core.$strict>;
+    advisoryKinds: z.ZodArray<z.ZodString>;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 /**
  * A DATA SUBJECT EXPORT — the compliance record of the framework assembling everything it holds
  * about one person and disclosing it.
@@ -2141,6 +3193,8 @@ export declare const AuditableEvent_SubjectDataExport_EventDataSchema: z.ZodObje
     fieldsExcludedAsDerived: z.ZodArray<z.ZodString>;
     fieldsWithheldAsNonDisclosable: z.ZodArray<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
+    recipientsStatus: z.ZodEnum<typeof SubjectDataRecipientsStatementStatus>;
+    recipientRefs: z.ZodArray<z.ZodString>;
 }, z.core.$strip>;
 /**
  * A COLLECTION EXPORT — an operator rendered a resource listing to a file and downloaded it.
@@ -2209,6 +3263,74 @@ export declare const AuditableEvent_ProviderOperationCall_EventDataSchema: z.Zod
     connectionDelegation: z.ZodString;
     status: z.ZodOptional<z.ZodNumber>;
     failureKind: z.ZodOptional<z.ZodString>;
+    scopeCheck: z.ZodOptional<z.ZodEnum<typeof ProviderOperationScopeCheck>>;
+    missingScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    initiatorUserId: z.ZodOptional<z.ZodString>;
+    executionType: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    augmentationPackage: z.ZodOptional<z.ZodString>;
+    augmentationPackageVersion: z.ZodOptional<z.ZodString>;
+    connectionRef: z.ZodOptional<z.ZodString>;
+    providerPackageName: z.ZodOptional<z.ZodString>;
+    tokenAudience: z.ZodOptional<z.ZodString>;
+    rateBudget: z.ZodOptional<z.ZodObject<{
+        budgetKeys: z.ZodArray<z.ZodString>;
+        counting: z.ZodEnum<typeof RateBudgetCounting>;
+        waitedMs: z.ZodNumber;
+        exhaustedBudgetKey: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * The backend CALLED a vendor to discharge an engine capability (#1712) — see the enum member for why this is
+ * neither a catalogue operation call nor a record about the data's subject.
+ *
+ * One event per PHYSICAL call the egress controls, on the success and the failure path. The granularity is the
+ * egress's own act: one email submission, one SMS, one storage verb, one billing adapter call. A billing adapter
+ * call that pages through a list may make several HTTP requests to the vendor under one row, as an agent turn does
+ * under one `providerCallRecords` row; the count is of the application's acts, not of the vendor's requests.
+ *
+ * No field names a subject — no recipient, number, file, customer or payload — so the schema, not a redaction
+ * step, is what keeps it out of the personal-data population.
+ *
+ * assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — records which vendor each capability reached,
+ * with what outcome, for every call the application made.
+ */
+export declare const AuditableEvent_ProviderCapabilityCall_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.PROVIDER_CAPABILITY_CALL>;
+    capability: z.ZodEnum<typeof ProviderCapabilityEgress>;
+    action: z.ZodEnum<typeof ProviderCapabilityCallAction>;
+    providerRef: z.ZodString;
+    engineCapability: z.ZodOptional<z.ZodString>;
+    billingOperation: z.ZodOptional<z.ZodString>;
+    outcome: z.ZodEnum<typeof ProviderCapabilityCallOutcome>;
+    status: z.ZodOptional<z.ZodNumber>;
+    failureKind: z.ZodOptional<z.ZodString>;
+    connectionOwnerScope: z.ZodString;
+    connectionOwnerId: z.ZodOptional<z.ZodString>;
+    initiatorUserId: z.ZodOptional<z.ZodString>;
+    executionType: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * The browser door REFUSED a provider operation (#367) — see the enum member for why this is not a
+ * failed call.
+ *
+ * Ids and shape only, like its call sibling: the request's `input` is never recorded. What the caller
+ * ASKED FOR is recorded even when it names nothing real, because a refusal records an attempt rather
+ * than proving the provider or operation exists.
+ *
+ * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+ */
+export declare const AuditableEvent_ProviderOperationDenied_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.PROVIDER_OPERATION_DENIED>;
+    denialReason: z.ZodEnum<typeof ProviderOperationDenialReason>;
+    providerRef: z.ZodString;
+    operationId: z.ZodString;
+    connectionOwnerScope: z.ZodString;
+    connectionOwnerId: z.ZodOptional<z.ZodString>;
+    connectionDelegation: z.ZodString;
+    requiredRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    heldRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
     initiatorUserId: z.ZodOptional<z.ZodString>;
     executionType: z.ZodOptional<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
@@ -2240,40 +3362,255 @@ export declare const AuditableEvent_McpToolCall_EventDataSchema: z.ZodObject<{
     outcome: z.ZodString;
     connectionOwnerScope: z.ZodOptional<z.ZodString>;
     credentialId: z.ZodOptional<z.ZodString>;
+    credentialSetByUserId: z.ZodOptional<z.ZodString>;
     initiatorUserId: z.ZodOptional<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
     agentRef: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type AuditableEvent_McpToolCall_EventData = z.infer<typeof AuditableEvent_McpToolCall_EventDataSchema>;
+export type AuditableEvent_ProviderCapabilityCall_EventData = z.infer<typeof AuditableEvent_ProviderCapabilityCall_EventDataSchema>;
+/** A decision was raised. */
+export declare const AuditableEvent_HumanDecisionRequested_EventDataSchema: z.ZodObject<{
+    requesterKind: z.ZodEnum<typeof HumanDecision_RequesterKind>;
+    assigneeUserId: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+    claimDeadlineAt: z.ZodOptional<z.ZodString>;
+    claimClockBasis: z.ZodOptional<z.ZodEnum<typeof ReviewClockBasis>>;
+    decisionDeadlineAt: z.ZodOptional<z.ZodString>;
+    decisionClockBasis: z.ZodOptional<z.ZodEnum<typeof ReviewClockBasis>>;
+    decisionRef: z.ZodString;
+    executionId: z.ZodString;
+    plane: z.ZodEnum<typeof HumanDecision_Plane>;
+    systemRef: z.ZodOptional<z.ZodString>;
+    agentRef: z.ZodOptional<z.ZodString>;
+    toolName: z.ZodOptional<z.ZodString>;
+    routeKind: z.ZodEnum<typeof HumanDecision_RouteKind>;
+    routeEligibleRole: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.HUMAN_DECISION_REQUESTED>;
+}, z.core.$strip>;
+export type AuditableEvent_HumanDecisionRequested_EventData = z.infer<typeof AuditableEvent_HumanDecisionRequested_EventDataSchema>;
+/** A decision ended. Exactly one per `decisionRef`. */
+export declare const AuditableEvent_HumanDecisionResolved_EventDataSchema: z.ZodObject<{
+    outcome: z.ZodEnum<typeof HumanDecision_Outcome>;
+    decidedByUserId: z.ZodOptional<z.ZodString>;
+    deciderRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    admittedByRouteRole: z.ZodOptional<z.ZodString>;
+    modifiedArgumentNames: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    reasonGiven: z.ZodBoolean;
+    lateDecisionUserId: z.ZodOptional<z.ZodString>;
+    deadlineOutcomes: z.ZodOptional<z.ZodRecord<z.ZodEnum<typeof ReviewDeadlineKind> & z.core.$partial, z.ZodEnum<typeof ReviewDeadlineOutcome>>>;
+    decisionRef: z.ZodString;
+    executionId: z.ZodString;
+    plane: z.ZodEnum<typeof HumanDecision_Plane>;
+    systemRef: z.ZodOptional<z.ZodString>;
+    agentRef: z.ZodOptional<z.ZodString>;
+    toolName: z.ZodOptional<z.ZodString>;
+    routeKind: z.ZodEnum<typeof HumanDecision_RouteKind>;
+    routeEligibleRole: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.HUMAN_DECISION_RESOLVED>;
+}, z.core.$strip>;
+export type AuditableEvent_HumanDecisionResolved_EventData = z.infer<typeof AuditableEvent_HumanDecisionResolved_EventDataSchema>;
+export declare const AuditableEvent_HumanDecisionReassigned_EventDataSchema: z.ZodObject<{
+    trigger: z.ZodEnum<typeof HumanDecision_RouteChangeTrigger>;
+    stage: z.ZodOptional<z.ZodEnum<typeof ReviewDeadlineStage>>;
+    fromAssigneeUserId: z.ZodOptional<z.ZodString>;
+    toAssigneeUserId: z.ZodString;
+    routeVersion: z.ZodNumber;
+    reasonGiven: z.ZodBoolean;
+    decisionRef: z.ZodString;
+    executionId: z.ZodString;
+    plane: z.ZodEnum<typeof HumanDecision_Plane>;
+    systemRef: z.ZodOptional<z.ZodString>;
+    agentRef: z.ZodOptional<z.ZodString>;
+    toolName: z.ZodOptional<z.ZodString>;
+    routeKind: z.ZodEnum<typeof HumanDecision_RouteKind>;
+    routeEligibleRole: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.HUMAN_DECISION_REASSIGNED>;
+}, z.core.$strip>;
+export type AuditableEvent_HumanDecisionReassigned_EventData = z.infer<typeof AuditableEvent_HumanDecisionReassigned_EventDataSchema>;
+export declare const AuditableEvent_HumanDecisionEscalated_EventDataSchema: z.ZodObject<{
+    toDeclaredTarget: z.ZodBoolean;
+    fromAssigneeUserId: z.ZodOptional<z.ZodString>;
+    toAssigneeUserId: z.ZodString;
+    routeVersion: z.ZodNumber;
+    reasonGiven: z.ZodBoolean;
+    decisionRef: z.ZodString;
+    executionId: z.ZodString;
+    plane: z.ZodEnum<typeof HumanDecision_Plane>;
+    systemRef: z.ZodOptional<z.ZodString>;
+    agentRef: z.ZodOptional<z.ZodString>;
+    toolName: z.ZodOptional<z.ZodString>;
+    routeKind: z.ZodEnum<typeof HumanDecision_RouteKind>;
+    routeEligibleRole: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.HUMAN_DECISION_ESCALATED>;
+}, z.core.$strip>;
+export type AuditableEvent_HumanDecisionEscalated_EventData = z.infer<typeof AuditableEvent_HumanDecisionEscalated_EventDataSchema>;
+/** A role-routed decision was claimed (`claimed: true`) or given back to its role (`claimed: false`). */
+export declare const AuditableEvent_HumanDecisionClaimed_EventDataSchema: z.ZodObject<{
+    claimed: z.ZodBoolean;
+    assigneeUserId: z.ZodString;
+    routeVersion: z.ZodNumber;
+    decisionRef: z.ZodString;
+    executionId: z.ZodString;
+    plane: z.ZodEnum<typeof HumanDecision_Plane>;
