@wildo-ai/saas-models 1.1.5 → 1.1.7

package/dist/esm/compliance/audit-trails/auditable-events.shared.schema.d.ts

@@ -1,12 +1,33 @@
 import { AuditApplicationReadAccess } from './audit-trail-config.shared.schemas';
+import { AuditActorKind } from './audit-actor.shared.schemas';
+import { HumanDecision_Act, HumanDecision_Outcome, HumanDecision_Plane, HumanDecision_RefusalReason, HumanDecision_RequesterKind, HumanDecision_RouteChangeTrigger, HumanDecision_RouteKind, ReviewClockBasis, ReviewDeadlineKind, ReviewDeadlineOutcome, ReviewDeadlineStage, ReviewEscalationActionKind } from '../../flows-actors/human-decision.shared.schemas';
+import { AutonomousPrincipalSource, AutonomousTurnRefusalReason, AutonomousTurnTrigger } from '../../flows-actors/autonomous-agents.shared.schemas';
+import { EvaluationDatasetExportRefusalReason } from '../../flows-actors/agent-work-decisions.shared.schemas';
 import { z } from "zod";
-import { ExternalProvider_Connection_DelegationMode } from "@wildo-ai/external-connectors-models";
+import '@wildo-ai/zod-decorators';
+import { AuthMethod } from "../../security/authentications/authentication.shared.schemas";
+import { FactorSatisfactionSource } from "../../security/authentications/service-provider-client-authentication.shared.schemas";
+import { ServiceProviderActivityFeedDisclosure, ServiceProviderMfaTrust } from "../../organizations/service-provider-client-controls.shared.schemas";
+import { ServiceProviderActivityFeedStatus } from "../../organizations/service-provider-activity-feed.shared.schemas";
+import { ExternalProvider_Connection_DelegationMode, RateBudgetCounting } from "@wildo-ai/external-connectors-models";
+import { ExternalDataConflictDecisionSource, ExternalDataConflictWinner, ExternalDataOutboundUnknownAnswer, ExternalDataPipelinePassMode, ExternalDataPipelineResetMode } from '../../external-data/external-data-pipeline-pass-mode.shared';
+import { LegalHoldGround, LegalHoldPlacementTier, LegalHoldScopeKind } from "../privacy/legal-holds.shared.schemas";
+import { DataRetentionClass } from "../privacy/retention-schedule.shared.schemas";
+import { RetentionEnforcementOutcome } from "../privacy/retention-enforcement-records.shared.schemas";
+import { SubjectErasureExternalEffectStatus } from "../privacy/subject-erasure.shared.schemas";
+import { SubjectDataRecipientObligation, SubjectDataRecipientReach, SubjectDataRecipientRelevance, SubjectDataRecipientsStatementStatus } from "../privacy/subject-data-recipients.shared.schemas";
 import { RegistrationAcquisitionChannel } from "../../config/entity-identity-config.shared.schemas";
 import { ResourceOperationRiskLevel, ResourceOperationVariantType } from "../../resources/resources.shared.schemas";
 import { CoreResourceOperation } from "../../resources/resources.shared.core.definitions";
 import { PlatformAccessGrantAutoApprovalReason, PlatformAccessGrantLifecycleTransition, PlatformAccessGrantScope, PlatformAccessGrantStatus } from "../../security/authorizations/platform-access-grants.shared.schemas";
 import { SystemOfRecordPartitionAssignmentTransition } from "../../systems-of-record/system-of-record-partition-assignments.shared.schemas";
+import { DelegatedAdministrativeCapability, ServiceProviderCapabilityGrantEndCause } from "../../organizations/service-provider-capability-grants.shared.schemas";
+import { ServiceProviderExpertAdmissionPolicy, ServiceProviderExpertApprovalDenialReason, ServiceProviderRelationshipStatus, ServiceProviderRelationshipTransition } from "../../organizations/service-provider-relationships.shared.schemas";
 import { ExecutionContext_ExecutionType } from "../../runtime/execution-context.shared.schemas";
+import { InboundDeliveryRejectionReason, InboundDeliveryUnroutableReason, InboundResolvedScopeKind, InboundSourceKind } from "../../inbound/inbound-delivery.shared.schemas";
+import { InboundBelowMinimumDisposition, InboundChannelKind, InboundSenderAssurance, ReplyTokenDowngradeReason } from "../../inbound/inbound-channels.shared.schemas";
+import { ReplyTokenRevocationReason } from "../../inbound/conversation-threads.shared.schemas";
+import { InboundEmailLimit, InboundEmailWithheldReason, OrganizationEmailDomainRemovalTrigger, OrganizationEmailDomainStatus, OrganizationEmailDomainSuspensionReason } from "../../notifications/inbound-email/inbound-email.shared.schemas";
 import { AuthScopeType, SsoConnectionType } from "../../security/authentications/authentication.shared.schemas";
 import { WebhookEndpointProbeOutcome } from "../../notifications/m2m/webhook-config.shared.schemas";
 import { ProviderCredentialDeletionReason, ProviderCredentialResolutionSource } from "../../security/connected-accounts/provider-credentials.shared.schemas";
@@ -149,7 +170,29 @@ export declare enum CoreAuditableEventType {
     ORGANIZATION_PROVIDER_CONNECTION_GRANTED = "organization_provider_connection_granted",
     USER_PROVIDER_CONNECTION_GRANTED = "user_provider_connection_granted",
     APPLICATION_AUTH_POLICY_CHANGED = "application_auth_policy_changed",
+    RETENTION_ENFORCEMENT_RECORDED = "retention_enforcement_recorded",
     WEBHOOK_ENDPOINT_TEST_DISPATCHED = "webhook_endpoint_test_dispatched",
+    INBOUND_DELIVERY_REJECTED = "inbound_delivery_rejected",
+    INBOUND_DELIVERY_ACCEPTED = "inbound_delivery_accepted",
+    INBOUND_DELIVERY_UNROUTABLE = "inbound_delivery_unroutable",
+    INBOUND_DELIVERY_PROCESSED = "inbound_delivery_processed",
+    INBOUND_DELIVERY_FAILED = "inbound_delivery_failed",
+    INBOUND_DELIVERY_DEAD = "inbound_delivery_dead",
+    INBOUND_DELIVERY_REPLAYED = "inbound_delivery_replayed",
+    INBOUND_DELIVERY_BELOW_ASSURANCE = "inbound_delivery_below_assurance",
+    INBOUND_REPLY_SENT = "inbound_reply_sent",
+    INBOUND_REPLY_FAILED = "inbound_reply_failed",
+    INBOUND_REPLY_TOKEN_REVOKED = "inbound_reply_token_revoked",
+    INBOUND_REPLY_TOKEN_DOWNGRADED = "inbound_reply_token_downgraded",
+    ORGANIZATION_EMAIL_DOMAIN_CLAIMED = "organization_email_domain_claimed",
+    ORGANIZATION_EMAIL_DOMAIN_OWNERSHIP_VERIFIED = "organization_email_domain_ownership_verified",
+    ORGANIZATION_EMAIL_DOMAIN_VERIFIED = "organization_email_domain_verified",
+    ORGANIZATION_EMAIL_DOMAIN_SUSPENDED = "organization_email_domain_suspended",
+    ORGANIZATION_EMAIL_DOMAIN_REMOVED = "organization_email_domain_removed",
+    CLIENT_MAILBOX_CREATED = "client_mailbox_created",
+    CLIENT_MAILBOX_REMOVED = "client_mailbox_removed",
+    INBOUND_EMAIL_ATTACHMENT_WITHHELD = "inbound_email_attachment_withheld",
+    INBOUND_EMAIL_REJECTED_LIMIT = "inbound_email_rejected_limit",
     SCIM_TOKEN_CREATED = "scim_token_created",
     SCIM_TOKEN_REVOKED = "scim_token_revoked",
     SCIM_TOKEN_GENERATED = "scim_token_generated",
@@ -274,6 +317,105 @@ export declare enum CoreAuditableEventType {
     RESOURCE_OPERATION_DENIED = "resource_operation_denied",
     CROSS_TENANT_ADMINISTRATIVE_ACCESS = "cross_tenant_administrative_access",
     PLATFORM_ACCESS_GRANT_LIFECYCLE = "platform_access_grant_lifecycle",
+    /**
+     * A legal hold was placed (#1634): from this instant every deletion path skips or refuses the held scope.
+     * HIGH — it suspends a tenant's retention schedule and its data subjects' erasures.
+     *
+     * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion suspended under a recorded legal hold.
+     */
+    LEGAL_HOLD_PLACED = "legal_hold_placed",
+    /**
+     * A legal hold was released (#1634): deletion of its scope resumes on the next sweep, purge or erasure.
+     *
+     * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion resumes only on a recorded release.
+     */
+    LEGAL_HOLD_RELEASED = "legal_hold_released",
+    /**
+     * A model-cost period aggregate was linked to the invoice that bills it (#1598). A retention-deciding act: the
+     * link is what keeps the aggregate past its tenant's deletion, for the statutory bookkeeping period.
+     *
+     * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — only an aggregate an invoice bills outlives its tenant.
+     */
+    MODEL_COST_AGGREGATE_INVOICE_LINKED = "model_cost_aggregate_invoice_linked",
+    /**
+     * An organization changed whether it keeps the CONTENT of its experts' corrections to agent work (#1599): the
+     * opt-in, its purpose, its reader role or its narrowing.
+     *
+     * assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — every change to what the tenant keeps of its client material is recorded.
+     */
+    CORRECTION_CAPTURE_SETTING_CHANGED = "correction_capture_setting_changed",
+    /**
+     * An organization recorded, changed or revoked its basis for exporting its experts' corrections as evaluation
+     * data (#1599).
+     *
+     * assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT — the authorisation an export relies on is recorded.
+     */
+    EVALUATION_EXPORT_AUTHORIZATION_CHANGED = "evaluation_export_authorization_changed",
+    /** A tenant's corrections were exported as an evaluation dataset under its recorded authorisation (#1599). */
+    EVALUATION_DATASET_EXPORTED = "evaluation_dataset_exported",
+    /**
+     * An export of a tenant's corrections was REFUSED: no ACTIVE authorisation of that organization (#1599 I7).
+     *
+     * assurance-control: WILDO.PRIVACY.COLLECTION_DATA_EXPORT — a refused export is recorded, not only prevented.
+     */
+    EVALUATION_DATASET_EXPORT_REFUSED = "evaluation_dataset_export_refused",
+    /**
+     * A service-provider relationship moved (#1597) — proposed, accepted, declined, suspended, resumed,
+     * scope amended, terminated, withdrawn or expired. ONE event for the relationship's whole life with a
+     * {@link ServiceProviderRelationshipTransition} field (the `platformAccessGrants` shape), written to
+     * BOTH the client's and the firm's trail so each reads the relationship's timeline in its own.
+     */
+    SERVICE_PROVIDER_RELATIONSHIP_LIFECYCLE = "service_provider_relationship_lifecycle",
+    /** A firm-owned OAuth client was admitted into, or removed from, a client organization (#1597, S3). */
+    SERVICE_PROVIDER_MACHINE_CLIENT_ADMISSION_CHANGED = "service_provider_machine_client_admission_changed",
+    /** A firm assigned one of its experts to serve a client relationship (#1597). */
+    SERVICE_PROVIDER_EXPERT_ASSIGNED = "service_provider_expert_assigned",
+    /** A firm ended an expert's assignment to a client relationship (#1597). */
+    SERVICE_PROVIDER_EXPERT_UNASSIGNED = "service_provider_expert_unassigned",
+    /**
+     * A firm assigned an expert under a relationship whose client approves each expert, so the assignment now waits
+     * for the client's administrators (#1612). The approval is a human decision; this row carries its `decisionRef`,
+     * so it joins that decision's own REQUESTED / RESOLVED rows rather than duplicating them. Both organizations' trails.