+    systemRef: z.ZodOptional<z.ZodString>;
+    agentRef: z.ZodOptional<z.ZodString>;
+    toolName: z.ZodOptional<z.ZodString>;
+    routeKind: z.ZodEnum<typeof HumanDecision_RouteKind>;
+    routeEligibleRole: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.HUMAN_DECISION_CLAIMED>;
+}, z.core.$strip>;
+export type AuditableEvent_HumanDecisionClaimed_EventData = z.infer<typeof AuditableEvent_HumanDecisionClaimed_EventDataSchema>;
+/** Someone tried to act on a decision and was refused. The decision is unchanged. */
+export declare const AuditableEvent_HumanDecisionAnswerRefused_EventDataSchema: z.ZodObject<{
+    act: z.ZodEnum<typeof HumanDecision_Act>;
+    reason: z.ZodEnum<typeof HumanDecision_RefusalReason>;
+    attemptedByUserId: z.ZodOptional<z.ZodString>;
+    decisionRef: z.ZodString;
+    executionId: z.ZodString;
+    plane: z.ZodEnum<typeof HumanDecision_Plane>;
+    systemRef: z.ZodOptional<z.ZodString>;
+    agentRef: z.ZodOptional<z.ZodString>;
+    toolName: z.ZodOptional<z.ZodString>;
+    routeKind: z.ZodEnum<typeof HumanDecision_RouteKind>;
+    routeEligibleRole: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.HUMAN_DECISION_ANSWER_REFUSED>;
+}, z.core.$strip>;
+export type AuditableEvent_HumanDecisionAnswerRefused_EventData = z.infer<typeof AuditableEvent_HumanDecisionAnswerRefused_EventDataSchema>;
+/** A CLAIM or DECISION deadline passed (#1628). The decision is unchanged and still answerable. */
+export declare const AuditableEvent_HumanDecisionDeadlineMissed_EventDataSchema: z.ZodObject<{
+    kind: z.ZodEnum<typeof ReviewDeadlineKind>;
+    deadlineAt: z.ZodString;
+    basis: z.ZodEnum<typeof ReviewClockBasis>;
+    decisionRef: z.ZodString;
+    executionId: z.ZodString;
+    plane: z.ZodEnum<typeof HumanDecision_Plane>;
+    systemRef: z.ZodOptional<z.ZodString>;
+    agentRef: z.ZodOptional<z.ZodString>;
+    toolName: z.ZodOptional<z.ZodString>;
+    routeKind: z.ZodEnum<typeof HumanDecision_RouteKind>;
+    routeEligibleRole: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.HUMAN_DECISION_DEADLINE_MISSED>;
+}, z.core.$strip>;
+export type AuditableEvent_HumanDecisionDeadlineMissed_EventData = z.infer<typeof AuditableEvent_HumanDecisionDeadlineMissed_EventDataSchema>;
 /**
- * A human approver AUTHORED the arguments an approval-gated tool ran with (#566).
- *
- * One row per MODIFIED approval — never per approval. See the enum member's docstring for why an
- * ordinary approval is not this event, and for why no argument VALUE appears in this schema.
- *
- * `proposedInputDigest` / `executedInputDigest` are the model SDK's own canonical input digests, the
- * same values its approval signature is computed over. That is what makes them evidence rather than
- * a convenience: a reader holding the executed call can recompute the second and see it match, and
- * the two differing is proof that the call which ran is not the call which was proposed — with no
- * copy of either payload on the trail.
- *
- * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — records that an authorization
- * decision REWROTE the act it authorized, and who made it.
+ * A deadline stage's rule fired (#1628). Ids and counts only: who was told is the route's candidates at
+ * that moment, recorded as a count so the row holds no list of people that would need scrubbing.
  */
-export declare const AuditableEvent_AgentToolApprovalModified_EventDataSchema: z.ZodObject<{
-    eventType: z.ZodLiteral<CoreAuditableEventType.AGENT_TOOL_APPROVAL_MODIFIED>;
+export declare const AuditableEvent_HumanDecisionEscalationFired_EventDataSchema: z.ZodObject<{
+    stage: z.ZodEnum<typeof ReviewDeadlineStage>;
+    action: z.ZodEnum<typeof ReviewEscalationActionKind>;
+    reassignAttempted: z.ZodBoolean;
+    targetResolved: z.ZodOptional<z.ZodBoolean>;
+    targetRefusalReason: z.ZodOptional<z.ZodEnum<typeof HumanDecision_RefusalReason>>;
+    fromAssigneeUserId: z.ZodOptional<z.ZodString>;
+    toAssigneeUserId: z.ZodOptional<z.ZodString>;
+    routeVersion: z.ZodOptional<z.ZodNumber>;
+    recipientCount: z.ZodNumber;
+    decisionRef: z.ZodString;
     executionId: z.ZodString;
-    approvalId: z.ZodString;
-    systemRef: z.ZodString;
-    agentRef: z.ZodString;
-    toolName: z.ZodString;
-    proposedInputDigest: z.ZodString;
-    executedInputDigest: z.ZodString;
-    modifiedArgumentKeys: z.ZodArray<z.ZodString>;
-    approverUserId: z.ZodOptional<z.ZodString>;
+    plane: z.ZodEnum<typeof HumanDecision_Plane>;
+    systemRef: z.ZodOptional<z.ZodString>;
+    agentRef: z.ZodOptional<z.ZodString>;
+    toolName: z.ZodOptional<z.ZodString>;
+    routeKind: z.ZodEnum<typeof HumanDecision_RouteKind>;
+    routeEligibleRole: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.HUMAN_DECISION_ESCALATION_FIRED>;
+}, z.core.$strip>;
+export type AuditableEvent_HumanDecisionEscalationFired_EventData = z.infer<typeof AuditableEvent_HumanDecisionEscalationFired_EventDataSchema>;
+/** A person stopped a decision's CLAIM and DECISION clocks (#1628). The lapse keeps running. */
+export declare const AuditableEvent_HumanDecisionClockPaused_EventDataSchema: z.ZodObject<{
+    pauseStateRef: z.ZodString;
+    pausedByUserId: z.ZodString;
+    decisionRef: z.ZodString;
+    executionId: z.ZodString;
+    plane: z.ZodEnum<typeof HumanDecision_Plane>;
+    systemRef: z.ZodOptional<z.ZodString>;
+    agentRef: z.ZodOptional<z.ZodString>;
+    toolName: z.ZodOptional<z.ZodString>;
+    routeKind: z.ZodEnum<typeof HumanDecision_RouteKind>;
+    routeEligibleRole: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.HUMAN_DECISION_CLOCK_PAUSED>;
+}, z.core.$strip>;
+export type AuditableEvent_HumanDecisionClockPaused_EventData = z.infer<typeof AuditableEvent_HumanDecisionClockPaused_EventDataSchema>;
+/** A person restarted a decision's clocks (#1628); `pausedMs` was added to both service targets. */
+export declare const AuditableEvent_HumanDecisionClockResumed_EventDataSchema: z.ZodObject<{
+    pauseStateRef: z.ZodString;
+    resumedByUserId: z.ZodString;
+    pausedMs: z.ZodNumber;
+    decisionRef: z.ZodString;
+    executionId: z.ZodString;
+    plane: z.ZodEnum<typeof HumanDecision_Plane>;
+    systemRef: z.ZodOptional<z.ZodString>;
+    agentRef: z.ZodOptional<z.ZodString>;
+    toolName: z.ZodOptional<z.ZodString>;
+    routeKind: z.ZodEnum<typeof HumanDecision_RouteKind>;
+    routeEligibleRole: z.ZodOptional<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.HUMAN_DECISION_CLOCK_RESUMED>;
 }, z.core.$strip>;
-export type AuditableEvent_AgentToolApprovalModified_EventData = z.infer<typeof AuditableEvent_AgentToolApprovalModified_EventDataSchema>;
+export type AuditableEvent_HumanDecisionClockResumed_EventData = z.infer<typeof AuditableEvent_HumanDecisionClockResumed_EventDataSchema>;
+export declare const AuditableEvent_AutonomousAgent_BoundEventDataSchema: z.ZodObject<{
+    autonomousAgentRef: z.ZodString;
+    organizationId: z.ZodString;
+    oauthClientId: z.ZodString;
+    principalSource: z.ZodEnum<typeof AutonomousPrincipalSource>;
+    providerOrganizationId: z.ZodOptional<z.ZodString>;
+    serviceProviderRelationshipId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.AUTONOMOUS_AGENT_BOUND>;
+}, z.core.$strip>;
+export type AuditableEvent_AutonomousAgent_BoundEventData = z.infer<typeof AuditableEvent_AutonomousAgent_BoundEventDataSchema>;
+export declare const AuditableEvent_AutonomousAgent_UnboundEventDataSchema: z.ZodObject<{
+    autonomousAgentRef: z.ZodString;
+    organizationId: z.ZodString;
+    oauthClientId: z.ZodString;
+    principalSource: z.ZodEnum<typeof AutonomousPrincipalSource>;
+    providerOrganizationId: z.ZodOptional<z.ZodString>;
+    serviceProviderRelationshipId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.AUTONOMOUS_AGENT_UNBOUND>;
+}, z.core.$strip>;
+export type AuditableEvent_AutonomousAgent_UnboundEventData = z.infer<typeof AuditableEvent_AutonomousAgent_UnboundEventDataSchema>;
+export declare const AuditableEvent_AutonomousAgent_TurnStartedEventDataSchema: z.ZodObject<{
+    executionId: z.ZodString;
+    systemRef: z.ZodString;
+    oauthClientId: z.ZodString;
+    principalSource: z.ZodEnum<typeof AutonomousPrincipalSource>;
+    autonomousAgentRef: z.ZodString;
+    organizationId: z.ZodString;
+    occurrenceKey: z.ZodString;
+    trigger: z.ZodEnum<typeof AutonomousTurnTrigger>;
+    caseRef: z.ZodOptional<z.ZodObject<{
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+    }, z.core.$strict>>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_STARTED>;
+}, z.core.$strip>;
+export type AuditableEvent_AutonomousAgent_TurnStartedEventData = z.infer<typeof AuditableEvent_AutonomousAgent_TurnStartedEventDataSchema>;
+export declare const AuditableEvent_AutonomousAgent_TurnRefusedEventDataSchema: z.ZodObject<{
+    reason: z.ZodEnum<typeof AutonomousTurnRefusalReason>;
+    budgetDenialReason: z.ZodOptional<z.ZodString>;
+    runtimeErrorCode: z.ZodOptional<z.ZodString>;
+    oauthClientId: z.ZodOptional<z.ZodString>;
+    autonomousAgentRef: z.ZodString;
+    organizationId: z.ZodString;
+    occurrenceKey: z.ZodString;
+    trigger: z.ZodEnum<typeof AutonomousTurnTrigger>;
+    caseRef: z.ZodOptional<z.ZodObject<{
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+    }, z.core.$strict>>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_REFUSED>;
+}, z.core.$strip>;
+export type AuditableEvent_AutonomousAgent_TurnRefusedEventData = z.infer<typeof AuditableEvent_AutonomousAgent_TurnRefusedEventDataSchema>;
 /**
  * Rows were read THROUGH an HTTP-API resource binding — the read-through trail for data living in
  * an EXTERNAL system the platform does not own (ETL plan D8/R6; see the enum member's docstring
@@ -2296,7 +3633,7 @@ export declare const AuditableEvent_HttpApiReadThroughAccess_EventDataSchema: z.
     eventType: z.ZodLiteral<CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS>;
     resourceType: z.ZodString;
     operationIdentifier: z.ZodString;
-    providerRef: z.ZodString;
+    systemOfRecord: z.ZodString;
     remoteEntityRef: z.ZodString;
     dialect: z.ZodString;
     initiatorUserId: z.ZodOptional<z.ZodString>;
@@ -2304,6 +3641,11 @@ export declare const AuditableEvent_HttpApiReadThroughAccess_EventDataSchema: z.
     organizationId: z.ZodOptional<z.ZodString>;
     resourceId: z.ZodOptional<z.ZodString>;
     rowCount: z.ZodOptional<z.ZodNumber>;
+    rejectedRows: z.ZodOptional<z.ZodNumber>;
+    completedPass: z.ZodOptional<z.ZodBoolean>;
+    pipelinePassMode: z.ZodOptional<z.ZodEnum<typeof ExternalDataPipelinePassMode>>;
+    suppressedRows: z.ZodOptional<z.ZodNumber>;
+    liveSuppressedRows: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 /**
  * A subject erasure invoked the DECLARED external-erasure operation of an HTTP_API binding
@@ -2315,18 +3657,212 @@ export declare const AuditableEvent_HttpApiReadThroughAccess_EventDataSchema: z.
  * assurance-control: WILDO.AUDIT.ATTRIBUTION — the outbound deletion names the subject it served
  * and the external system it reached; the erasure report is the per-request receipt, this row is
  * the queryable trail.
+ *
+ * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — an erasure that deleted rows in an external
+ * system leaves a durable record naming that system and how many rows it deleted there.
  */
 export declare const AuditableEvent_HttpApiExternalErasure_EventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE>;
     subjectResourceType: z.ZodString;
     subjectIds: z.ZodArray<z.ZodString>;
     resourceType: z.ZodString;
-    providerRef: z.ZodString;
+    systemOfRecord: z.ZodString;
     remoteEntityRef: z.ZodString;
     dialect: z.ZodString;
     deletedRowCount: z.ZodNumber;
     organizationId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/**
+ * What became of ONE write sent (or about to be sent) through an HTTP-API binding (#1679).
+ *
+ * Distinct members because each one sends a reviewer somewhere different, and two of them are the
+ * answers a client must not read as "not written".
+ */
+export declare enum HttpApiWriteThroughOutcome {
+    /** The system of record applied the write. */
+    APPLIED = "applied",
+    /**
+     * The ENGINE refused before anything was sent — a non-owner organization, a partition outside the
+     * caller's grant, an engine-owned field in the payload. Nothing reached the remote.
+     */
+    REFUSED = "refused",
+    /** The request was sent and the system of record refused it with a definite answer; nothing was applied. */
+    REMOTE_REFUSED = "remote_refused",
+    /**
+     * The request was sent and nobody knows whether it was applied — a timeout, a connection dropped after
+     * the request left, a gateway answering for the vendor. A retry under the same Idempotency-Key answers
+     * this again rather than sending a second write.
+     */
+    OUTCOME_UNKNOWN = "outcome_unknown",
+    /**
+     * A retry under an Idempotency-Key whose first attempt was APPLIED. Nothing was sent: the outcome was
+     * replayed from the first attempt's record. Recorded so the second RESOURCE_OPERATION_PERFORMED row such a
+     * retry produces is visibly one that changed nothing remote.
+     */
+    REPLAYED = "replayed"
+}
+/**
+ * A row was written THROUGH an HTTP-API resource binding, or a write was refused (#1679) — see the enum
+ * member's docstring for the vocabulary argument and the relation to RESOURCE_OPERATION_PERFORMED.
+ *
+ * MINIMISATION is the shape of this schema: it names the FIELDS written and never their values. The
+ * values live in the system of record; a copy here would be a second store of that system's content, one
+ * the application's erasure never reaches. `writtenFieldNames` are the LOCAL names the caller sent,
+ * because those are the names a reviewer of this application reads.
+ *
+ * assurance-control: WILDO.AUDIT.ATTRIBUTION — every write sent into an external system through the shared
+ * service identity is recorded with the real initiating user, the row it reached and the fields it changed.
+ */
+export declare const AuditableEvent_HttpApiWriteThrough_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.HTTP_API_WRITE_THROUGH>;
+    resourceType: z.ZodString;
+    operationIdentifier: z.ZodString;
+    systemOfRecord: z.ZodString;
+    remoteEntityRef: z.ZodString;
+    dialect: z.ZodString;
+    outcome: z.ZodEnum<typeof HttpApiWriteThroughOutcome>;
+    resourceId: z.ZodOptional<z.ZodString>;
+    writtenFieldNames: z.ZodArray<z.ZodString>;
+    refusalCode: z.ZodOptional<z.ZodString>;
+    initiatorUserId: z.ZodOptional<z.ZodString>;
+    executionType: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    organizationUnitId: z.ZodOptional<z.ZodString>;
+    localResourceId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * What became of ONE declared system-of-record action that was sent, or replayed (#1678). Refusals before sending are a
+ * separate event type ({@link CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_REFUSED}).
+ */
+export declare enum SystemOfRecordActionOutcome {
+    /** The system of record performed the action. */
+    APPLIED = "applied",
+    /** The action was sent and the system of record refused it with a definite answer; nothing was applied. */
+    REMOTE_REFUSED = "remote_refused",
+    /**
+     * The action was sent and nobody knows whether it was performed — a timeout, a connection dropped after the request
+     * left, a gateway answering for the vendor, or an answer the engine could not read after the vendor answered success.
+     * A retry under the same Idempotency-Key answers this again rather than acting twice.
+     */
+    OUTCOME_UNKNOWN = "outcome_unknown",
+    /** A retry under an Idempotency-Key whose first attempt was APPLIED. Nothing was sent. */
+    REPLAYED = "replayed"
+}
+/**
+ * A declared system-of-record action was run (#1678) — see the enum member for the vocabulary argument.
+ *
+ * MINIMISATION is the shape: the input's field NAMES, never their values, and no result. The values live in the system
+ * of record; a copy here would be a second store of that system's content, one no erasure reaches.
+ *
+ * assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — every physical action call to a system of record is
+ * recorded with the instance, the action, the remote entity and its outcome.
+ * assurance-control: WILDO.AUDIT.ATTRIBUTION — the real initiating actor is recorded through the shared service identity.
+ */
+export declare const AuditableEvent_SystemOfRecordActionExecuted_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_EXECUTED>;
+    systemOfRecord: z.ZodString;
+    action: z.ZodString;
+    resourceType: z.ZodString;
+    remoteEntityRef: z.ZodString;
+    callShape: z.ZodString;
+    outcome: z.ZodEnum<typeof SystemOfRecordActionOutcome>;
+    writes: z.ZodBoolean;
+    targetResourceId: z.ZodOptional<z.ZodString>;
+    inputFieldNames: z.ZodArray<z.ZodString>;
+    failureCode: z.ZodOptional<z.ZodString>;
+    initiatorUserId: z.ZodOptional<z.ZodString>;
+    executionType: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    organizationUnitId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * A declared system-of-record action was REFUSED before anything was sent (#1678).
+ *
+ * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — every refusal of an action on a system of record is
+ * recorded with the caller, the instance, the action and the rule that refused it.
+ */
+export declare const AuditableEvent_SystemOfRecordActionRefused_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_REFUSED>;
+    systemOfRecord: z.ZodString;
+    action: z.ZodString;
+    resourceType: z.ZodOptional<z.ZodString>;
+    targetResourceId: z.ZodOptional<z.ZodString>;
+    refusalCode: z.ZodString;
+    refusalReason: z.ZodOptional<z.ZodString>;
+    initiatorUserId: z.ZodOptional<z.ZodString>;
+    executionType: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * An operator reset a pipeline (#1734) — see {@link CoreAuditableEventType.EXTERNAL_DATA_PIPELINE_RESET}.
+ *
+ * The DISCARDED state is the point of the row: the pass id, cursor and watermark are remote POSITIONS (an id, a
+ * continuation link, a timestamp), never record content, and they are what lets a reviewer say which part of a sync
+ * the reset threw away. The door is authenticated by the application admin secret, which names no person, so the
+ * row's `userId` is empty; `statedOperator` is who the operator SAID they are, recorded as a statement, and `reason`
+ * is their own words — which is why the event exports at SUBJECT_DETAIL.
+ *
+ * assurance-control: WILDO.AUDIT.SECURITY_EVENT — an operator's reset of a pipeline is recorded with what it discarded
+ * and why.
+ */
+export declare const AuditableEvent_ExternalDataPipelineReset_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EXTERNAL_DATA_PIPELINE_RESET>;
+    pipelineResourceType: z.ZodString;
+    systemOfRecord: z.ZodString;
+    resetMode: z.ZodEnum<typeof ExternalDataPipelineResetMode>;
+    reason: z.ZodString;
+    statedOperator: z.ZodOptional<z.ZodString>;
+    stateFound: z.ZodBoolean;
+    discardedPassId: z.ZodNullable<z.ZodString>;
+    discardedCursor: z.ZodNullable<z.ZodString>;
+    discardedPassStartedAt: z.ZodNullable<z.ZodString>;
+    discardedIncrementalWatermark: z.ZodNullable<z.ZodString>;
+    discardedIncrementalCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * An operator answered an outbound write of unknown outcome (#2039) — see
+ * {@link CoreAuditableEventType.EXTERNAL_DATA_OUTBOUND_UNKNOWN_RESOLVED}.