+     */
+    SERVICE_PROVIDER_EXPERT_APPROVAL_REQUESTED = "service_provider_expert_approval_requested",
+    /** The client approved the expert and the expert was admitted — a provider membership now exists (#1612). Both trails. */
+    SERVICE_PROVIDER_EXPERT_APPROVAL_GRANTED = "service_provider_expert_approval_granted",
+    /**
+     * The expert was NOT admitted (#1612): the client refused, or approved when the relationship, the expert's firm
+     * membership or the (person, client) slot no longer allowed it. `denialReason` says which. Both trails.
+     */
+    SERVICE_PROVIDER_EXPERT_APPROVAL_DENIED = "service_provider_expert_approval_denied",
+    /** Nobody in the client answered before the approval's lapse; nothing was created (#1612). Both trails. */
+    SERVICE_PROVIDER_EXPERT_APPROVAL_LAPSED = "service_provider_expert_approval_lapsed",
+    /**
+     * A client lent a service firm's experts a named administrative capability, until a stated end (#1631). HIGH, CRITICAL
+     * for a security-critical capability. Written to both organizations' trails.
+     */
+    SERVICE_PROVIDER_CAPABILITY_GRANTED = "service_provider_capability_granted",
+    /** A client revoked a lent capability — or the relationship ended, which revokes them all (#1631). Both trails. */
+    SERVICE_PROVIDER_CAPABILITY_REVOKED = "service_provider_capability_revoked",
+    /**
+     * A client organization changed whether it trusts the firm's own identity provider's MFA on one relationship
+     * (#1633). HIGH: turning it on lets a proof made outside this application satisfy the client's authentication
+     * policy for the firm's experts. Written to the client's trail and the firm's.
+     */
+    SERVICE_PROVIDER_MFA_TRUST_CHANGED = "service_provider_mfa_trust_changed",
+    /**
+     * A firm's expert satisfied a CLIENT organization's authentication policy (#1633): a factor was recorded on the
+     * session for that client, with where it came from — a step-up answered here, or the firm's trusted identity
+     * provider. The client's answer to "was this expert's work MFA-protected, and by whom?". Client trail only.
+     */
+    SERVICE_PROVIDER_CLIENT_AUTHENTICATION_SATISFIED = "service_provider_client_authentication_satisfied",
+    /**
+     * A firm switched its expert-activity feed on or off (#1632). The record of a worker-monitoring decision: who,
+     * when, and whether the consultation notice was acknowledged. Firm trail.
+     */
+    SERVICE_PROVIDER_ACTIVITY_FEED_DECIDED = "service_provider_activity_feed_decided",
+    /**
+     * A client organization changed how much a firm's activity feed may say about work done in it (#1632). Written to
+     * the client's trail and the firm's, so the firm sees why its feed went quiet.
+     */
+    SERVICE_PROVIDER_ACTIVITY_FEED_DISCLOSURE_CHANGED = "service_provider_activity_feed_disclosure_changed",
     /**
      * A remote partition of a system of record was assigned to, moved between, or removed from an
      * organization unit.
@@ -342,12 +484,63 @@ export declare enum CoreAuditableEventType {
     SUBJECT_DATA_EXPORT = "subject_data_export",
     COLLECTION_DATA_EXPORT = "collection_data_export",
     HTTP_API_READ_THROUGH_ACCESS = "http_api_read_through_access",
+    HTTP_API_WRITE_THROUGH = "http_api_write_through",
+    SYSTEM_OF_RECORD_ACTION_EXECUTED = "system_of_record_action_executed",
+    SYSTEM_OF_RECORD_ACTION_REFUSED = "system_of_record_action_refused",
+    EXTERNAL_DATA_PIPELINE_RESET = "external_data_pipeline_reset",
+    EXTERNAL_DATA_OUTBOUND_UNKNOWN_RESOLVED = "external_data_outbound_unknown_resolved",
+    EXTERNAL_DATA_CONFLICT_RESOLVED = "external_data_conflict_resolved",
     HTTP_API_EXTERNAL_ERASURE = "http_api_external_erasure",
     HTTP_API_NON_ERASURE_ACKNOWLEDGED = "http_api_non_erasure_acknowledged",
+    SUBJECT_ERASURE_RECIPIENT_OUTCOME = "subject_erasure_recipient_outcome",
     PROVIDER_OPERATION_CALL = "provider_operation_call",
     PROVIDER_OPERATION_DENIED = "provider_operation_denied",
     MCP_TOOL_CALL = "mcp_tool_call",
-    AGENT_TOOL_APPROVAL_MODIFIED = "agent_tool_approval_modified",
+    PROVIDER_CAPABILITY_CALL = "provider_capability_call",
+    /** A decision was raised and is waiting. Actor: the requester's principal, with the agent. */
+    HUMAN_DECISION_REQUESTED = "human_decision_requested",
+    /**
+     * A decision ended — answered, lapsed, withdrawn, or its requester's authority lapsed. Exactly one
+     * per `decisionRef`, written only by whoever won the compare-and-swap that released the pause.
+     * `outcome` says which; a SIEM that wants modified approvals filters on it.
+     *
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — every human decision on an agent's action is recorded once, with its decider and outcome.
+     */
+    HUMAN_DECISION_RESOLVED = "human_decision_resolved",
+    /** A decision was moved to another person (an answerer's handover, or a supervisor's takeover). */
+    HUMAN_DECISION_REASSIGNED = "human_decision_reassigned",
+    /** A decision was escalated — moved up, never denied. */
+    HUMAN_DECISION_ESCALATED = "human_decision_escalated",
+    /** A role-routed decision was claimed by one holder, or given back to the role (`claimed: false`). */
+    HUMAN_DECISION_CLAIMED = "human_decision_claimed",
+    /** Someone tried to act on a decision and the predicate refused them. WARNING: the refusal is the evidence. */
+    HUMAN_DECISION_ANSWER_REFUSED = "human_decision_answer_refused",
+    /** A decision's CLAIM or DECISION deadline passed with nobody having taken or answered it. Actor: the application. */
+    HUMAN_DECISION_DEADLINE_MISSED = "human_decision_deadline_missed",
+    /**
+     * A deadline stage's escalation rule fired: who was notified, and — for a REASSIGN rule — whether its
+     * target resolved and could answer. Actor: the application.
+     *
+     * assurance-control: WILDO.AUDIT.SECURITY_EVENT — every rule-driven change to who is asked about an agent's action is recorded, including a reassignment refused because its target could not answer.
+     */
+    HUMAN_DECISION_ESCALATION_FIRED = "human_decision_escalation_fired",
+    /** A person admitted to answer stopped the decision's CLAIM and DECISION clocks, naming a declared pause state. */
+    HUMAN_DECISION_CLOCK_PAUSED = "human_decision_clock_paused",
+    /** A person admitted to answer restarted the clocks; the paused time was added to both deadlines. */
+    HUMAN_DECISION_CLOCK_RESUMED = "human_decision_clock_resumed",
+    /**
+     * An autonomous agent may now run in an organization: a client of that organization was bound to it,
+     * or a firm's client that runs it was admitted by the organization's service-provider relationship.
+     *
+     * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — granting an agent standing authority to act unattended is recorded.
+     */
+    AUTONOMOUS_AGENT_BOUND = "autonomous_agent_bound",
+    /** An autonomous agent may no longer run in an organization: its binding or its admission was removed. */
+    AUTONOMOUS_AGENT_UNBOUND = "autonomous_agent_unbound",
+    /** The autonomous entry point opened a turn. Actor: the machine principal it resolved. */
+    AUTONOMOUS_AGENT_TURN_STARTED = "autonomous_agent_turn_started",
+    /** The autonomous entry point refused to open a turn, and created nothing. WARNING: `reason` says why. */
+    AUTONOMOUS_AGENT_TURN_REFUSED = "autonomous_agent_turn_refused",
     /** A user-delegated `authorization_code` access token was minted for a third-party client
      *  (the client may now act AS the user at the bound A2A/MCP resource) — the flagship grant. */
     OAUTH_DELEGATED_TOKEN_ISSUED = "oauth_delegated_token_issued",
@@ -483,6 +676,49 @@ export declare enum ProviderOperationScopeCheck {
     /** The grant recorded its scopes and lacks at least one required scope. The call was refused before any request. */
     MISSING = "missing"
 }
+/**
+ * WHICH engine capability an outbound capability call discharged (#1712) — the egress, not the vendor.
+ *
+ * Deliberately not {@link EngineCapability}: file storage is not an engine capability (a storage is selected
+ * per field, not per application), and email is two capabilities (transactional and marketing) with one
+ * egress. The finer engine capability, where one exists, rides `engineCapability` beside it.
+ */
+export declare enum ProviderCapabilityEgress {
+    EMAIL = "email",
+    SMS = "sms",
+    BILLING = "billing",
+    FILE_STORAGE = "file_storage",
+    /** A captcha vendor's backend verification of a token a public form submitted (#1735). */
+    CAPTCHA = "captcha"
+}
+/** WHAT a capability call did (#1712). One member per act the egress performs; billing names its adapter method apart. */
+export declare enum ProviderCapabilityCallAction {
+    EMAIL_SEND = "email_send",
+    SMS_SEND = "sms_send",
+    /** One call of the billing adapter; `billingOperation` names which. */
+    BILLING_OPERATION = "billing_operation",
+    FILE_STORAGE_UPLOAD = "file_storage_upload",
+    FILE_STORAGE_DOWNLOAD = "file_storage_download",
+    FILE_STORAGE_READ_METADATA = "file_storage_read_metadata",
+    FILE_STORAGE_DELETE = "file_storage_delete",
+    /** One token sent to a captcha vendor's verification endpoint (reCAPTCHA `siteverify`). */
+    CAPTCHA_VERIFY = "captcha_verify"
+}
+/**
+ * How ONE capability call ended, as far as the application can know (#1712).
+ *
+ * Three members, not two, because a call can leave and never be answered: an email whose transport timed out after
+ * the request was sent may or may not have been accepted. Reporting that as a failure would invite a resend the
+ * vendor may already have honoured; reporting it as a success would claim what nobody observed.
+ */
+export declare enum ProviderCapabilityCallOutcome {
+    /** The vendor answered and accepted the call. */
+    SUCCEEDED = "succeeded",
+    /** The call was refused — by the vendor, or before it left (a missing credential, a refused request). */
+    FAILED = "failed",
+    /** The call left and its result was not observed (a timeout or a broken connection after sending). */
+    OUTCOME_UNKNOWN = "outcome_unknown"
+}
 export declare enum ProviderOperationDenialReason {
     /**
      * The caller authenticated without a person — an application API key, a machine identity. This door
@@ -668,7 +904,19 @@ export declare enum ResourceOperationDenialReason {
      * assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION
      * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
      */
-    STEP_UP_REQUIRED_BY_FRESHNESS = "step_up_required_by_freshness"
+    STEP_UP_REQUIRED_BY_FRESHNESS = "step_up_required_by_freshness",
+    /**
+     * A service firm's expert was refused in a CLIENT organization because the client organization type's
+     * authentication policy asks for a factor the session has not satisfied FOR THAT CLIENT (#1633).
+     *
+     * Distinct from the two above because the party that demanded the proof is a third one: not the operation, not the
+     * expert's own user type, but the TENANT the expert is working in. A reviewer reading the client's trail sees its
+     * own policy being enforced on outside staff; the row carries the relationship through the usual attribution.
+     *
+     * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the resource tenant's authentication policy is enforced on external experts, per request.