+ *
+ * Like the reset, the door is authenticated by the application admin secret, which names no person: the row's `userId`
+ * is empty, `statedOperator` is who the operator SAID they are, and `reason` is their own words (SUBJECT_DETAIL on
+ * export). `remoteKey` is the remote record's identity the operator supplied, never record content.
+ *
+ * assurance-control: WILDO.AUDIT.SECURITY_EVENT — an operator's answer about another system's state is recorded with
+ * what it changed locally and why.
+ */
+export declare const AuditableEvent_ExternalDataOutboundUnknownResolved_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EXTERNAL_DATA_OUTBOUND_UNKNOWN_RESOLVED>;
+    pipelineResourceType: z.ZodString;
+    systemOfRecord: z.ZodString;
+    localResourceId: z.ZodString;
+    operationIdentifier: z.ZodString;
+    answer: z.ZodEnum<typeof ExternalDataOutboundUnknownAnswer>;
+    remoteKey: z.ZodNullable<z.ZodString>;
+    remoteKeyWritten: z.ZodBoolean;
+    changeStillOwed: z.ZodBoolean;
+    reason: z.ZodString;
+    statedOperator: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * A BIDIRECTIONAL pipeline resolved a conflict on one row (#1723) — see
+ * {@link CoreAuditableEventType.EXTERNAL_DATA_CONFLICT_RESOLVED}. Identities and field NAMES only, never a field's
+ * value: the row says which side's change to which fields was discarded, and the values are in the two systems.
+ *
+ * assurance-control: WILDO.AUDIT.SECURITY_EVENT — a resolution that overwrites one side's data is recorded with the row,
+ * the fields, the winning side and who chose it.
+ */
+export declare const AuditableEvent_ExternalDataConflictResolved_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EXTERNAL_DATA_CONFLICT_RESOLVED>;
+    pipelineResourceType: z.ZodString;
+    systemOfRecord: z.ZodString;
+    localResourceId: z.ZodString;
+    remoteKey: z.ZodString;
+    winner: z.ZodEnum<typeof ExternalDataConflictWinner>;
+    decidedBy: z.ZodEnum<typeof ExternalDataConflictDecisionSource>;
+    overwrittenFieldNames: z.ZodArray<z.ZodString>;
+    remoteVersion: z.ZodNullable<z.ZodString>;
+    agreedVersion: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
 /**
  * A subject erasure COMPLETED while rows linked to the subject remain live in an HTTP_API-bound
  * external system, on the controller's explicit per-request acknowledgement (ETL D6 stance 6c).
@@ -2338,18 +3874,46 @@ export declare const AuditableEvent_HttpApiExternalErasure_EventDataSchema: z.Zo
  *
  * assurance-control: WILDO.AUDIT.ATTRIBUTION — an acknowledged erasure hole is recorded per
  * resource, per erasure request, never as a standing posture.
+ *
+ * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — a store the erasure deliberately did not
+ * reach is recorded as such, so the accounting cannot read as complete.
  */
 export declare const AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED>;
     subjectResourceType: z.ZodString;
     subjectIds: z.ZodArray<z.ZodString>;
     resourceType: z.ZodString;
-    providerRef: z.ZodString;
+    systemOfRecord: z.ZodString;
     remoteEntityRef: z.ZodString;
     dialect: z.ZodString;
     remainingRowCount: z.ZodOptional<z.ZodNumber>;
     organizationId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/**
+ * A subject erasure's outcome at one RECIPIENT of the subject's data (#1710) — see
+ * {@link CoreAuditableEventType.SUBJECT_ERASURE_RECIPIENT_OUTCOME}.
+ *
+ * Art. 19 asks the controller to communicate an erasure "to each recipient to whom the personal data have been
+ * disclosed" and to tell the data subject who they are on request; this row records, per recipient, what the erasure
+ * did and who owes that communication. `status` is absent for a recipient reached with the TENANT's account, which is
+ * the tenant's to notify and never the operator's effect to run.
+ * spec-cite: GDPR Art. 19, https://gdpr-info.eu/art-19-gdpr/ (fetched 2026-09-29)
+ *
+ * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — every recipient the application declares is accounted for
+ * at every erasure, and one that no effect reached is recorded as unmeasured rather than passing silently.
+ */
+export declare const AuditableEvent_SubjectErasureRecipientOutcome_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SUBJECT_ERASURE_RECIPIENT_OUTCOME>;
+    subjectResourceType: z.ZodString;
+    subjectIds: z.ZodArray<z.ZodString>;
+    recipientRef: z.ZodString;
+    reach: z.ZodEnum<typeof SubjectDataRecipientReach>;
+    obligation: z.ZodEnum<typeof SubjectDataRecipientObligation>;
+    relevance: z.ZodEnum<typeof SubjectDataRecipientRelevance>;
+    status: z.ZodOptional<z.ZodEnum<typeof SubjectErasureExternalEffectStatus>>;
+    effectRefs: z.ZodArray<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 /**
  * Audit-log event for cross-frontend session handoff issuance
  * (cross-app-jwt-propagation Step 2).
@@ -2535,21 +4099,57 @@ export declare const AuditableEvent_User_RefreshTokenReuseDetectedEventDataSchem
 export declare const AuditableEvent_DataSchema: z.ZodRecord<z.ZodString, z.ZodAny>;
 export declare const AuditableEvent_BaseSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    eventId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    eventId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     userId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     organizationId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     applicationId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     correlationId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     frontendServiceName: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     clientInstanceId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    actorKind: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof AuditActorKind>>>>>;
+    agentActor: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodObject<{
+        agentRef: z.ZodString;
+        agentExecutionId: z.ZodOptional<z.ZodString>;
+        systemRef: z.ZodOptional<z.ZodString>;
+        toolName: z.ZodOptional<z.ZodString>;
+        decisionRef: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    delegatingClientId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    principalCredentialId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    actingViaServiceProviderRelationshipId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    providerOrganizationId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    serviceProviderFactorSource: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof FactorSatisfactionSource>>>>;
     riskLevel: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ResourceOperationRiskLevel>>;
-    eventType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    eventType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     eventData: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodRecord<z.ZodString, z.ZodAny>>;
     eventCategory: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof AuditEventCategory>>;
     severity: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof AuditEventSeverity>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
 }, z.core.$strip>;
+/**
+ * One retention-class sweep run, summarised per class (#1636). Counts only — no row id, no field value, no
+ * person: the per-resource detail is in the `retentionEnforcementRecords` row the same run wrote.
+ */
+export declare const AuditableEvent_RetentionEnforcementRecorded_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.RETENTION_ENFORCEMENT_RECORDED>;
+    runRef: z.ZodString;
+    sweptAt: z.ZodString;
+    outcome: z.ZodEnum<typeof RetentionEnforcementOutcome>;
+    boundResourceCount: z.ZodNumber;
+    deletedCount: z.ZodNumber;
+    recordWriteFailureCount: z.ZodNumber;
+    classes: z.ZodArray<z.ZodObject<{
+        retentionClass: z.ZodEnum<typeof DataRetentionClass>;
+        resourceCount: z.ZodNumber;
+        deletedCount: z.ZodNumber;
+        completedCount: z.ZodNumber;
+        deferredByCeilingCount: z.ZodNumber;
+        failedCount: z.ZodNumber;
+        skippedCount: z.ZodNumber;
+        heldSkippedCount: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_LOGIN>;
     ipAddress: z.ZodString;
@@ -2642,6 +4242,13 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     operationIdentifier: z.ZodOptional<z.ZodString>;
     subjectUserId: z.ZodOptional<z.ZodString>;
     subjectNextStatus: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_TYPE_ASSIGNED>;
+    organizationId: z.ZodString;
+    organizationType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    previousType: z.ZodOptional<z.ZodString>;
+    basis: z.ZodEnum<typeof OrganizationTypeAssignmentBasis>;
+    justification: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_MEMBER_INVITED>;
     organizationId: z.ZodString;
@@ -2670,6 +4277,7 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     requestedRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
     operation: z.ZodString;
     changedBy: z.ZodString;
+    justification: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_MEMBER_STATUS_CHANGED>;
     organizationId: z.ZodString;
@@ -2808,6 +4416,11 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     deletedBy: z.ZodString;
     appRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>, z.ZodObject<{
+    assurance: z.ZodOptional<z.ZodObject<{
+        decision: z.ZodEnum<typeof import("../..").ExternalAssuranceDecision>;
+        reason: z.ZodEnum<typeof import("../..").ExternalAssuranceReason>;
+        enforcement: z.ZodEnum<typeof import("../..").ExternalAssuranceEnforcement>;
+    }, z.core.$strip>>;
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_SSO_LOGIN>;
     userId: z.ZodString;
     email: z.ZodEmail;
@@ -2821,6 +4434,11 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     userAgent: z.ZodString;
     sessionId: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
+    assurance: z.ZodOptional<z.ZodObject<{
+        decision: z.ZodEnum<typeof import("../..").ExternalAssuranceDecision>;
+        reason: z.ZodEnum<typeof import("../..").ExternalAssuranceReason>;
+        enforcement: z.ZodEnum<typeof import("../..").ExternalAssuranceEnforcement>;
+    }, z.core.$strip>>;
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_SSO_LOGIN_FAILED>;
     email: z.ZodOptional<z.ZodEmail>;
     providerRef: z.ZodOptional<z.ZodString>;
@@ -2835,9 +4453,11 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED>;
     email: z.ZodEmail;
-    attemptedProviderRef: z.ZodString;
-    attemptedConnectionType: z.ZodEnum<typeof SsoConnectionType>;
-    organizationId: z.ZodString;
+    attemptedProviderRef: z.ZodOptional<z.ZodString>;
+    attemptedConnectionType: z.ZodOptional<z.ZodEnum<typeof SsoConnectionType>>;
+    scopeType: z.ZodEnum<typeof AuthScopeType>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    applicationId: z.ZodOptional<z.ZodString>;
     enforcementPolicy: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
@@ -2855,16 +4475,34 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     affectedProviderRef: z.ZodOptional<z.ZodString>;
     changes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
 }, z.core.$strip>, z.ZodObject<{
+    organizationId: z.ZodString;
+    changedBy: z.ZodString;
+    changeType: z.ZodEnum<typeof SiemExportChangeType>;
+    webhookUrlDomain: z.ZodOptional<z.ZodString>;
+    eventFormatConfigured: z.ZodOptional<z.ZodString>;
+    changedFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED>;
+}, z.core.$strip>, z.ZodObject<{
     organizationId: z.ZodString;
     changedBy: z.ZodString;
     changeType: z.ZodEnum<typeof SiemExportChangeType>;
     webhookUrlDomain: z.ZodOptional<z.ZodString>;
     eventFormatConfigured: z.ZodOptional<z.ZodString>;
+    changedFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_DISABLED>;
+}, z.core.$strip>, z.ZodObject<{
+    organizationId: z.ZodString;
+    changedBy: z.ZodString;
+    changeType: z.ZodEnum<typeof SiemExportChangeType>;
+    webhookUrlDomain: z.ZodOptional<z.ZodString>;
+    eventFormatConfigured: z.ZodOptional<z.ZodString>;
+    changedFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_DESTINATION_CHANGED>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET>;
     organizationId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     setBy: z.ZodOptional<z.ZodString>;
     credentialId: z.ZodString;
@@ -2872,6 +4510,7 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED>;
     organizationId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     rotatedBy: z.ZodOptional<z.ZodString>;
     credentialId: z.ZodString;
@@ -2880,23 +4519,50 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED>;
     organizationId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
+    providerPackageName: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     resolvedFrom: z.ZodEnum<typeof ProviderCredentialResolutionSource>;
     credentialId: z.ZodOptional<z.ZodString>;
+    credentialSetByUserId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED>;
     organizationId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     deletedBy: z.ZodOptional<z.ZodString>;
     credentialId: z.ZodString;
     reason: z.ZodEnum<typeof ProviderCredentialDeletionReason>;
+    vendorRevocation: z.ZodOptional<z.ZodEnum<typeof import("../..").ProviderOAuth2RevocationOutcome>>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED>;
     changedUserTypes: z.ZodArray<z.ZodString>;
     snapshotDigest: z.ZodString;
     before: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
     after: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    auditApplicationReadAccess: z.ZodOptional<z.ZodObject<{
+        before: z.ZodNullable<z.ZodEnum<typeof AuditApplicationReadAccess>>;
+        after: z.ZodEnum<typeof AuditApplicationReadAccess>;
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.RETENTION_ENFORCEMENT_RECORDED>;
+    runRef: z.ZodString;
+    sweptAt: z.ZodString;
+    outcome: z.ZodEnum<typeof RetentionEnforcementOutcome>;
+    boundResourceCount: z.ZodNumber;
+    deletedCount: z.ZodNumber;
+    recordWriteFailureCount: z.ZodNumber;
+    classes: z.ZodArray<z.ZodObject<{
+        retentionClass: z.ZodEnum<typeof DataRetentionClass>;
+        resourceCount: z.ZodNumber;
+        deletedCount: z.ZodNumber;
+        completedCount: z.ZodNumber;
+        deferredByCeilingCount: z.ZodNumber;
+        failedCount: z.ZodNumber;
+        skippedCount: z.ZodNumber;
+        heldSkippedCount: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED>;
     organizationId: z.ZodOptional<z.ZodString>;
@@ -2908,6 +4574,207 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     responseStatus: z.ZodOptional<z.ZodNumber>;
     durationMs: z.ZodNumber;
     signatureJti: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    reason: z.ZodEnum<typeof InboundDeliveryRejectionReason>;
+    refusalCount: z.ZodNumber;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_REJECTED>;
+}, z.core.$strip>, z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    resolvedScopeKind: z.ZodEnum<typeof InboundResolvedScopeKind>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    channel: z.ZodEnum<typeof InboundChannelKind>;
+    senderAssurance: z.ZodEnum<typeof InboundSenderAssurance>;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_ACCEPTED>;
+}, z.core.$strip>, z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    reason: z.ZodEnum<typeof InboundDeliveryUnroutableReason>;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_UNROUTABLE>;
+}, z.core.$strip>, z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    attempt: z.ZodNumber;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_PROCESSED>;
+}, z.core.$strip>, z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    attempt: z.ZodNumber;
+    errorCode: z.ZodString;
+    nextAttemptAt: z.ZodDate;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_FAILED>;
+}, z.core.$strip>, z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    attempts: z.ZodNumber;
+    errorCode: z.ZodString;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_DEAD>;
+}, z.core.$strip>, z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    replayedBy: z.ZodString;
+    justification: z.ZodString;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_REPLAYED>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_BELOW_ASSURANCE>;
+    channel: z.ZodEnum<typeof InboundChannelKind>;
+    handlerRef: z.ZodString;
+    senderAssurance: z.ZodEnum<typeof InboundSenderAssurance>;
+    minimumSenderAssurance: z.ZodEnum<typeof InboundSenderAssurance>;
+    disposition: z.ZodEnum<typeof InboundBelowMinimumDisposition>;
+    belowMinimumHandlerRef: z.ZodOptional<z.ZodString>;
+    inboundDeliveryId: z.ZodOptional<z.ZodString>;
+    channelMessageId: z.ZodString;
+    organizationId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    templateRef: z.ZodString;
+    recipientCount: z.ZodNumber;
+    deduplicated: z.ZodBoolean;
+    channel: z.ZodEnum<typeof InboundChannelKind>;
+    threadId: z.ZodString;
+    conversationMessageId: z.ZodString;
+    submissionId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_REPLY_SENT>;
+}, z.core.$strip>, z.ZodObject<{
+    failureCode: z.ZodString;
+    channel: z.ZodEnum<typeof InboundChannelKind>;
+    threadId: z.ZodString;
+    conversationMessageId: z.ZodString;
+    submissionId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_REPLY_FAILED>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_REPLY_TOKEN_REVOKED>;
+    threadId: z.ZodString;
+    replyTokenId: z.ZodString;
+    reason: z.ZodEnum<typeof ReplyTokenRevocationReason>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_REPLY_TOKEN_DOWNGRADED>;
+    threadId: z.ZodString;
+    replyTokenId: z.ZodString;
+    reason: z.ZodEnum<typeof ReplyTokenDowngradeReason>;
+    derivedAssurance: z.ZodEnum<typeof InboundSenderAssurance>;
+}, z.core.$strip>, z.ZodObject<{
+    sending: z.ZodBoolean;
+    receiving: z.ZodBoolean;
+    organizationId: z.ZodString;
+    organizationEmailDomainId: z.ZodString;
+    domain: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_CLAIMED>;
+}, z.core.$strip>, z.ZodObject<{
+    providerRef: z.ZodString;
+    providerDomainId: z.ZodString;
+    organizationId: z.ZodString;
+    organizationEmailDomainId: z.ZodString;
+    domain: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_OWNERSHIP_VERIFIED>;
+}, z.core.$strip>, z.ZodObject<{
+    status: z.ZodEnum<typeof OrganizationEmailDomainStatus>;
+    organizationId: z.ZodString;
+    organizationEmailDomainId: z.ZodString;
+    domain: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_VERIFIED>;
+}, z.core.$strip>, z.ZodObject<{
+    reason: z.ZodEnum<typeof OrganizationEmailDomainSuspensionReason>;
+    organizationId: z.ZodString;
+    organizationEmailDomainId: z.ZodString;
+    domain: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_SUSPENDED>;
+}, z.core.$strip>, z.ZodObject<{
+    trigger: z.ZodEnum<typeof OrganizationEmailDomainRemovalTrigger>;
+    providerDomainDeleted: z.ZodBoolean;
+    organizationId: z.ZodString;
+    organizationEmailDomainId: z.ZodString;
+    domain: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_REMOVED>;
+}, z.core.$strip>, z.ZodObject<{
+    organizationId: z.ZodString;
+    clientMailboxId: z.ZodString;
+    address: z.ZodString;
+    emailDomainId: z.ZodString;
+    serviceProviderRelationshipId: z.ZodString;
+    firmOrganizationId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.CLIENT_MAILBOX_CREATED>;
+}, z.core.$strip>, z.ZodObject<{
+    organizationId: z.ZodString;
+    clientMailboxId: z.ZodString;
+    address: z.ZodString;
+    emailDomainId: z.ZodString;
+    serviceProviderRelationshipId: z.ZodString;
+    firmOrganizationId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.CLIENT_MAILBOX_REMOVED>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_EMAIL_ATTACHMENT_WITHHELD>;
+    organizationId: z.ZodString;
+    inboundEmailId: z.ZodString;
+    reason: z.ZodEnum<typeof InboundEmailWithheldReason>;
+    fileId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_EMAIL_REJECTED_LIMIT>;