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+     */
+    STEP_UP_REQUIRED_BY_CLIENT_ORGANIZATION_POLICY = "step_up_required_by_client_organization_policy"
 }
 /** SSO configuration change type. */
 export declare enum SsoConfigChangeType {
@@ -1277,7 +1525,7 @@ export declare enum OrganizationTypeAssignmentBasis {
 export declare const AuditableEvent_Organization_TypeAssignedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_TYPE_ASSIGNED>;
     organizationId: z.ZodString;
-    organizationType: z.ZodString;
+    organizationType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
     previousType: z.ZodOptional<z.ZodString>;
     basis: z.ZodEnum<typeof OrganizationTypeAssignmentBasis>;
     justification: z.ZodOptional<z.ZodString>;
@@ -1619,6 +1867,7 @@ export declare const AuditableEvent_OrganizationProviderCredential_SetEventDataS
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET>;
     organizationId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     setBy: z.ZodOptional<z.ZodString>;
     credentialId: z.ZodString;
@@ -1636,6 +1885,7 @@ export declare const AuditableEvent_OrganizationProviderCredential_RotatedEventD
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED>;
     organizationId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     rotatedBy: z.ZodOptional<z.ZodString>;
     credentialId: z.ZodString;
@@ -1657,6 +1907,8 @@ export declare const AuditableEvent_OrganizationProviderCredential_UsedEventData
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED>;
     organizationId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
+    providerPackageName: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     resolvedFrom: z.ZodEnum<typeof ProviderCredentialResolutionSource>;
     credentialId: z.ZodOptional<z.ZodString>;
@@ -1675,6 +1927,7 @@ export declare const AuditableEvent_OrganizationProviderCredential_DeletedEventD
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED>;
     organizationId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     deletedBy: z.ZodOptional<z.ZodString>;
     credentialId: z.ZodString;
@@ -1702,6 +1955,7 @@ export declare const AuditableEvent_UserProviderCredential_SetEventDataSchema: z
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_SET>;
     userId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     credentialId: z.ZodString;
 }, z.core.$strip>;
@@ -1713,9 +1967,12 @@ export declare const AuditableEvent_UserProviderCredential_SetEventDataSchema: z
  *
  * `grantedScopes` is what the VENDOR said it issued, not what was asked for. The two differ often
  * enough to matter: a vendor may narrow a request against what the account is permitted, and the
- * answer to "what could this application actually do as them" is the granted set. Optional because
- * several vendors return no scope at all on a token response, and an empty array would assert
- * something stronger than silence.
+ * answer to "what could this application actually do as them" is the granted set. Since #1671 it is the
+ * set the stored grant RECORDS after this authorization: a token answer without `scope` granted what was
+ * requested (RFC 6749 §5.1), and a re-authorization of a vendor that accumulates consent unites the new
+ * answer with the previous consent (`consentAccumulated`). Optional because a grant may record none, and an
+ * empty array would assert something stronger than silence.
+ * spec-cite: RFC 6749 §5.1 (the `scope` row of the access token response).
  *
  * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — a user authorizes third-party
  * delegated access, and the authorization's extent is recorded with it.
@@ -1724,11 +1981,17 @@ export declare const AuditableEvent_UserProviderConnection_GrantedEventDataSchem
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PROVIDER_CONNECTION_GRANTED>;
     userId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
+    providerPackageName: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     credentialId: z.ZodString;
     grantedScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
     accountRef: z.ZodOptional<z.ZodString>;
     replacedExistingConnection: z.ZodBoolean;
+    addedScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    addedForOperationId: z.ZodOptional<z.ZodString>;
+    addedForPackageName: z.ZodOptional<z.ZodString>;
+    consentAccumulated: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 /**
  * An ORGANIZATION's delegated authorization toward a vendor was granted.
@@ -1747,6 +2010,8 @@ export declare const AuditableEvent_OrganizationProviderConnection_GrantedEventD
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CONNECTION_GRANTED>;
     organizationId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
+    providerPackageName: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     credentialId: z.ZodString;
     grantedByUserId: z.ZodOptional<z.ZodString>;
@@ -1755,6 +2020,10 @@ export declare const AuditableEvent_OrganizationProviderConnection_GrantedEventD
     replacedExistingConnection: z.ZodBoolean;
     delegation: z.ZodOptional<z.ZodEnum<typeof ExternalProvider_Connection_DelegationMode>>;
     organizationWideUseAcknowledged: z.ZodOptional<z.ZodBoolean>;
+    addedScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    addedForOperationId: z.ZodOptional<z.ZodString>;
+    addedForPackageName: z.ZodOptional<z.ZodString>;
+    consentAccumulated: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 /**
  * The stored VALUE changed for a person's credential that already existed.
@@ -1770,6 +2039,7 @@ export declare const AuditableEvent_UserProviderCredential_RotatedEventDataSchem
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_ROTATED>;
     userId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     credentialId: z.ZodString;
     previousSecretSetAt: z.ZodOptional<z.ZodString>;
@@ -1789,6 +2059,8 @@ export declare const AuditableEvent_UserProviderCredential_UsedEventDataSchema:
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_USED>;
     userId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
+    providerPackageName: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     resolvedFrom: z.ZodEnum<typeof ProviderCredentialResolutionSource>;
     credentialId: z.ZodString;
@@ -1817,6 +2089,7 @@ export declare const AuditableEvent_UserProviderCredential_DeletedEventDataSchem
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED>;
     userId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     deletedBy: z.ZodOptional<z.ZodString>;
     credentialId: z.ZodString;
@@ -1849,6 +2122,184 @@ export declare const AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchem
     durationMs: z.ZodNumber;
     signatureJti: z.ZodString;
 }, z.core.$strip>;
+export declare const AuditableEvent_InboundDelivery_RejectedEventDataSchema: z.ZodObject<{
+    reason: z.ZodEnum<typeof InboundDeliveryRejectionReason>;
+    refusalCount: z.ZodNumber;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_REJECTED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundDelivery_AcceptedEventDataSchema: z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    resolvedScopeKind: z.ZodEnum<typeof InboundResolvedScopeKind>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    channel: z.ZodEnum<typeof InboundChannelKind>;
+    senderAssurance: z.ZodEnum<typeof InboundSenderAssurance>;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_ACCEPTED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundDelivery_UnroutableEventDataSchema: z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    reason: z.ZodEnum<typeof InboundDeliveryUnroutableReason>;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_UNROUTABLE>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundDelivery_ProcessedEventDataSchema: z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    attempt: z.ZodNumber;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_PROCESSED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundDelivery_FailedEventDataSchema: z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    attempt: z.ZodNumber;
+    errorCode: z.ZodString;
+    nextAttemptAt: z.ZodDate;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_FAILED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundDelivery_DeadEventDataSchema: z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    attempts: z.ZodNumber;
+    errorCode: z.ZodString;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_DEAD>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundDelivery_ReplayedEventDataSchema: z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    replayedBy: z.ZodString;
+    justification: z.ZodString;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_REPLAYED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundDelivery_BelowAssuranceEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_BELOW_ASSURANCE>;
+    channel: z.ZodEnum<typeof InboundChannelKind>;
+    handlerRef: z.ZodString;
+    senderAssurance: z.ZodEnum<typeof InboundSenderAssurance>;
+    minimumSenderAssurance: z.ZodEnum<typeof InboundSenderAssurance>;
+    disposition: z.ZodEnum<typeof InboundBelowMinimumDisposition>;
+    belowMinimumHandlerRef: z.ZodOptional<z.ZodString>;
+    inboundDeliveryId: z.ZodOptional<z.ZodString>;
+    channelMessageId: z.ZodString;
+    organizationId: z.ZodString;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundReply_SentEventDataSchema: z.ZodObject<{
+    templateRef: z.ZodString;
+    recipientCount: z.ZodNumber;
+    deduplicated: z.ZodBoolean;
+    channel: z.ZodEnum<typeof InboundChannelKind>;
+    threadId: z.ZodString;
+    conversationMessageId: z.ZodString;
+    submissionId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_REPLY_SENT>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundReply_FailedEventDataSchema: z.ZodObject<{
+    failureCode: z.ZodString;
+    channel: z.ZodEnum<typeof InboundChannelKind>;
+    threadId: z.ZodString;
+    conversationMessageId: z.ZodString;
+    submissionId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_REPLY_FAILED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundReplyToken_RevokedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_REPLY_TOKEN_REVOKED>;
+    threadId: z.ZodString;
+    replyTokenId: z.ZodString;
+    reason: z.ZodEnum<typeof ReplyTokenRevocationReason>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundReplyToken_DowngradedEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_REPLY_TOKEN_DOWNGRADED>;
+    threadId: z.ZodString;
+    replyTokenId: z.ZodString;
+    reason: z.ZodEnum<typeof ReplyTokenDowngradeReason>;
+    derivedAssurance: z.ZodEnum<typeof InboundSenderAssurance>;
+}, z.core.$strip>;
+export declare const AuditableEvent_OrganizationEmailDomain_ClaimedEventDataSchema: z.ZodObject<{
+    sending: z.ZodBoolean;
+    receiving: z.ZodBoolean;
+    organizationId: z.ZodString;
+    organizationEmailDomainId: z.ZodString;
+    domain: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_CLAIMED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_OrganizationEmailDomain_OwnershipVerifiedEventDataSchema: z.ZodObject<{
+    providerRef: z.ZodString;
+    providerDomainId: z.ZodString;
+    organizationId: z.ZodString;
+    organizationEmailDomainId: z.ZodString;
+    domain: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_OWNERSHIP_VERIFIED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_OrganizationEmailDomain_VerifiedEventDataSchema: z.ZodObject<{
+    status: z.ZodEnum<typeof OrganizationEmailDomainStatus>;
+    organizationId: z.ZodString;
+    organizationEmailDomainId: z.ZodString;
+    domain: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_VERIFIED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_OrganizationEmailDomain_SuspendedEventDataSchema: z.ZodObject<{
+    reason: z.ZodEnum<typeof OrganizationEmailDomainSuspensionReason>;
+    organizationId: z.ZodString;
+    organizationEmailDomainId: z.ZodString;
+    domain: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_SUSPENDED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_OrganizationEmailDomain_RemovedEventDataSchema: z.ZodObject<{
+    trigger: z.ZodEnum<typeof OrganizationEmailDomainRemovalTrigger>;
+    providerDomainDeleted: z.ZodBoolean;
+    organizationId: z.ZodString;
+    organizationEmailDomainId: z.ZodString;
+    domain: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_REMOVED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_ClientMailbox_CreatedEventDataSchema: z.ZodObject<{
+    organizationId: z.ZodString;
+    clientMailboxId: z.ZodString;
+    address: z.ZodString;
+    emailDomainId: z.ZodString;
+    serviceProviderRelationshipId: z.ZodString;
+    firmOrganizationId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.CLIENT_MAILBOX_CREATED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_ClientMailbox_RemovedEventDataSchema: z.ZodObject<{
+    organizationId: z.ZodString;
+    clientMailboxId: z.ZodString;
+    address: z.ZodString;
+    emailDomainId: z.ZodString;
+    serviceProviderRelationshipId: z.ZodString;
+    firmOrganizationId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.CLIENT_MAILBOX_REMOVED>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundEmail_AttachmentWithheldEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_EMAIL_ATTACHMENT_WITHHELD>;
+    organizationId: z.ZodString;
+    inboundEmailId: z.ZodString;
+    reason: z.ZodEnum<typeof InboundEmailWithheldReason>;
+    fileId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const AuditableEvent_InboundEmail_RejectedLimitEventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_EMAIL_REJECTED_LIMIT>;
+    organizationId: z.ZodString;
+    inboundEmailId: z.ZodString;
+    limit: z.ZodEnum<typeof InboundEmailLimit>;
+    sizeBytes: z.ZodNumber;
+    attachmentCount: z.ZodNumber;
+}, z.core.$strip>;
 export declare const AuditableEvent_SCIM_TokenCreatedEventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.SCIM_TOKEN_CREATED>;
     organizationId: z.ZodString;
@@ -2281,115 +2732,89 @@ export declare const AuditableEvent_ResourceOperationPerformed_EventDataSchema:
         after: z.ZodOptional<z.ZodUnknown>;
     }, z.core.$strip>>>;
 }, z.core.$strip>;
+/** A legal hold was placed (#1634). */
+export declare const AuditableEvent_LegalHoldPlaced_EventDataSchema: z.ZodObject<{
+    placedByUserId: z.ZodString;
+    holdId: z.ZodString;
+    heldOrganizationId: z.ZodString;
+    scopeKind: z.ZodEnum<typeof LegalHoldScopeKind>;
+    legalGround: z.ZodEnum<typeof LegalHoldGround>;
+    placementTier: z.ZodEnum<typeof LegalHoldPlacementTier>;
+    heldResourceType: z.ZodOptional<z.ZodString>;
+    heldRowCount: z.ZodOptional<z.ZodNumber>;
+    subjectUserId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.LEGAL_HOLD_PLACED>;
+}, z.core.$strip>;
 /**
- * An operation the authorizer REFUSED. The other half of "record access decisions" — the negative
- * decision, which until now left no trace anywhere in the framework.