+    organizationId: z.ZodString;
+    inboundEmailId: z.ZodString;
+    limit: z.ZodEnum<typeof InboundEmailLimit>;
+    sizeBytes: z.ZodNumber;
+    attachmentCount: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    autonomousAgentRef: z.ZodString;
+    organizationId: z.ZodString;
+    oauthClientId: z.ZodString;
+    principalSource: z.ZodEnum<typeof AutonomousPrincipalSource>;
+    providerOrganizationId: z.ZodOptional<z.ZodString>;
+    serviceProviderRelationshipId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.AUTONOMOUS_AGENT_BOUND>;
+}, z.core.$strip>, z.ZodObject<{
+    autonomousAgentRef: z.ZodString;
+    organizationId: z.ZodString;
+    oauthClientId: z.ZodString;
+    principalSource: z.ZodEnum<typeof AutonomousPrincipalSource>;
+    providerOrganizationId: z.ZodOptional<z.ZodString>;
+    serviceProviderRelationshipId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.AUTONOMOUS_AGENT_UNBOUND>;
+}, z.core.$strip>, z.ZodObject<{
+    executionId: z.ZodString;
+    systemRef: z.ZodString;
+    oauthClientId: z.ZodString;
+    principalSource: z.ZodEnum<typeof AutonomousPrincipalSource>;
+    autonomousAgentRef: z.ZodString;
+    organizationId: z.ZodString;
+    occurrenceKey: z.ZodString;
+    trigger: z.ZodEnum<typeof AutonomousTurnTrigger>;
+    caseRef: z.ZodOptional<z.ZodObject<{
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+    }, z.core.$strict>>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_STARTED>;
+}, z.core.$strip>, z.ZodObject<{
+    reason: z.ZodEnum<typeof AutonomousTurnRefusalReason>;
+    budgetDenialReason: z.ZodOptional<z.ZodString>;
+    runtimeErrorCode: z.ZodOptional<z.ZodString>;
+    oauthClientId: z.ZodOptional<z.ZodString>;
+    autonomousAgentRef: z.ZodString;
+    organizationId: z.ZodString;
+    occurrenceKey: z.ZodString;
+    trigger: z.ZodEnum<typeof AutonomousTurnTrigger>;
+    caseRef: z.ZodOptional<z.ZodObject<{
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+    }, z.core.$strict>>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_REFUSED>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.SCIM_TOKEN_CREATED>;
     organizationId: z.ZodString;
@@ -2967,6 +4834,8 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     email: z.ZodString;
     ipAddress: z.ZodString;
     userAgent: z.ZodString;
+    acquisitionChannel: z.ZodOptional<z.ZodEnum<typeof RegistrationAcquisitionChannel>>;
+    providerRef: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_EMAIL_VERIFIED>;
     userId: z.ZodString;
@@ -3140,11 +5009,13 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     isBulkOperation: z.ZodOptional<z.ZodBoolean>;
     resourceId: z.ZodOptional<z.ZodString>;
     affectedRecordCount: z.ZodOptional<z.ZodNumber>;
+    affectedResourceIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
     initiatorRoles: z.ZodArray<z.ZodString>;
     executionType: z.ZodEnum<typeof ExecutionContext_ExecutionType>;
     machineCredentialAuthMethod: z.ZodOptional<z.ZodString>;
     machineCredentialId: z.ZodOptional<z.ZodString>;
     subCallDepth: z.ZodNumber;
+    reason: z.ZodOptional<z.ZodString>;
     changedFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
     fieldEvidence: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         before: z.ZodOptional<z.ZodUnknown>;
@@ -3161,6 +5032,8 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     isBulkOperation: z.ZodOptional<z.ZodBoolean>;
     attemptedResourceIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
     requiredRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    escalatedRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    refusedSurface: z.ZodOptional<z.ZodString>;
     initiatorRoles: z.ZodArray<z.ZodString>;
     executionType: z.ZodEnum<typeof ExecutionContext_ExecutionType>;
     machineCredentialAuthMethod: z.ZodOptional<z.ZodString>;
@@ -3181,6 +5054,10 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     admissionDeclared: z.ZodBoolean;
     initiatorRoles: z.ZodArray<z.ZodString>;
     executionType: z.ZodEnum<typeof ExecutionContext_ExecutionType>;
+    machineCredential: z.ZodOptional<z.ZodObject<{
+        authMethod: z.ZodEnum<typeof import("../..").MachineAuthMethod>;
+        credentialId: z.ZodString;
+    }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS>;
     resourceType: z.ZodString;
@@ -3205,6 +5082,218 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     autoApprovalReason: z.ZodOptional<z.ZodEnum<typeof PlatformAccessGrantAutoApprovalReason>>;
     decidedByUserId: z.ZodOptional<z.ZodString>;
     decisionReason: z.ZodOptional<z.ZodString>;
+    grantedMachineCredential: z.ZodOptional<z.ZodObject<{
+        authMethod: z.ZodEnum<typeof import("../..").MachineAuthMethod>;
+        credentialId: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    placedByUserId: z.ZodString;
+    holdId: z.ZodString;
+    heldOrganizationId: z.ZodString;
+    scopeKind: z.ZodEnum<typeof LegalHoldScopeKind>;
+    legalGround: z.ZodEnum<typeof LegalHoldGround>;
+    placementTier: z.ZodEnum<typeof LegalHoldPlacementTier>;
+    heldResourceType: z.ZodOptional<z.ZodString>;
+    heldRowCount: z.ZodOptional<z.ZodNumber>;
+    subjectUserId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.LEGAL_HOLD_PLACED>;
+}, z.core.$strip>, z.ZodObject<{
+    releasedByUserId: z.ZodString;
+    heldForSeconds: z.ZodNumber;
+    holdId: z.ZodString;
+    heldOrganizationId: z.ZodString;
+    scopeKind: z.ZodEnum<typeof LegalHoldScopeKind>;
+    legalGround: z.ZodEnum<typeof LegalHoldGround>;
+    placementTier: z.ZodEnum<typeof LegalHoldPlacementTier>;
+    heldResourceType: z.ZodOptional<z.ZodString>;
+    heldRowCount: z.ZodOptional<z.ZodNumber>;
+    subjectUserId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.LEGAL_HOLD_RELEASED>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.MODEL_COST_AGGREGATE_INVOICE_LINKED>;
+    aggregateId: z.ZodString;
+    billedOrganizationId: z.ZodString;
+    periodStart: z.ZodString;
+    currency: z.ZodString;
+    organizationInvoiceRefId: z.ZodString;
+    linkedByUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.CORRECTION_CAPTURE_SETTING_CHANGED>;
+    settingOrganizationId: z.ZodString;
+    previousContentCapture: z.ZodOptional<z.ZodString>;
+    contentCapture: z.ZodString;
+    purposeStated: z.ZodBoolean;
+    contentReaderRole: z.ZodOptional<z.ZodString>;
+    narrowedToCaseCount: z.ZodNumber;
+    changedByUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EVALUATION_EXPORT_AUTHORIZATION_CHANGED>;
+    authorizationOrganizationId: z.ZodString;
+    status: z.ZodString;
+    previousStatus: z.ZodOptional<z.ZodString>;
+    basis: z.ZodOptional<z.ZodString>;
+    clientConsentCount: z.ZodNumber;
+    excludedCaseCount: z.ZodNumber;
+    changedByUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EVALUATION_DATASET_EXPORTED>;
+    exportId: z.ZodString;
+    exportOrganizationId: z.ZodString;
+    agentRef: z.ZodString;
+    basis: z.ZodString;
+    recordCount: z.ZodNumber;
+    windowFrom: z.ZodString;
+    windowTo: z.ZodString;
+    destination: z.ZodString;
+    exportedByUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EVALUATION_DATASET_EXPORT_REFUSED>;
+    exportOrganizationId: z.ZodString;
+    agentRef: z.ZodString;
+    reason: z.ZodEnum<typeof EvaluationDatasetExportRefusalReason>;
+    attemptedByUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_RELATIONSHIP_LIFECYCLE>;
+    transition: z.ZodEnum<typeof ServiceProviderRelationshipTransition>;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    resultingStatus: z.ZodEnum<typeof ServiceProviderRelationshipStatus>;
+    role: z.ZodString;
+    organizationUnitIds: z.ZodArray<z.ZodString>;
+    endsAt: z.ZodOptional<z.ZodDate>;
+    proposedByOrganizationId: z.ZodString;
+    actorUserId: z.ZodOptional<z.ZodString>;
+    actorOrganizationId: z.ZodOptional<z.ZodString>;
+    purpose: z.ZodOptional<z.ZodString>;
+    decisionReason: z.ZodOptional<z.ZodString>;
+    expertAdmissionPolicy: z.ZodOptional<z.ZodEnum<typeof ServiceProviderExpertAdmissionPolicy>>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_MACHINE_CLIENT_ADMISSION_CHANGED>;
+    admitted: z.ZodBoolean;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    oauthClientId: z.ZodString;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_ASSIGNED>;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_UNASSIGNED>;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    expertAdmissionPolicy: z.ZodEnum<typeof ServiceProviderExpertAdmissionPolicy>;
+    role: z.ZodString;
+    actorUserId: z.ZodOptional<z.ZodString>;
+    decisionRef: z.ZodString;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_REQUESTED>;
+}, z.core.$strip>, z.ZodObject<{
+    role: z.ZodString;
+    decisionRef: z.ZodString;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_GRANTED>;
+}, z.core.$strip>, z.ZodObject<{
+    denialReason: z.ZodEnum<typeof ServiceProviderExpertApprovalDenialReason>;
+    decisionRef: z.ZodString;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_DENIED>;
+}, z.core.$strip>, z.ZodObject<{
+    decisionRef: z.ZodString;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_LAPSED>;
+}, z.core.$strip>, z.ZodObject<{
+    grantId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    capability: z.ZodEnum<typeof DelegatedAdministrativeCapability>;
+    securityCritical: z.ZodBoolean;
+    endsAt: z.ZodDate;
+    actorUserId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_GRANTED>;
+}, z.core.$strip>, z.ZodObject<{
+    byRelationshipEnd: z.ZodBoolean;
+    endCause: z.ZodOptional<z.ZodEnum<typeof ServiceProviderCapabilityGrantEndCause>>;
+    endedCredentials: z.ZodOptional<z.ZodNumber>;
+    grantId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    capability: z.ZodEnum<typeof DelegatedAdministrativeCapability>;
+    securityCritical: z.ZodBoolean;
+    endsAt: z.ZodDate;