- *
- * ## Emitted pre-dispatch, from the one funnel
- *
- * Every public entry point of `AuthorizationsBackendService` converges on the same two inner phase
- * runners — `authorizeInController` (HTTP controller, MCP, WebSocket, queue, field validation),
- * `authorizeInProgrammaticSurface` (a non-controller surface that faces an external caller), and
- * `authorizeInRepositoryAndService`, which has exactly one caller — `authorizeInController` itself.
- * So a single instrumentation point observes every refusal THE AUTHORIZER MAKES, with the operation
- * and execution context both in scope. No mutation has occurred when this row is written; nothing is
- * rolled back by it.
- *
- * **The scope of that claim, stated because an earlier revision overstated it.** It used to read
- * "the sole production entry point for every execution surface", which asserts something stronger
- * and false: that every execution surface passes the role gate. A programmatic operation entering at
- * the SERVICE tier (`ServicesRegistryHandlerBackendService.read` / `list` / …) reaches no authorizer
- * at all — deliberately, because that population includes the reads that ESTABLISH identity before a
- * role-bearing principal exists. So the absence of a row here means "the authorizer refused nothing",
- * never "nothing was read". See `AuthorizationsBackendService.authorizeInProgrammaticSurface` for the
- * layering decision and the door.
- *
- * ## What it is NOT
- *
- * - **Not an authentication failure.** `USER_LOGIN_FAILED` / `MACHINE_AUTH_FAILED` say "you are not
- *   who you claim to be". This says "you are, and you may not do this". Distinct types, distinct
- *   categories, neither overloaded.
- * - **Not an `outcome: 'denied'` variant of {@link AuditableEvent_ResourceOperationPerformed_EventDataSchema}.**
- *   That event is emitted from the post-commit lane, which by construction can only observe
- *   operations that already took effect. A refusal never reaches it.
- *
- * ## Volume: bounded by dedup, NOT by a risk floor
- *
- * Denial volume is attacker-drivable in a way the success path's never is. A risk floor was
- * considered and rejected as the control: it would exclude 100% of denied READS (zero of the
- * catalogue's HIGH/CRITICAL variants are reads, while 371 of 551 API-reachable variants are) —
- * discarding the canonical reconnaissance signal — while not capping the adversarial worst case at
- * all, since the attacker chooses which endpoint to hammer.
- *
- * The actual bound is a per-principal / per-operation / per-reason dedup window. Rather than
- * suppressing repeats outright (which would erase the storm — the very signal a security-operations team wants),
- * emission escalates on a LOGARITHMIC ladder: the 1st, 10th, 100th, … refusal in the window each
- * emit one row carrying {@link occurrenceCount}. A burst of 10 000 identical denials therefore
- * costs 5 rows and remains legible as a burst.
- *
- * Dedup is best-effort and FAILS OPEN (emit) when the counter store is unavailable — a fail-closed
- * cooldown would let an attacker blind the audit trail by taking Redis down.
- *
- * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
- */
-/**
- * A platform operator acted on a row belonging to a tenant they are not a member of.
- *
- * ## Why this event exists
- *
- * Wildo's answer to "may a platform super-administrator administer any tenant?" is YES — the same
- * answer most mature B2B platforms give, because support and incident response genuinely need it.
- * What those platforms do NOT do is leave the reach implicit. Support access is a named, logged
- * event, because the difference between legitimate operator work and quiet snooping is not the
- * capability — both use the identical capability — it is whether anyone can tell afterwards.
- *
- * Until 2026-08-05 Wildo had the capability with none of the visibility, and by accident rather than
- * declaration: per-instance org-scoped requests are checked by `authorizeOrganizations`, which
- * compares the fetched row's organization against a scope the SAME REQUEST supplied through its URL.
- * A non-member operator therefore passed it silently. Measured over real HTTP by
- * `organization-ownership-grant-hostile.e2e.ts` probe F-1a, which deleted a membership row in
- * another tenant and got a 200.
- *
- * This event is the visibility half, and it is NOT the refusal. The refusal shipped separately and
- * lives in `authorizeOrganizations`: an undeclared crossing is no longer admitted, and the caller is
- * answered as not-found so the response cannot be used as an existence oracle. Emission here stays
- * best-effort and never blocks the request: an operator action must not fail because the audit sink
- * is down, and a fail-closed variant would let anyone disable operator support by breaking the sink.
- * The observation is taken BEFORE the admission decision, on purpose, so a sanctioned crossing is
- * recorded too.
- *
- * ## Reading the event
- *
- * {@link admissionDeclared} is the field that matters most. `true` means the operation VARIANT
- * declared `admitsCrossTenantPlatformAdministration` — an intended, reviewed crossing such as
- * `organizationMembers.grantOwnership`, which additionally requires a usable platform access grant.
- * `false` now means an ATTEMPTED undeclared crossing, which was refused: still the population to
- * watch, because it is reach nobody declared and no specification describes.
- *
- * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — platform-tier access to a tenant the
- * principal does not belong to.
- * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
- */
-/**
- * One transition in the life of a platform access grant.
- *
- * The crossing itself is recorded by {@link CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS}.
- * This is the other half, and a reviewer needs both: that event answers "an operator reached into
- * this tenant", this one answers "on what authority, asked for when, and who agreed".
- *
- * Deliberately two events rather than one enriched one. A grant is requested once and may authorise
- * many crossings across its window, so folding them together would either duplicate the grant's
- * details onto every access or lose the request/decision timeline entirely.
- *
- * {@link autoApprovalReason} is the field a customer audit turns on. Its ABSENCE on an approved grant
- * means a human in the tenant said yes. `TENANT_APPROVAL_NOT_REQUIRED` means the tenant had not opted
- * into approval. `TENANT_CANNOT_APPROVE` means the tenant had no administratively usable owner and
- * could not consent — the one path where operator access proceeds against a tenant that never agreed
- * and never could, which is why the emitter carries it at a higher risk level.
- *
- * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION
- * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of a privileged assignment's full life.
+ * A model-cost period aggregate was linked to its invoice (#1598). Identifiers, the period and the currency
+ * only: no amount (the aggregate row holds it), no personal data.
  */
+export declare const AuditableEvent_ModelCostAggregateInvoiceLinked_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.MODEL_COST_AGGREGATE_INVOICE_LINKED>;
+    aggregateId: z.ZodString;
+    billedOrganizationId: z.ZodString;
+    periodStart: z.ZodString;
+    currency: z.ZodString;
+    organizationInvoiceRefId: z.ZodString;
+    linkedByUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** An organization's content-capture setting changed (#1599). The setting, never any content. */
+export declare const AuditableEvent_CorrectionCaptureSettingChanged_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.CORRECTION_CAPTURE_SETTING_CHANGED>;
+    settingOrganizationId: z.ZodString;
+    previousContentCapture: z.ZodOptional<z.ZodString>;
+    contentCapture: z.ZodString;
+    purposeStated: z.ZodBoolean;
+    contentReaderRole: z.ZodOptional<z.ZodString>;
+    narrowedToCaseCount: z.ZodNumber;
+    changedByUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** An organization's evaluation-export authorisation changed (#1599). The basis and counts, never case identities. */
+export declare const AuditableEvent_EvaluationExportAuthorizationChanged_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EVALUATION_EXPORT_AUTHORIZATION_CHANGED>;
+    authorizationOrganizationId: z.ZodString;
+    status: z.ZodString;
+    previousStatus: z.ZodOptional<z.ZodString>;
+    basis: z.ZodOptional<z.ZodString>;
+    clientConsentCount: z.ZodNumber;
+    excludedCaseCount: z.ZodNumber;
+    changedByUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** An evaluation dataset was exported (#1599). The ledger row names every record; the trail names the export. */
+export declare const AuditableEvent_EvaluationDatasetExported_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EVALUATION_DATASET_EXPORTED>;
+    exportId: z.ZodString;
+    exportOrganizationId: z.ZodString;
+    agentRef: z.ZodString;
+    basis: z.ZodString;
+    recordCount: z.ZodNumber;
+    windowFrom: z.ZodString;
+    windowTo: z.ZodString;
+    destination: z.ZodString;
+    exportedByUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** An evaluation-dataset export was refused (#1599 I7). */
+export declare const AuditableEvent_EvaluationDatasetExportRefused_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EVALUATION_DATASET_EXPORT_REFUSED>;
+    exportOrganizationId: z.ZodString;
+    agentRef: z.ZodString;
+    reason: z.ZodEnum<typeof EvaluationDatasetExportRefusalReason>;
+    attemptedByUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** A legal hold was released (#1634). */
+export declare const AuditableEvent_LegalHoldReleased_EventDataSchema: z.ZodObject<{
+    releasedByUserId: z.ZodString;
+    heldForSeconds: z.ZodNumber;
+    holdId: z.ZodString;
+    heldOrganizationId: z.ZodString;
+    scopeKind: z.ZodEnum<typeof LegalHoldScopeKind>;
+    legalGround: z.ZodEnum<typeof LegalHoldGround>;
+    placementTier: z.ZodEnum<typeof LegalHoldPlacementTier>;
+    heldResourceType: z.ZodOptional<z.ZodString>;
+    heldRowCount: z.ZodOptional<z.ZodNumber>;
+    subjectUserId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.LEGAL_HOLD_RELEASED>;
+}, z.core.$strip>;
 export declare const AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema: z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE>;
     transition: z.ZodEnum<typeof PlatformAccessGrantLifecycleTransition>;
@@ -2408,6 +2833,183 @@ export declare const AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema
         credentialId: z.ZodString;
     }, z.core.$strip>>;
 }, z.core.$strip>;
+/**
+ * One transition in the life of a service-provider relationship (#1597).
+ *
+ * Read it to answer "which firm could reach this tenant, under what scope, since when — and who decided".
+ * Written once to the CLIENT's trail and once to the FIRM's: the same facts, each organization reading
+ * them in its own tenant. `purpose` and `decisionReason` are free text people typed, so they are carried
+ * for the tenants' own trails and are NOT exported to a SIEM by default.
+ *
+ * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
+ * assurance-control: WILDO.PRIVACY.THIRD_PARTY_PROCESSING
+ */
+export declare const AuditableEvent_ServiceProviderRelationshipLifecycle_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_RELATIONSHIP_LIFECYCLE>;
+    transition: z.ZodEnum<typeof ServiceProviderRelationshipTransition>;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    resultingStatus: z.ZodEnum<typeof ServiceProviderRelationshipStatus>;
+    role: z.ZodString;
+    organizationUnitIds: z.ZodArray<z.ZodString>;
+    endsAt: z.ZodOptional<z.ZodDate>;
+    proposedByOrganizationId: z.ZodString;
+    actorUserId: z.ZodOptional<z.ZodString>;
+    actorOrganizationId: z.ZodOptional<z.ZodString>;
+    purpose: z.ZodOptional<z.ZodString>;
+    decisionReason: z.ZodOptional<z.ZodString>;
+    expertAdmissionPolicy: z.ZodOptional<z.ZodEnum<typeof ServiceProviderExpertAdmissionPolicy>>;
+}, z.core.$strip>;
+/** A firm machine client admitted into / removed from a client organization under a relationship (#1597, S3). */
+export declare const AuditableEvent_ServiceProviderMachineClientAdmissionChanged_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_MACHINE_CLIENT_ADMISSION_CHANGED>;
+    admitted: z.ZodBoolean;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    oauthClientId: z.ZodString;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** An expert assigned to a client relationship by their firm (#1597). */
+export declare const AuditableEvent_ServiceProviderExpertAssigned_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_ASSIGNED>;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** An expert's assignment to a client relationship ended by their firm (#1597). */
+export declare const AuditableEvent_ServiceProviderExpertUnassigned_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_UNASSIGNED>;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** A firm's assignment now waits for the client's approval (#1612). Actor: the firm administrator who assigned. */
+export declare const AuditableEvent_ServiceProviderExpertApprovalRequested_EventDataSchema: z.ZodObject<{
+    expertAdmissionPolicy: z.ZodEnum<typeof ServiceProviderExpertAdmissionPolicy>;
+    role: z.ZodString;
+    actorUserId: z.ZodOptional<z.ZodString>;
+    decisionRef: z.ZodString;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_REQUESTED>;
+}, z.core.$strip>;
+/** The client approved, and the expert was admitted (#1612). */
+export declare const AuditableEvent_ServiceProviderExpertApprovalGranted_EventDataSchema: z.ZodObject<{
+    role: z.ZodString;
+    decisionRef: z.ZodString;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_GRANTED>;
+}, z.core.$strip>;
+/** The expert was not admitted (#1612). */
+export declare const AuditableEvent_ServiceProviderExpertApprovalDenied_EventDataSchema: z.ZodObject<{
+    denialReason: z.ZodEnum<typeof ServiceProviderExpertApprovalDenialReason>;
+    decisionRef: z.ZodString;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_DENIED>;
+}, z.core.$strip>;
+/** Nobody answered in time (#1612). */
+export declare const AuditableEvent_ServiceProviderExpertApprovalLapsed_EventDataSchema: z.ZodObject<{
+    decisionRef: z.ZodString;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_LAPSED>;
+}, z.core.$strip>;
+/** A capability was lent (#1631). */
+export declare const AuditableEvent_ServiceProviderCapabilityGranted_EventDataSchema: z.ZodObject<{
+    grantId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    capability: z.ZodEnum<typeof DelegatedAdministrativeCapability>;
+    securityCritical: z.ZodBoolean;
+    endsAt: z.ZodDate;
+    actorUserId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_GRANTED>;
+}, z.core.$strip>;
+/** A lent capability was revoked (#1631). */
+export declare const AuditableEvent_ServiceProviderCapabilityRevoked_EventDataSchema: z.ZodObject<{
+    byRelationshipEnd: z.ZodBoolean;
+    endCause: z.ZodOptional<z.ZodEnum<typeof ServiceProviderCapabilityGrantEndCause>>;
+    endedCredentials: z.ZodOptional<z.ZodNumber>;
+    grantId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    capability: z.ZodEnum<typeof DelegatedAdministrativeCapability>;
+    securityCritical: z.ZodBoolean;
+    endsAt: z.ZodDate;
+    actorUserId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_REVOKED>;
+}, z.core.$strip>;
+/** A client's decision about trusting a firm's identity provider's MFA on one relationship (#1633). */
+export declare const AuditableEvent_ServiceProviderMfaTrustChanged_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_MFA_TRUST_CHANGED>;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    previousProviderMfaTrust: z.ZodEnum<typeof ServiceProviderMfaTrust>;
+    providerMfaTrust: z.ZodEnum<typeof ServiceProviderMfaTrust>;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * A factor recorded on an expert's session for one client organization (#1633).
+ *
+ * Names the factor and its SOURCE, never the proof itself. `identityProviderOrganizationId` is present exactly when
+ * the source is the firm's trusted identity provider.
+ *
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the resource tenant's authentication policy is enforced on external experts, per request.
+ */
+export declare const AuditableEvent_ServiceProviderClientAuthenticationSatisfied_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_CLIENT_AUTHENTICATION_SATISFIED>;
+    organizationId: z.ZodString;
+    relationshipId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    factor: z.ZodEnum<typeof AuthMethod>;
+    source: z.ZodEnum<typeof FactorSatisfactionSource>;
+    identityProviderOrganizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** A firm's decision about collecting activity metadata on its own experts' client work (#1632). */
+export declare const AuditableEvent_ServiceProviderActivityFeedDecided_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DECIDED>;
+    providerOrganizationId: z.ZodString;
+    previousStatus: z.ZodEnum<typeof ServiceProviderActivityFeedStatus>;
+    status: z.ZodEnum<typeof ServiceProviderActivityFeedStatus>;
+    acknowledgedWorkerConsultationNotice: z.ZodBoolean;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** A client's decision about how much a firm's activity feed may say about work in it (#1632). */
+export declare const AuditableEvent_ServiceProviderActivityFeedDisclosureChanged_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DISCLOSURE_CHANGED>;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    previousActivityFeedDisclosure: z.ZodEnum<typeof ServiceProviderActivityFeedDisclosure>;
+    activityFeedDisclosure: z.ZodEnum<typeof ServiceProviderActivityFeedDisclosure>;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 /**
  * One transition in the life of a system-of-record partition assignment.
  *
@@ -2591,6 +3193,8 @@ export declare const AuditableEvent_SubjectDataExport_EventDataSchema: z.ZodObje
     fieldsExcludedAsDerived: z.ZodArray<z.ZodString>;
     fieldsWithheldAsNonDisclosable: z.ZodArray<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
+    recipientsStatus: z.ZodEnum<typeof SubjectDataRecipientsStatementStatus>;
+    recipientRefs: z.ZodArray<z.ZodString>;
 }, z.core.$strip>;
 /**
  * A COLLECTION EXPORT — an operator rendered a resource listing to a file and downloaded it.
@@ -2664,6 +3268,48 @@ export declare const AuditableEvent_ProviderOperationCall_EventDataSchema: z.Zod
     initiatorUserId: z.ZodOptional<z.ZodString>;
     executionType: z.ZodOptional<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
+    augmentationPackage: z.ZodOptional<z.ZodString>;
+    augmentationPackageVersion: z.ZodOptional<z.ZodString>;
+    connectionRef: z.ZodOptional<z.ZodString>;
+    providerPackageName: z.ZodOptional<z.ZodString>;
+    tokenAudience: z.ZodOptional<z.ZodString>;
+    rateBudget: z.ZodOptional<z.ZodObject<{
+        budgetKeys: z.ZodArray<z.ZodString>;
+        counting: z.ZodEnum<typeof RateBudgetCounting>;
+        waitedMs: z.ZodNumber;
+        exhaustedBudgetKey: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * The backend CALLED a vendor to discharge an engine capability (#1712) — see the enum member for why this is
+ * neither a catalogue operation call nor a record about the data's subject.
+ *
+ * One event per PHYSICAL call the egress controls, on the success and the failure path. The granularity is the
+ * egress's own act: one email submission, one SMS, one storage verb, one billing adapter call. A billing adapter
+ * call that pages through a list may make several HTTP requests to the vendor under one row, as an agent turn does
+ * under one `providerCallRecords` row; the count is of the application's acts, not of the vendor's requests.
+ *
+ * No field names a subject — no recipient, number, file, customer or payload — so the schema, not a redaction
+ * step, is what keeps it out of the personal-data population.
+ *
+ * assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — records which vendor each capability reached,
+ * with what outcome, for every call the application made.
+ */
+export declare const AuditableEvent_ProviderCapabilityCall_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.PROVIDER_CAPABILITY_CALL>;
+    capability: z.ZodEnum<typeof ProviderCapabilityEgress>;
+    action: z.ZodEnum<typeof ProviderCapabilityCallAction>;
+    providerRef: z.ZodString;
+    engineCapability: z.ZodOptional<z.ZodString>;
+    billingOperation: z.ZodOptional<z.ZodString>;
+    outcome: z.ZodEnum<typeof ProviderCapabilityCallOutcome>;
+    status: z.ZodOptional<z.ZodNumber>;
+    failureKind: z.ZodOptional<z.ZodString>;
+    connectionOwnerScope: z.ZodString;
+    connectionOwnerId: z.ZodOptional<z.ZodString>;
+    initiatorUserId: z.ZodOptional<z.ZodString>;
+    executionType: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /**
  * The browser door REFUSED a provider operation (#367) — see the enum member for why this is not a
@@ -2722,35 +3368,249 @@ export declare const AuditableEvent_McpToolCall_EventDataSchema: z.ZodObject<{
     agentRef: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type AuditableEvent_McpToolCall_EventData = z.infer<typeof AuditableEvent_McpToolCall_EventDataSchema>;
+export type AuditableEvent_ProviderCapabilityCall_EventData = z.infer<typeof AuditableEvent_ProviderCapabilityCall_EventDataSchema>;
+/** A decision was raised. */
+export declare const AuditableEvent_HumanDecisionRequested_EventDataSchema: z.ZodObject<{
+    requesterKind: z.ZodEnum<typeof HumanDecision_RequesterKind>;
+    assigneeUserId: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+    claimDeadlineAt: z.ZodOptional<z.ZodString>;
+    claimClockBasis: z.ZodOptional<z.ZodEnum<typeof ReviewClockBasis>>;
+    decisionDeadlineAt: z.ZodOptional<z.ZodString>;
+    decisionClockBasis: z.ZodOptional<z.ZodEnum<typeof ReviewClockBasis>>;
+    decisionRef: z.ZodString;
+    executionId: z.ZodString;
+    plane: z.ZodEnum<typeof HumanDecision_Plane>;
+    systemRef: z.ZodOptional<z.ZodString>;
+    agentRef: z.ZodOptional<z.ZodString>;
+    toolName: z.ZodOptional<z.ZodString>;
+    routeKind: z.ZodEnum<typeof HumanDecision_RouteKind>;
+    routeEligibleRole: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.HUMAN_DECISION_REQUESTED>;
+}, z.core.$strip>;
+export type AuditableEvent_HumanDecisionRequested_EventData = z.infer<typeof AuditableEvent_HumanDecisionRequested_EventDataSchema>;
+/** A decision ended. Exactly one per `decisionRef`. */
+export declare const AuditableEvent_HumanDecisionResolved_EventDataSchema: z.ZodObject<{
+    outcome: z.ZodEnum<typeof HumanDecision_Outcome>;
+    decidedByUserId: z.ZodOptional<z.ZodString>;
+    deciderRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    admittedByRouteRole: z.ZodOptional<z.ZodString>;
+    modifiedArgumentNames: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    reasonGiven: z.ZodBoolean;
+    lateDecisionUserId: z.ZodOptional<z.ZodString>;
+    deadlineOutcomes: z.ZodOptional<z.ZodRecord<z.ZodEnum<typeof ReviewDeadlineKind> & z.core.$partial, z.ZodEnum<typeof ReviewDeadlineOutcome>>>;
+    decisionRef: z.ZodString;
+    executionId: z.ZodString;
+    plane: z.ZodEnum<typeof HumanDecision_Plane>;
+    systemRef: z.ZodOptional<z.ZodString>;
+    agentRef: z.ZodOptional<z.ZodString>;