+    actorUserId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_REVOKED>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_MFA_TRUST_CHANGED>;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    previousProviderMfaTrust: z.ZodEnum<typeof ServiceProviderMfaTrust>;
+    providerMfaTrust: z.ZodEnum<typeof ServiceProviderMfaTrust>;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_CLIENT_AUTHENTICATION_SATISFIED>;
+    organizationId: z.ZodString;
+    relationshipId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    factor: z.ZodEnum<typeof AuthMethod>;
+    source: z.ZodEnum<typeof FactorSatisfactionSource>;
+    identityProviderOrganizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DECIDED>;
+    providerOrganizationId: z.ZodString;
+    previousStatus: z.ZodEnum<typeof ServiceProviderActivityFeedStatus>;
+    status: z.ZodEnum<typeof ServiceProviderActivityFeedStatus>;
+    acknowledgedWorkerConsultationNotice: z.ZodBoolean;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DISCLOSURE_CHANGED>;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    previousActivityFeedDisclosure: z.ZodEnum<typeof ServiceProviderActivityFeedDisclosure>;
+    activityFeedDisclosure: z.ZodEnum<typeof ServiceProviderActivityFeedDisclosure>;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_LIFECYCLE>;
+    transition: z.ZodEnum<typeof SystemOfRecordPartitionAssignmentTransition>;
+    assignmentId: z.ZodString;
+    system: z.ZodString;
+    remoteKey: z.ZodString;
+    organizationUnitId: z.ZodOptional<z.ZodString>;
+    previousOrganizationUnitId: z.ZodOptional<z.ZodString>;
+    justification: z.ZodOptional<z.ZodString>;
+    assignedByUserId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.RETAINED_DATA_ACCESS>;
     accessingUserId: z.ZodString;
@@ -3216,6 +5305,30 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
     organizationId: z.ZodOptional<z.ZodString>;
     ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.GOVERNED_DOCUMENT_INTERACTION_RECORDED>;
+    userId: z.ZodOptional<z.ZodString>;
+    anonymousUserId: z.ZodOptional<z.ZodString>;
+    interaction: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        interactionKind: z.ZodEnum<typeof import("../..").GovernedDocumentInteractionKind>;
+        release: z.ZodObject<{
+            document: z.ZodObject<{
+                documentRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                documentVersion: z.ZodNumber;
+            }, z.core.$strict>;
+            releaseId: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+            releaseVersion: z.ZodNumber;
+        }, z.core.$strict>;
+        documentClass: z.ZodEnum<typeof import("../..").GovernedDocumentClass>;
+        locale: z.ZodString;
+        jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
+        releaseApprovalState: z.ZodEnum<typeof import("../..").GovernedDocumentReleaseApprovalState>;
+        acceptanceMode: z.ZodOptional<z.ZodEnum<typeof import("../..").GovernedDocumentAcceptanceMode>>;
+        occurredAt: z.ZodISODateTime;
+    }, z.core.$strict>;
+    advisoryKinds: z.ZodArray<z.ZodString>;
+    ipAddress: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.SUBJECT_DATA_EXPORT>;
     purpose: z.ZodString;
@@ -3226,6 +5339,8 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     fieldsExcludedAsDerived: z.ZodArray<z.ZodString>;
     fieldsWithheldAsNonDisclosable: z.ZodArray<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
+    recipientsStatus: z.ZodEnum<typeof SubjectDataRecipientsStatementStatus>;
+    recipientRefs: z.ZodArray<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.COLLECTION_DATA_EXPORT>;
     resourceType: z.ZodString;
@@ -3246,7 +5361,7 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     eventType: z.ZodLiteral<CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS>;
     resourceType: z.ZodString;
     operationIdentifier: z.ZodString;
-    providerRef: z.ZodString;
+    systemOfRecord: z.ZodString;
     remoteEntityRef: z.ZodString;
     dialect: z.ZodString;
     initiatorUserId: z.ZodOptional<z.ZodString>;
@@ -3254,6 +5369,90 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     organizationId: z.ZodOptional<z.ZodString>;
     resourceId: z.ZodOptional<z.ZodString>;
     rowCount: z.ZodOptional<z.ZodNumber>;
+    rejectedRows: z.ZodOptional<z.ZodNumber>;
+    completedPass: z.ZodOptional<z.ZodBoolean>;
+    pipelinePassMode: z.ZodOptional<z.ZodEnum<typeof ExternalDataPipelinePassMode>>;
+    suppressedRows: z.ZodOptional<z.ZodNumber>;
+    liveSuppressedRows: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.HTTP_API_WRITE_THROUGH>;
+    resourceType: z.ZodString;
+    operationIdentifier: z.ZodString;
+    systemOfRecord: z.ZodString;
+    remoteEntityRef: z.ZodString;
+    dialect: z.ZodString;
+    outcome: z.ZodEnum<typeof HttpApiWriteThroughOutcome>;
+    resourceId: z.ZodOptional<z.ZodString>;
+    writtenFieldNames: z.ZodArray<z.ZodString>;
+    refusalCode: z.ZodOptional<z.ZodString>;
+    initiatorUserId: z.ZodOptional<z.ZodString>;
+    executionType: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    organizationUnitId: z.ZodOptional<z.ZodString>;
+    localResourceId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_EXECUTED>;
+    systemOfRecord: z.ZodString;
+    action: z.ZodString;
+    resourceType: z.ZodString;
+    remoteEntityRef: z.ZodString;
+    callShape: z.ZodString;
+    outcome: z.ZodEnum<typeof SystemOfRecordActionOutcome>;
+    writes: z.ZodBoolean;
+    targetResourceId: z.ZodOptional<z.ZodString>;
+    inputFieldNames: z.ZodArray<z.ZodString>;
+    failureCode: z.ZodOptional<z.ZodString>;
+    initiatorUserId: z.ZodOptional<z.ZodString>;
+    executionType: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    organizationUnitId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_REFUSED>;
+    systemOfRecord: z.ZodString;
+    action: z.ZodString;
+    resourceType: z.ZodOptional<z.ZodString>;
+    targetResourceId: z.ZodOptional<z.ZodString>;
+    refusalCode: z.ZodString;
+    refusalReason: z.ZodOptional<z.ZodString>;
+    initiatorUserId: z.ZodOptional<z.ZodString>;
+    executionType: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EXTERNAL_DATA_PIPELINE_RESET>;
+    pipelineResourceType: z.ZodString;
+    systemOfRecord: z.ZodString;
+    resetMode: z.ZodEnum<typeof ExternalDataPipelineResetMode>;
+    reason: z.ZodString;
+    statedOperator: z.ZodOptional<z.ZodString>;
+    stateFound: z.ZodBoolean;
+    discardedPassId: z.ZodNullable<z.ZodString>;
+    discardedCursor: z.ZodNullable<z.ZodString>;
+    discardedPassStartedAt: z.ZodNullable<z.ZodString>;
+    discardedIncrementalWatermark: z.ZodNullable<z.ZodString>;
+    discardedIncrementalCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EXTERNAL_DATA_OUTBOUND_UNKNOWN_RESOLVED>;
+    pipelineResourceType: z.ZodString;
+    systemOfRecord: z.ZodString;
+    localResourceId: z.ZodString;
+    operationIdentifier: z.ZodString;
+    answer: z.ZodEnum<typeof ExternalDataOutboundUnknownAnswer>;
+    remoteKey: z.ZodNullable<z.ZodString>;
+    remoteKeyWritten: z.ZodBoolean;
+    changeStillOwed: z.ZodBoolean;
+    reason: z.ZodString;
+    statedOperator: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EXTERNAL_DATA_CONFLICT_RESOLVED>;
+    pipelineResourceType: z.ZodString;
+    systemOfRecord: z.ZodString;
+    localResourceId: z.ZodString;
+    remoteKey: z.ZodString;
+    winner: z.ZodEnum<typeof ExternalDataConflictWinner>;
+    decidedBy: z.ZodEnum<typeof ExternalDataConflictDecisionSource>;
+    overwrittenFieldNames: z.ZodArray<z.ZodString>;
+    remoteVersion: z.ZodNullable<z.ZodString>;
+    agreedVersion: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.PROVIDER_OPERATION_CALL>;
     providerRef: z.ZodString;
@@ -3266,6 +5465,32 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     connectionDelegation: z.ZodString;
     status: z.ZodOptional<z.ZodNumber>;
     failureKind: z.ZodOptional<z.ZodString>;
+    scopeCheck: z.ZodOptional<z.ZodEnum<typeof ProviderOperationScopeCheck>>;
+    missingScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    initiatorUserId: z.ZodOptional<z.ZodString>;
+    executionType: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    augmentationPackage: z.ZodOptional<z.ZodString>;
+    augmentationPackageVersion: z.ZodOptional<z.ZodString>;
+    connectionRef: z.ZodOptional<z.ZodString>;
+    providerPackageName: z.ZodOptional<z.ZodString>;
+    tokenAudience: z.ZodOptional<z.ZodString>;
+    rateBudget: z.ZodOptional<z.ZodObject<{
+        budgetKeys: z.ZodArray<z.ZodString>;
+        counting: z.ZodEnum<typeof RateBudgetCounting>;
+        waitedMs: z.ZodNumber;
+        exhaustedBudgetKey: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.PROVIDER_OPERATION_DENIED>;
+    denialReason: z.ZodEnum<typeof ProviderOperationDenialReason>;
+    providerRef: z.ZodString;
+    operationId: z.ZodString;
+    connectionOwnerScope: z.ZodString;
+    connectionOwnerId: z.ZodOptional<z.ZodString>;
+    connectionDelegation: z.ZodString;
+    requiredRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    heldRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
     initiatorUserId: z.ZodOptional<z.ZodString>;
     executionType: z.ZodOptional<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
@@ -3274,7 +5499,7 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     subjectResourceType: z.ZodString;
     subjectIds: z.ZodArray<z.ZodString>;
     resourceType: z.ZodString;
-    providerRef: z.ZodString;
+    systemOfRecord: z.ZodString;
     remoteEntityRef: z.ZodString;
     dialect: z.ZodString;
     deletedRowCount: z.ZodNumber;
@@ -3284,11 +5509,22 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     subjectResourceType: z.ZodString;
     subjectIds: z.ZodArray<z.ZodString>;
     resourceType: z.ZodString;
-    providerRef: z.ZodString;
+    systemOfRecord: z.ZodString;
     remoteEntityRef: z.ZodString;
     dialect: z.ZodString;
     remainingRowCount: z.ZodOptional<z.ZodNumber>;
     organizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SUBJECT_ERASURE_RECIPIENT_OUTCOME>;
+    subjectResourceType: z.ZodString;
+    subjectIds: z.ZodArray<z.ZodString>;