+    toolName: z.ZodOptional<z.ZodString>;
+    routeKind: z.ZodEnum<typeof HumanDecision_RouteKind>;
+    routeEligibleRole: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.HUMAN_DECISION_RESOLVED>;
+}, z.core.$strip>;
+export type AuditableEvent_HumanDecisionResolved_EventData = z.infer<typeof AuditableEvent_HumanDecisionResolved_EventDataSchema>;
+export declare const AuditableEvent_HumanDecisionReassigned_EventDataSchema: z.ZodObject<{
+    trigger: z.ZodEnum<typeof HumanDecision_RouteChangeTrigger>;
+    stage: z.ZodOptional<z.ZodEnum<typeof ReviewDeadlineStage>>;
+    fromAssigneeUserId: z.ZodOptional<z.ZodString>;
+    toAssigneeUserId: z.ZodString;
+    routeVersion: z.ZodNumber;
+    reasonGiven: z.ZodBoolean;
+    decisionRef: z.ZodString;
+    executionId: z.ZodString;
+    plane: z.ZodEnum<typeof HumanDecision_Plane>;
+    systemRef: z.ZodOptional<z.ZodString>;
+    agentRef: z.ZodOptional<z.ZodString>;
+    toolName: z.ZodOptional<z.ZodString>;
+    routeKind: z.ZodEnum<typeof HumanDecision_RouteKind>;
+    routeEligibleRole: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.HUMAN_DECISION_REASSIGNED>;
+}, z.core.$strip>;
+export type AuditableEvent_HumanDecisionReassigned_EventData = z.infer<typeof AuditableEvent_HumanDecisionReassigned_EventDataSchema>;
+export declare const AuditableEvent_HumanDecisionEscalated_EventDataSchema: z.ZodObject<{
+    toDeclaredTarget: z.ZodBoolean;
+    fromAssigneeUserId: z.ZodOptional<z.ZodString>;
+    toAssigneeUserId: z.ZodString;
+    routeVersion: z.ZodNumber;
+    reasonGiven: z.ZodBoolean;
+    decisionRef: z.ZodString;
+    executionId: z.ZodString;
+    plane: z.ZodEnum<typeof HumanDecision_Plane>;
+    systemRef: z.ZodOptional<z.ZodString>;
+    agentRef: z.ZodOptional<z.ZodString>;
+    toolName: z.ZodOptional<z.ZodString>;
+    routeKind: z.ZodEnum<typeof HumanDecision_RouteKind>;
+    routeEligibleRole: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.HUMAN_DECISION_ESCALATED>;
+}, z.core.$strip>;
+export type AuditableEvent_HumanDecisionEscalated_EventData = z.infer<typeof AuditableEvent_HumanDecisionEscalated_EventDataSchema>;
+/** A role-routed decision was claimed (`claimed: true`) or given back to its role (`claimed: false`). */
+export declare const AuditableEvent_HumanDecisionClaimed_EventDataSchema: z.ZodObject<{
+    claimed: z.ZodBoolean;
+    assigneeUserId: z.ZodString;
+    routeVersion: z.ZodNumber;
+    decisionRef: z.ZodString;
+    executionId: z.ZodString;
+    plane: z.ZodEnum<typeof HumanDecision_Plane>;
+    systemRef: z.ZodOptional<z.ZodString>;
+    agentRef: z.ZodOptional<z.ZodString>;
+    toolName: z.ZodOptional<z.ZodString>;
+    routeKind: z.ZodEnum<typeof HumanDecision_RouteKind>;
+    routeEligibleRole: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.HUMAN_DECISION_CLAIMED>;
+}, z.core.$strip>;
+export type AuditableEvent_HumanDecisionClaimed_EventData = z.infer<typeof AuditableEvent_HumanDecisionClaimed_EventDataSchema>;
+/** Someone tried to act on a decision and was refused. The decision is unchanged. */
+export declare const AuditableEvent_HumanDecisionAnswerRefused_EventDataSchema: z.ZodObject<{
+    act: z.ZodEnum<typeof HumanDecision_Act>;
+    reason: z.ZodEnum<typeof HumanDecision_RefusalReason>;
+    attemptedByUserId: z.ZodOptional<z.ZodString>;
+    decisionRef: z.ZodString;
+    executionId: z.ZodString;
+    plane: z.ZodEnum<typeof HumanDecision_Plane>;
+    systemRef: z.ZodOptional<z.ZodString>;
+    agentRef: z.ZodOptional<z.ZodString>;
+    toolName: z.ZodOptional<z.ZodString>;
+    routeKind: z.ZodEnum<typeof HumanDecision_RouteKind>;
+    routeEligibleRole: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.HUMAN_DECISION_ANSWER_REFUSED>;
+}, z.core.$strip>;
+export type AuditableEvent_HumanDecisionAnswerRefused_EventData = z.infer<typeof AuditableEvent_HumanDecisionAnswerRefused_EventDataSchema>;
+/** A CLAIM or DECISION deadline passed (#1628). The decision is unchanged and still answerable. */
+export declare const AuditableEvent_HumanDecisionDeadlineMissed_EventDataSchema: z.ZodObject<{
+    kind: z.ZodEnum<typeof ReviewDeadlineKind>;
+    deadlineAt: z.ZodString;
+    basis: z.ZodEnum<typeof ReviewClockBasis>;
+    decisionRef: z.ZodString;
+    executionId: z.ZodString;
+    plane: z.ZodEnum<typeof HumanDecision_Plane>;
+    systemRef: z.ZodOptional<z.ZodString>;
+    agentRef: z.ZodOptional<z.ZodString>;
+    toolName: z.ZodOptional<z.ZodString>;
+    routeKind: z.ZodEnum<typeof HumanDecision_RouteKind>;
+    routeEligibleRole: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.HUMAN_DECISION_DEADLINE_MISSED>;
+}, z.core.$strip>;
+export type AuditableEvent_HumanDecisionDeadlineMissed_EventData = z.infer<typeof AuditableEvent_HumanDecisionDeadlineMissed_EventDataSchema>;
 /**
- * A human approver AUTHORED the arguments an approval-gated tool ran with (#566).
- *
- * One row per MODIFIED approval — never per approval. See the enum member's docstring for why an
- * ordinary approval is not this event, and for why no argument VALUE appears in this schema.
- *
- * `proposedInputDigest` / `executedInputDigest` are the model SDK's own canonical input digests, the
- * same values its approval signature is computed over. That is what makes them evidence rather than
- * a convenience: a reader holding the executed call can recompute the second and see it match, and
- * the two differing is proof that the call which ran is not the call which was proposed — with no
- * copy of either payload on the trail.
- *
- * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — records that an authorization
- * decision REWROTE the act it authorized, and who made it.
+ * A deadline stage's rule fired (#1628). Ids and counts only: who was told is the route's candidates at
+ * that moment, recorded as a count so the row holds no list of people that would need scrubbing.
  */
-export declare const AuditableEvent_AgentToolApprovalModified_EventDataSchema: z.ZodObject<{
-    eventType: z.ZodLiteral<CoreAuditableEventType.AGENT_TOOL_APPROVAL_MODIFIED>;
+export declare const AuditableEvent_HumanDecisionEscalationFired_EventDataSchema: z.ZodObject<{
+    stage: z.ZodEnum<typeof ReviewDeadlineStage>;
+    action: z.ZodEnum<typeof ReviewEscalationActionKind>;
+    reassignAttempted: z.ZodBoolean;
+    targetResolved: z.ZodOptional<z.ZodBoolean>;
+    targetRefusalReason: z.ZodOptional<z.ZodEnum<typeof HumanDecision_RefusalReason>>;
+    fromAssigneeUserId: z.ZodOptional<z.ZodString>;
+    toAssigneeUserId: z.ZodOptional<z.ZodString>;
+    routeVersion: z.ZodOptional<z.ZodNumber>;
+    recipientCount: z.ZodNumber;
+    decisionRef: z.ZodString;
     executionId: z.ZodString;
-    approvalId: z.ZodString;
-    systemRef: z.ZodString;
-    agentRef: z.ZodString;
-    toolName: z.ZodString;
-    proposedInputDigest: z.ZodString;
-    executedInputDigest: z.ZodString;
-    modifiedArgumentKeys: z.ZodArray<z.ZodString>;
-    approverUserId: z.ZodOptional<z.ZodString>;
+    plane: z.ZodEnum<typeof HumanDecision_Plane>;
+    systemRef: z.ZodOptional<z.ZodString>;
+    agentRef: z.ZodOptional<z.ZodString>;
+    toolName: z.ZodOptional<z.ZodString>;
+    routeKind: z.ZodEnum<typeof HumanDecision_RouteKind>;
+    routeEligibleRole: z.ZodOptional<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.HUMAN_DECISION_ESCALATION_FIRED>;
 }, z.core.$strip>;
-export type AuditableEvent_AgentToolApprovalModified_EventData = z.infer<typeof AuditableEvent_AgentToolApprovalModified_EventDataSchema>;
+export type AuditableEvent_HumanDecisionEscalationFired_EventData = z.infer<typeof AuditableEvent_HumanDecisionEscalationFired_EventDataSchema>;
+/** A person stopped a decision's CLAIM and DECISION clocks (#1628). The lapse keeps running. */
+export declare const AuditableEvent_HumanDecisionClockPaused_EventDataSchema: z.ZodObject<{
+    pauseStateRef: z.ZodString;
+    pausedByUserId: z.ZodString;
+    decisionRef: z.ZodString;
+    executionId: z.ZodString;
+    plane: z.ZodEnum<typeof HumanDecision_Plane>;
+    systemRef: z.ZodOptional<z.ZodString>;
+    agentRef: z.ZodOptional<z.ZodString>;
+    toolName: z.ZodOptional<z.ZodString>;
+    routeKind: z.ZodEnum<typeof HumanDecision_RouteKind>;
+    routeEligibleRole: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.HUMAN_DECISION_CLOCK_PAUSED>;
+}, z.core.$strip>;
+export type AuditableEvent_HumanDecisionClockPaused_EventData = z.infer<typeof AuditableEvent_HumanDecisionClockPaused_EventDataSchema>;
+/** A person restarted a decision's clocks (#1628); `pausedMs` was added to both service targets. */
+export declare const AuditableEvent_HumanDecisionClockResumed_EventDataSchema: z.ZodObject<{
+    pauseStateRef: z.ZodString;
+    resumedByUserId: z.ZodString;
+    pausedMs: z.ZodNumber;
+    decisionRef: z.ZodString;
+    executionId: z.ZodString;
+    plane: z.ZodEnum<typeof HumanDecision_Plane>;
+    systemRef: z.ZodOptional<z.ZodString>;
+    agentRef: z.ZodOptional<z.ZodString>;
+    toolName: z.ZodOptional<z.ZodString>;
+    routeKind: z.ZodEnum<typeof HumanDecision_RouteKind>;
+    routeEligibleRole: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.HUMAN_DECISION_CLOCK_RESUMED>;
+}, z.core.$strip>;
+export type AuditableEvent_HumanDecisionClockResumed_EventData = z.infer<typeof AuditableEvent_HumanDecisionClockResumed_EventDataSchema>;
+export declare const AuditableEvent_AutonomousAgent_BoundEventDataSchema: z.ZodObject<{
+    autonomousAgentRef: z.ZodString;
+    organizationId: z.ZodString;
+    oauthClientId: z.ZodString;
+    principalSource: z.ZodEnum<typeof AutonomousPrincipalSource>;
+    providerOrganizationId: z.ZodOptional<z.ZodString>;
+    serviceProviderRelationshipId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.AUTONOMOUS_AGENT_BOUND>;
+}, z.core.$strip>;
+export type AuditableEvent_AutonomousAgent_BoundEventData = z.infer<typeof AuditableEvent_AutonomousAgent_BoundEventDataSchema>;
+export declare const AuditableEvent_AutonomousAgent_UnboundEventDataSchema: z.ZodObject<{
+    autonomousAgentRef: z.ZodString;
+    organizationId: z.ZodString;
+    oauthClientId: z.ZodString;
+    principalSource: z.ZodEnum<typeof AutonomousPrincipalSource>;
+    providerOrganizationId: z.ZodOptional<z.ZodString>;
+    serviceProviderRelationshipId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.AUTONOMOUS_AGENT_UNBOUND>;
+}, z.core.$strip>;
+export type AuditableEvent_AutonomousAgent_UnboundEventData = z.infer<typeof AuditableEvent_AutonomousAgent_UnboundEventDataSchema>;
+export declare const AuditableEvent_AutonomousAgent_TurnStartedEventDataSchema: z.ZodObject<{
+    executionId: z.ZodString;
+    systemRef: z.ZodString;
+    oauthClientId: z.ZodString;
+    principalSource: z.ZodEnum<typeof AutonomousPrincipalSource>;
+    autonomousAgentRef: z.ZodString;
+    organizationId: z.ZodString;
+    occurrenceKey: z.ZodString;
+    trigger: z.ZodEnum<typeof AutonomousTurnTrigger>;
+    caseRef: z.ZodOptional<z.ZodObject<{
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+    }, z.core.$strict>>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_STARTED>;
+}, z.core.$strip>;
+export type AuditableEvent_AutonomousAgent_TurnStartedEventData = z.infer<typeof AuditableEvent_AutonomousAgent_TurnStartedEventDataSchema>;
+export declare const AuditableEvent_AutonomousAgent_TurnRefusedEventDataSchema: z.ZodObject<{
+    reason: z.ZodEnum<typeof AutonomousTurnRefusalReason>;
+    budgetDenialReason: z.ZodOptional<z.ZodString>;
+    runtimeErrorCode: z.ZodOptional<z.ZodString>;
+    oauthClientId: z.ZodOptional<z.ZodString>;
+    autonomousAgentRef: z.ZodString;
+    organizationId: z.ZodString;
+    occurrenceKey: z.ZodString;
+    trigger: z.ZodEnum<typeof AutonomousTurnTrigger>;
+    caseRef: z.ZodOptional<z.ZodObject<{
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+    }, z.core.$strict>>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_REFUSED>;
+}, z.core.$strip>;
+export type AuditableEvent_AutonomousAgent_TurnRefusedEventData = z.infer<typeof AuditableEvent_AutonomousAgent_TurnRefusedEventDataSchema>;
 /**
  * Rows were read THROUGH an HTTP-API resource binding — the read-through trail for data living in
  * an EXTERNAL system the platform does not own (ETL plan D8/R6; see the enum member's docstring
@@ -2773,7 +3633,7 @@ export declare const AuditableEvent_HttpApiReadThroughAccess_EventDataSchema: z.
     eventType: z.ZodLiteral<CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS>;
     resourceType: z.ZodString;
     operationIdentifier: z.ZodString;
-    providerRef: z.ZodString;
+    systemOfRecord: z.ZodString;
     remoteEntityRef: z.ZodString;
     dialect: z.ZodString;
     initiatorUserId: z.ZodOptional<z.ZodString>;
@@ -2781,6 +3641,11 @@ export declare const AuditableEvent_HttpApiReadThroughAccess_EventDataSchema: z.
     organizationId: z.ZodOptional<z.ZodString>;
     resourceId: z.ZodOptional<z.ZodString>;
     rowCount: z.ZodOptional<z.ZodNumber>;
+    rejectedRows: z.ZodOptional<z.ZodNumber>;
+    completedPass: z.ZodOptional<z.ZodBoolean>;
+    pipelinePassMode: z.ZodOptional<z.ZodEnum<typeof ExternalDataPipelinePassMode>>;
+    suppressedRows: z.ZodOptional<z.ZodNumber>;
+    liveSuppressedRows: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 /**
  * A subject erasure invoked the DECLARED external-erasure operation of an HTTP_API binding
@@ -2801,12 +3666,203 @@ export declare const AuditableEvent_HttpApiExternalErasure_EventDataSchema: z.Zo
     subjectResourceType: z.ZodString;
     subjectIds: z.ZodArray<z.ZodString>;
     resourceType: z.ZodString;
-    providerRef: z.ZodString;
+    systemOfRecord: z.ZodString;
     remoteEntityRef: z.ZodString;
     dialect: z.ZodString;
     deletedRowCount: z.ZodNumber;
     organizationId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/**
+ * What became of ONE write sent (or about to be sent) through an HTTP-API binding (#1679).
+ *
+ * Distinct members because each one sends a reviewer somewhere different, and two of them are the
+ * answers a client must not read as "not written".
+ */
+export declare enum HttpApiWriteThroughOutcome {
+    /** The system of record applied the write. */
+    APPLIED = "applied",
+    /**
+     * The ENGINE refused before anything was sent — a non-owner organization, a partition outside the
+     * caller's grant, an engine-owned field in the payload. Nothing reached the remote.
+     */
+    REFUSED = "refused",
+    /** The request was sent and the system of record refused it with a definite answer; nothing was applied. */
+    REMOTE_REFUSED = "remote_refused",
+    /**
+     * The request was sent and nobody knows whether it was applied — a timeout, a connection dropped after
+     * the request left, a gateway answering for the vendor. A retry under the same Idempotency-Key answers
+     * this again rather than sending a second write.
+     */
+    OUTCOME_UNKNOWN = "outcome_unknown",
+    /**
+     * A retry under an Idempotency-Key whose first attempt was APPLIED. Nothing was sent: the outcome was
+     * replayed from the first attempt's record. Recorded so the second RESOURCE_OPERATION_PERFORMED row such a
+     * retry produces is visibly one that changed nothing remote.
+     */
+    REPLAYED = "replayed"
+}
+/**
+ * A row was written THROUGH an HTTP-API resource binding, or a write was refused (#1679) — see the enum
+ * member's docstring for the vocabulary argument and the relation to RESOURCE_OPERATION_PERFORMED.
+ *
+ * MINIMISATION is the shape of this schema: it names the FIELDS written and never their values. The
+ * values live in the system of record; a copy here would be a second store of that system's content, one
+ * the application's erasure never reaches. `writtenFieldNames` are the LOCAL names the caller sent,
+ * because those are the names a reviewer of this application reads.
+ *
+ * assurance-control: WILDO.AUDIT.ATTRIBUTION — every write sent into an external system through the shared
+ * service identity is recorded with the real initiating user, the row it reached and the fields it changed.
+ */
+export declare const AuditableEvent_HttpApiWriteThrough_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.HTTP_API_WRITE_THROUGH>;
+    resourceType: z.ZodString;
+    operationIdentifier: z.ZodString;
+    systemOfRecord: z.ZodString;
+    remoteEntityRef: z.ZodString;
+    dialect: z.ZodString;
+    outcome: z.ZodEnum<typeof HttpApiWriteThroughOutcome>;
+    resourceId: z.ZodOptional<z.ZodString>;
+    writtenFieldNames: z.ZodArray<z.ZodString>;
+    refusalCode: z.ZodOptional<z.ZodString>;
+    initiatorUserId: z.ZodOptional<z.ZodString>;
+    executionType: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    organizationUnitId: z.ZodOptional<z.ZodString>;
+    localResourceId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * What became of ONE declared system-of-record action that was sent, or replayed (#1678). Refusals before sending are a
+ * separate event type ({@link CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_REFUSED}).
+ */
+export declare enum SystemOfRecordActionOutcome {
+    /** The system of record performed the action. */
+    APPLIED = "applied",
+    /** The action was sent and the system of record refused it with a definite answer; nothing was applied. */
+    REMOTE_REFUSED = "remote_refused",
+    /**
+     * The action was sent and nobody knows whether it was performed — a timeout, a connection dropped after the request
+     * left, a gateway answering for the vendor, or an answer the engine could not read after the vendor answered success.
+     * A retry under the same Idempotency-Key answers this again rather than acting twice.
+     */
+    OUTCOME_UNKNOWN = "outcome_unknown",
+    /** A retry under an Idempotency-Key whose first attempt was APPLIED. Nothing was sent. */
+    REPLAYED = "replayed"
+}
+/**
+ * A declared system-of-record action was run (#1678) — see the enum member for the vocabulary argument.
+ *
+ * MINIMISATION is the shape: the input's field NAMES, never their values, and no result. The values live in the system
+ * of record; a copy here would be a second store of that system's content, one no erasure reaches.
+ *
+ * assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — every physical action call to a system of record is
+ * recorded with the instance, the action, the remote entity and its outcome.
+ * assurance-control: WILDO.AUDIT.ATTRIBUTION — the real initiating actor is recorded through the shared service identity.
+ */
+export declare const AuditableEvent_SystemOfRecordActionExecuted_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_EXECUTED>;
+    systemOfRecord: z.ZodString;
+    action: z.ZodString;
+    resourceType: z.ZodString;
+    remoteEntityRef: z.ZodString;
+    callShape: z.ZodString;
+    outcome: z.ZodEnum<typeof SystemOfRecordActionOutcome>;
+    writes: z.ZodBoolean;
+    targetResourceId: z.ZodOptional<z.ZodString>;
+    inputFieldNames: z.ZodArray<z.ZodString>;
+    failureCode: z.ZodOptional<z.ZodString>;
+    initiatorUserId: z.ZodOptional<z.ZodString>;
+    executionType: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    organizationUnitId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * A declared system-of-record action was REFUSED before anything was sent (#1678).
+ *
+ * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — every refusal of an action on a system of record is
+ * recorded with the caller, the instance, the action and the rule that refused it.
+ */
+export declare const AuditableEvent_SystemOfRecordActionRefused_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_REFUSED>;
+    systemOfRecord: z.ZodString;
+    action: z.ZodString;
+    resourceType: z.ZodOptional<z.ZodString>;
+    targetResourceId: z.ZodOptional<z.ZodString>;
+    refusalCode: z.ZodString;
+    refusalReason: z.ZodOptional<z.ZodString>;
+    initiatorUserId: z.ZodOptional<z.ZodString>;
+    executionType: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * An operator reset a pipeline (#1734) — see {@link CoreAuditableEventType.EXTERNAL_DATA_PIPELINE_RESET}.
+ *
+ * The DISCARDED state is the point of the row: the pass id, cursor and watermark are remote POSITIONS (an id, a
+ * continuation link, a timestamp), never record content, and they are what lets a reviewer say which part of a sync
+ * the reset threw away. The door is authenticated by the application admin secret, which names no person, so the
+ * row's `userId` is empty; `statedOperator` is who the operator SAID they are, recorded as a statement, and `reason`
+ * is their own words — which is why the event exports at SUBJECT_DETAIL.
+ *
+ * assurance-control: WILDO.AUDIT.SECURITY_EVENT — an operator's reset of a pipeline is recorded with what it discarded
+ * and why.
+ */
+export declare const AuditableEvent_ExternalDataPipelineReset_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EXTERNAL_DATA_PIPELINE_RESET>;
+    pipelineResourceType: z.ZodString;
+    systemOfRecord: z.ZodString;
+    resetMode: z.ZodEnum<typeof ExternalDataPipelineResetMode>;
+    reason: z.ZodString;
+    statedOperator: z.ZodOptional<z.ZodString>;
+    stateFound: z.ZodBoolean;
+    discardedPassId: z.ZodNullable<z.ZodString>;
+    discardedCursor: z.ZodNullable<z.ZodString>;
+    discardedPassStartedAt: z.ZodNullable<z.ZodString>;
+    discardedIncrementalWatermark: z.ZodNullable<z.ZodString>;
+    discardedIncrementalCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * An operator answered an outbound write of unknown outcome (#2039) — see
+ * {@link CoreAuditableEventType.EXTERNAL_DATA_OUTBOUND_UNKNOWN_RESOLVED}.
+ *
+ * Like the reset, the door is authenticated by the application admin secret, which names no person: the row's `userId`
+ * is empty, `statedOperator` is who the operator SAID they are, and `reason` is their own words (SUBJECT_DETAIL on
+ * export). `remoteKey` is the remote record's identity the operator supplied, never record content.
+ *
+ * assurance-control: WILDO.AUDIT.SECURITY_EVENT — an operator's answer about another system's state is recorded with
+ * what it changed locally and why.
+ */
+export declare const AuditableEvent_ExternalDataOutboundUnknownResolved_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EXTERNAL_DATA_OUTBOUND_UNKNOWN_RESOLVED>;
+    pipelineResourceType: z.ZodString;
+    systemOfRecord: z.ZodString;
+    localResourceId: z.ZodString;
+    operationIdentifier: z.ZodString;
+    answer: z.ZodEnum<typeof ExternalDataOutboundUnknownAnswer>;
+    remoteKey: z.ZodNullable<z.ZodString>;
+    remoteKeyWritten: z.ZodBoolean;
+    changeStillOwed: z.ZodBoolean;
+    reason: z.ZodString;
+    statedOperator: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * A BIDIRECTIONAL pipeline resolved a conflict on one row (#1723) — see
+ * {@link CoreAuditableEventType.EXTERNAL_DATA_CONFLICT_RESOLVED}. Identities and field NAMES only, never a field's
+ * value: the row says which side's change to which fields was discarded, and the values are in the two systems.