+    recipientRef: z.ZodString;
+    reach: z.ZodEnum<typeof SubjectDataRecipientReach>;
+    obligation: z.ZodEnum<typeof SubjectDataRecipientObligation>;
+    relevance: z.ZodEnum<typeof SubjectDataRecipientRelevance>;
+    status: z.ZodOptional<z.ZodEnum<typeof SubjectErasureExternalEffectStatus>>;
+    effectRefs: z.ZodArray<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED>;
     userId: z.ZodString;
@@ -3382,6 +5618,7 @@ export type AuditableEvent_User_SessionExpiredEventData = z.infer<typeof Auditab
 export type AuditableEvent_User_AppRolesChangedEventData = z.infer<typeof AuditableEvent_User_AppRolesChangedEventDataSchema>;
 export type AuditableEvent_Application_SuperAdminFloorBreachedEventData = z.infer<typeof AuditableEvent_Application_SuperAdminFloorBreachedEventDataSchema>;
 export type AuditableEvent_Organization_OwnerFloorBreachedEventData = z.infer<typeof AuditableEvent_Organization_OwnerFloorBreachedEventDataSchema>;
+export type AuditableEvent_Organization_TypeAssignedEventData = z.infer<typeof AuditableEvent_Organization_TypeAssignedEventDataSchema>;
 export type AuditableEvent_User_DeletedEventData = z.infer<typeof AuditableEvent_User_DeletedEventDataSchema>;
 export type AuditableEvent_OrganizationMember_InvitedEventData = z.infer<typeof AuditableEvent_OrganizationMember_InvitedEventDataSchema>;
 export type AuditableEvent_OrganizationMember_JoinedEventData = z.infer<typeof AuditableEvent_OrganizationMember_JoinedEventDataSchema>;
@@ -3409,6 +5646,8 @@ export type AuditableEvent_User_SSOEnforcementBlockedEventData = z.infer<typeof
 export type AuditableEvent_User_TokenRefreshedEventData = z.infer<typeof AuditableEvent_User_TokenRefreshedEventDataSchema>;
 export type AuditableEvent_Organization_SSOConfigurationChangedEventData = z.infer<typeof AuditableEvent_Organization_SSOConfigurationChangedEventDataSchema>;
 export type AuditableEvent_Organization_SIEMExportConfiguredEventData = z.infer<typeof AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema>;
+export type AuditableEvent_Organization_SIEMExportDisabledEventData = z.infer<typeof AuditableEvent_Organization_SIEMExportDisabledEventDataSchema>;
+export type AuditableEvent_Organization_SIEMExportDestinationChangedEventData = z.infer<typeof AuditableEvent_Organization_SIEMExportDestinationChangedEventDataSchema>;
 export type AuditableEvent_OrganizationProviderCredential_SetEventData = z.infer<typeof AuditableEvent_OrganizationProviderCredential_SetEventDataSchema>;
 export type AuditableEvent_OrganizationProviderCredential_RotatedEventData = z.infer<typeof AuditableEvent_OrganizationProviderCredential_RotatedEventDataSchema>;
 export type AuditableEvent_OrganizationProviderCredential_UsedEventData = z.infer<typeof AuditableEvent_OrganizationProviderCredential_UsedEventDataSchema>;
@@ -3421,7 +5660,29 @@ export type AuditableEvent_UserProviderConnection_GrantedEventData = z.infer<typ
 export type AuditableEvent_OrganizationProviderConnection_GrantedEventData = z.infer<typeof AuditableEvent_OrganizationProviderConnection_GrantedEventDataSchema>;
 export type ApplicationAuthPolicySnapshot = z.infer<typeof ApplicationAuthPolicySnapshotSchema>;
 export type AuditableEvent_ApplicationAuthPolicyChanged_EventData = z.infer<typeof AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema>;
+export type AuditableEvent_RetentionEnforcementRecorded_EventData = z.infer<typeof AuditableEvent_RetentionEnforcementRecorded_EventDataSchema>;
 export type AuditableEvent_Webhook_EndpointTestDispatchedEventData = z.infer<typeof AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchema>;
+export type AuditableEvent_InboundDelivery_RejectedEventData = z.infer<typeof AuditableEvent_InboundDelivery_RejectedEventDataSchema>;
+export type AuditableEvent_InboundDelivery_AcceptedEventData = z.infer<typeof AuditableEvent_InboundDelivery_AcceptedEventDataSchema>;
+export type AuditableEvent_InboundDelivery_UnroutableEventData = z.infer<typeof AuditableEvent_InboundDelivery_UnroutableEventDataSchema>;
+export type AuditableEvent_InboundDelivery_ProcessedEventData = z.infer<typeof AuditableEvent_InboundDelivery_ProcessedEventDataSchema>;
+export type AuditableEvent_InboundDelivery_FailedEventData = z.infer<typeof AuditableEvent_InboundDelivery_FailedEventDataSchema>;
+export type AuditableEvent_InboundDelivery_DeadEventData = z.infer<typeof AuditableEvent_InboundDelivery_DeadEventDataSchema>;
+export type AuditableEvent_InboundDelivery_ReplayedEventData = z.infer<typeof AuditableEvent_InboundDelivery_ReplayedEventDataSchema>;
+export type AuditableEvent_InboundDelivery_BelowAssuranceEventData = z.infer<typeof AuditableEvent_InboundDelivery_BelowAssuranceEventDataSchema>;
+export type AuditableEvent_InboundReply_SentEventData = z.infer<typeof AuditableEvent_InboundReply_SentEventDataSchema>;
+export type AuditableEvent_InboundReply_FailedEventData = z.infer<typeof AuditableEvent_InboundReply_FailedEventDataSchema>;
+export type AuditableEvent_InboundReplyToken_RevokedEventData = z.infer<typeof AuditableEvent_InboundReplyToken_RevokedEventDataSchema>;
+export type AuditableEvent_InboundReplyToken_DowngradedEventData = z.infer<typeof AuditableEvent_InboundReplyToken_DowngradedEventDataSchema>;
+export type AuditableEvent_OrganizationEmailDomain_ClaimedEventData = z.infer<typeof AuditableEvent_OrganizationEmailDomain_ClaimedEventDataSchema>;
+export type AuditableEvent_OrganizationEmailDomain_OwnershipVerifiedEventData = z.infer<typeof AuditableEvent_OrganizationEmailDomain_OwnershipVerifiedEventDataSchema>;
+export type AuditableEvent_OrganizationEmailDomain_VerifiedEventData = z.infer<typeof AuditableEvent_OrganizationEmailDomain_VerifiedEventDataSchema>;
+export type AuditableEvent_OrganizationEmailDomain_SuspendedEventData = z.infer<typeof AuditableEvent_OrganizationEmailDomain_SuspendedEventDataSchema>;
+export type AuditableEvent_OrganizationEmailDomain_RemovedEventData = z.infer<typeof AuditableEvent_OrganizationEmailDomain_RemovedEventDataSchema>;
+export type AuditableEvent_ClientMailbox_CreatedEventData = z.infer<typeof AuditableEvent_ClientMailbox_CreatedEventDataSchema>;
+export type AuditableEvent_ClientMailbox_RemovedEventData = z.infer<typeof AuditableEvent_ClientMailbox_RemovedEventDataSchema>;
+export type AuditableEvent_InboundEmail_AttachmentWithheldEventData = z.infer<typeof AuditableEvent_InboundEmail_AttachmentWithheldEventDataSchema>;
+export type AuditableEvent_InboundEmail_RejectedLimitEventData = z.infer<typeof AuditableEvent_InboundEmail_RejectedLimitEventDataSchema>;
 export type AuditableEvent_SCIM_TokenCreatedEventData = z.infer<typeof AuditableEvent_SCIM_TokenCreatedEventDataSchema>;
 export type AuditableEvent_SCIM_TokenRevokedEventData = z.infer<typeof AuditableEvent_SCIM_TokenRevokedEventDataSchema>;
 export type AuditableEvent_SCIM_UserProvisionedEventData = z.infer<typeof AuditableEvent_SCIM_UserProvisionedEventDataSchema>;
@@ -3455,13 +5716,22 @@ export type AuditableEvent_ResourceOperationPerformed_EventData = z.infer<typeof
 export type AuditableEvent_PlatformDirectoryAccess_EventData = z.infer<typeof AuditableEvent_PlatformDirectoryAccess_EventDataSchema>;
 export type AuditableEvent_ResourceOperationDenied_EventData = z.infer<typeof AuditableEvent_ResourceOperationDenied_EventDataSchema>;
 export type AuditableEvent_RetainedDataAccess_EventData = z.infer<typeof AuditableEvent_RetainedDataAccess_EventDataSchema>;
+export type AuditableEvent_GovernedDocument_InteractionRecordedEventData = z.infer<typeof AuditableEvent_GovernedDocument_InteractionRecordedEventDataSchema>;
 export type AuditableEvent_SubjectDataExport_EventData = z.infer<typeof AuditableEvent_SubjectDataExport_EventDataSchema>;
 export type AuditableEvent_CollectionDataExport_EventData = z.infer<typeof AuditableEvent_CollectionDataExport_EventDataSchema>;
 export type AuditableEvent_User_SessionEvictedEventData = z.infer<typeof AuditableEvent_User_SessionEvictedEventDataSchema>;
 export type AuditableEvent_HttpApiReadThroughAccess_EventData = z.infer<typeof AuditableEvent_HttpApiReadThroughAccess_EventDataSchema>;
+export type AuditableEvent_HttpApiWriteThrough_EventData = z.infer<typeof AuditableEvent_HttpApiWriteThrough_EventDataSchema>;
+export type AuditableEvent_SystemOfRecordActionExecuted_EventData = z.infer<typeof AuditableEvent_SystemOfRecordActionExecuted_EventDataSchema>;
+export type AuditableEvent_SystemOfRecordActionRefused_EventData = z.infer<typeof AuditableEvent_SystemOfRecordActionRefused_EventDataSchema>;
+export type AuditableEvent_ExternalDataPipelineReset_EventData = z.infer<typeof AuditableEvent_ExternalDataPipelineReset_EventDataSchema>;
+export type AuditableEvent_ExternalDataOutboundUnknownResolved_EventData = z.infer<typeof AuditableEvent_ExternalDataOutboundUnknownResolved_EventDataSchema>;
+export type AuditableEvent_ExternalDataConflictResolved_EventData = z.infer<typeof AuditableEvent_ExternalDataConflictResolved_EventDataSchema>;
 export type AuditableEvent_ProviderOperationCall_EventData = z.infer<typeof AuditableEvent_ProviderOperationCall_EventDataSchema>;
+export type AuditableEvent_ProviderOperationDenied_EventData = z.infer<typeof AuditableEvent_ProviderOperationDenied_EventDataSchema>;
 export type AuditableEvent_HttpApiExternalErasure_EventData = z.infer<typeof AuditableEvent_HttpApiExternalErasure_EventDataSchema>;
 export type AuditableEvent_HttpApiNonErasureAcknowledged_EventData = z.infer<typeof AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema>;
+export type AuditableEvent_SubjectErasureRecipientOutcome_EventData = z.infer<typeof AuditableEvent_SubjectErasureRecipientOutcome_EventDataSchema>;
 export type AuditableEvent_User_CrossFrontendHandoffIssuedEventData = z.infer<typeof AuditableEvent_User_CrossFrontendHandoffIssuedEventDataSchema>;
 export type AuditableEvent_OAuth_DelegatedTokenIssuedEventData = z.infer<typeof AuditableEvent_OAuth_DelegatedTokenIssuedEventDataSchema>;
 export type AuditableEvent_OAuth_ConsentGrantedEventData = z.infer<typeof AuditableEvent_OAuth_ConsentGrantedEventDataSchema>;