+ *
+ * assurance-control: WILDO.AUDIT.SECURITY_EVENT — a resolution that overwrites one side's data is recorded with the row,
+ * the fields, the winning side and who chose it.
+ */
+export declare const AuditableEvent_ExternalDataConflictResolved_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EXTERNAL_DATA_CONFLICT_RESOLVED>;
+    pipelineResourceType: z.ZodString;
+    systemOfRecord: z.ZodString;
+    localResourceId: z.ZodString;
+    remoteKey: z.ZodString;
+    winner: z.ZodEnum<typeof ExternalDataConflictWinner>;
+    decidedBy: z.ZodEnum<typeof ExternalDataConflictDecisionSource>;
+    overwrittenFieldNames: z.ZodArray<z.ZodString>;
+    remoteVersion: z.ZodNullable<z.ZodString>;
+    agreedVersion: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
 /**
  * A subject erasure COMPLETED while rows linked to the subject remain live in an HTTP_API-bound
  * external system, on the controller's explicit per-request acknowledgement (ETL D6 stance 6c).
@@ -2827,12 +3883,37 @@ export declare const AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchem
     subjectResourceType: z.ZodString;
     subjectIds: z.ZodArray<z.ZodString>;
     resourceType: z.ZodString;
-    providerRef: z.ZodString;
+    systemOfRecord: z.ZodString;
     remoteEntityRef: z.ZodString;
     dialect: z.ZodString;
     remainingRowCount: z.ZodOptional<z.ZodNumber>;
     organizationId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/**
+ * A subject erasure's outcome at one RECIPIENT of the subject's data (#1710) — see
+ * {@link CoreAuditableEventType.SUBJECT_ERASURE_RECIPIENT_OUTCOME}.
+ *
+ * Art. 19 asks the controller to communicate an erasure "to each recipient to whom the personal data have been
+ * disclosed" and to tell the data subject who they are on request; this row records, per recipient, what the erasure
+ * did and who owes that communication. `status` is absent for a recipient reached with the TENANT's account, which is
+ * the tenant's to notify and never the operator's effect to run.
+ * spec-cite: GDPR Art. 19, https://gdpr-info.eu/art-19-gdpr/ (fetched 2026-09-29)
+ *
+ * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — every recipient the application declares is accounted for
+ * at every erasure, and one that no effect reached is recorded as unmeasured rather than passing silently.
+ */
+export declare const AuditableEvent_SubjectErasureRecipientOutcome_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SUBJECT_ERASURE_RECIPIENT_OUTCOME>;
+    subjectResourceType: z.ZodString;
+    subjectIds: z.ZodArray<z.ZodString>;
+    recipientRef: z.ZodString;
+    reach: z.ZodEnum<typeof SubjectDataRecipientReach>;
+    obligation: z.ZodEnum<typeof SubjectDataRecipientObligation>;
+    relevance: z.ZodEnum<typeof SubjectDataRecipientRelevance>;
+    status: z.ZodOptional<z.ZodEnum<typeof SubjectErasureExternalEffectStatus>>;
+    effectRefs: z.ZodArray<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 /**
  * Audit-log event for cross-frontend session handoff issuance
  * (cross-app-jwt-propagation Step 2).
@@ -3025,14 +4106,50 @@ export declare const AuditableEvent_BaseSchema: z.ZodObject<{
     correlationId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     frontendServiceName: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     clientInstanceId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    actorKind: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof AuditActorKind>>>>>;
+    agentActor: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodObject<{
+        agentRef: z.ZodString;
+        agentExecutionId: z.ZodOptional<z.ZodString>;
+        systemRef: z.ZodOptional<z.ZodString>;
+        toolName: z.ZodOptional<z.ZodString>;
+        decisionRef: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    delegatingClientId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    principalCredentialId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    actingViaServiceProviderRelationshipId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    providerOrganizationId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    serviceProviderFactorSource: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof FactorSatisfactionSource>>>>;
     riskLevel: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ResourceOperationRiskLevel>>;
-    eventType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    eventType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     eventData: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodRecord<z.ZodString, z.ZodAny>>;
     eventCategory: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof AuditEventCategory>>;
     severity: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof AuditEventSeverity>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
 }, z.core.$strip>;
+/**
+ * One retention-class sweep run, summarised per class (#1636). Counts only — no row id, no field value, no
+ * person: the per-resource detail is in the `retentionEnforcementRecords` row the same run wrote.
+ */
+export declare const AuditableEvent_RetentionEnforcementRecorded_EventDataSchema: z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.RETENTION_ENFORCEMENT_RECORDED>;
+    runRef: z.ZodString;
+    sweptAt: z.ZodString;
+    outcome: z.ZodEnum<typeof RetentionEnforcementOutcome>;
+    boundResourceCount: z.ZodNumber;
+    deletedCount: z.ZodNumber;
+    recordWriteFailureCount: z.ZodNumber;
+    classes: z.ZodArray<z.ZodObject<{
+        retentionClass: z.ZodEnum<typeof DataRetentionClass>;
+        resourceCount: z.ZodNumber;
+        deletedCount: z.ZodNumber;
+        completedCount: z.ZodNumber;
+        deferredByCeilingCount: z.ZodNumber;
+        failedCount: z.ZodNumber;
+        skippedCount: z.ZodNumber;
+        heldSkippedCount: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_LOGIN>;
     ipAddress: z.ZodString;
@@ -3128,7 +4245,7 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_TYPE_ASSIGNED>;
     organizationId: z.ZodString;
-    organizationType: z.ZodString;
+    organizationType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
     previousType: z.ZodOptional<z.ZodString>;
     basis: z.ZodEnum<typeof OrganizationTypeAssignmentBasis>;
     justification: z.ZodOptional<z.ZodString>;
@@ -3385,6 +4502,7 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_SET>;
     organizationId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     setBy: z.ZodOptional<z.ZodString>;
     credentialId: z.ZodString;
@@ -3392,6 +4510,7 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_ROTATED>;
     organizationId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     rotatedBy: z.ZodOptional<z.ZodString>;
     credentialId: z.ZodString;
@@ -3400,6 +4519,8 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_USED>;
     organizationId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
+    providerPackageName: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     resolvedFrom: z.ZodEnum<typeof ProviderCredentialResolutionSource>;
     credentialId: z.ZodOptional<z.ZodString>;
@@ -3408,6 +4529,7 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_PROVIDER_CREDENTIAL_DELETED>;
     organizationId: z.ZodString;
     providerRef: z.ZodString;
+    connectionRef: z.ZodOptional<z.ZodString>;
     secretSlug: z.ZodString;
     deletedBy: z.ZodOptional<z.ZodString>;
     credentialId: z.ZodString;
@@ -3423,6 +4545,24 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
         before: z.ZodNullable<z.ZodEnum<typeof AuditApplicationReadAccess>>;
         after: z.ZodEnum<typeof AuditApplicationReadAccess>;
     }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.RETENTION_ENFORCEMENT_RECORDED>;
+    runRef: z.ZodString;
+    sweptAt: z.ZodString;
+    outcome: z.ZodEnum<typeof RetentionEnforcementOutcome>;
+    boundResourceCount: z.ZodNumber;
+    deletedCount: z.ZodNumber;
+    recordWriteFailureCount: z.ZodNumber;
+    classes: z.ZodArray<z.ZodObject<{
+        retentionClass: z.ZodEnum<typeof DataRetentionClass>;
+        resourceCount: z.ZodNumber;
+        deletedCount: z.ZodNumber;
+        completedCount: z.ZodNumber;
+        deferredByCeilingCount: z.ZodNumber;
+        failedCount: z.ZodNumber;
+        skippedCount: z.ZodNumber;
+        heldSkippedCount: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED>;
     organizationId: z.ZodOptional<z.ZodString>;
@@ -3434,6 +4574,207 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     responseStatus: z.ZodOptional<z.ZodNumber>;
     durationMs: z.ZodNumber;
     signatureJti: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    reason: z.ZodEnum<typeof InboundDeliveryRejectionReason>;
+    refusalCount: z.ZodNumber;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_REJECTED>;
+}, z.core.$strip>, z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    resolvedScopeKind: z.ZodEnum<typeof InboundResolvedScopeKind>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    channel: z.ZodEnum<typeof InboundChannelKind>;
+    senderAssurance: z.ZodEnum<typeof InboundSenderAssurance>;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_ACCEPTED>;
+}, z.core.$strip>, z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    reason: z.ZodEnum<typeof InboundDeliveryUnroutableReason>;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_UNROUTABLE>;
+}, z.core.$strip>, z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    attempt: z.ZodNumber;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_PROCESSED>;
+}, z.core.$strip>, z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    attempt: z.ZodNumber;
+    errorCode: z.ZodString;
+    nextAttemptAt: z.ZodDate;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_FAILED>;
+}, z.core.$strip>, z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    attempts: z.ZodNumber;
+    errorCode: z.ZodString;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_DEAD>;
+}, z.core.$strip>, z.ZodObject<{
+    inboundDeliveryId: z.ZodString;
+    handlerRef: z.ZodString;
+    replayedBy: z.ZodString;
+    justification: z.ZodString;
+    sourceKind: z.ZodEnum<typeof InboundSourceKind>;
+    sourceKey: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_REPLAYED>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_DELIVERY_BELOW_ASSURANCE>;
+    channel: z.ZodEnum<typeof InboundChannelKind>;
+    handlerRef: z.ZodString;
+    senderAssurance: z.ZodEnum<typeof InboundSenderAssurance>;
+    minimumSenderAssurance: z.ZodEnum<typeof InboundSenderAssurance>;
+    disposition: z.ZodEnum<typeof InboundBelowMinimumDisposition>;
+    belowMinimumHandlerRef: z.ZodOptional<z.ZodString>;
+    inboundDeliveryId: z.ZodOptional<z.ZodString>;
+    channelMessageId: z.ZodString;
+    organizationId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    templateRef: z.ZodString;
+    recipientCount: z.ZodNumber;
+    deduplicated: z.ZodBoolean;
+    channel: z.ZodEnum<typeof InboundChannelKind>;
+    threadId: z.ZodString;
+    conversationMessageId: z.ZodString;
+    submissionId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_REPLY_SENT>;
+}, z.core.$strip>, z.ZodObject<{
+    failureCode: z.ZodString;
+    channel: z.ZodEnum<typeof InboundChannelKind>;
+    threadId: z.ZodString;
+    conversationMessageId: z.ZodString;
+    submissionId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_REPLY_FAILED>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_REPLY_TOKEN_REVOKED>;
+    threadId: z.ZodString;
+    replyTokenId: z.ZodString;
+    reason: z.ZodEnum<typeof ReplyTokenRevocationReason>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_REPLY_TOKEN_DOWNGRADED>;
+    threadId: z.ZodString;
+    replyTokenId: z.ZodString;
+    reason: z.ZodEnum<typeof ReplyTokenDowngradeReason>;
+    derivedAssurance: z.ZodEnum<typeof InboundSenderAssurance>;
+}, z.core.$strip>, z.ZodObject<{
+    sending: z.ZodBoolean;
+    receiving: z.ZodBoolean;
+    organizationId: z.ZodString;
+    organizationEmailDomainId: z.ZodString;
+    domain: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_CLAIMED>;
+}, z.core.$strip>, z.ZodObject<{
+    providerRef: z.ZodString;
+    providerDomainId: z.ZodString;
+    organizationId: z.ZodString;
+    organizationEmailDomainId: z.ZodString;
+    domain: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_OWNERSHIP_VERIFIED>;
+}, z.core.$strip>, z.ZodObject<{
+    status: z.ZodEnum<typeof OrganizationEmailDomainStatus>;
+    organizationId: z.ZodString;
+    organizationEmailDomainId: z.ZodString;
+    domain: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_VERIFIED>;
+}, z.core.$strip>, z.ZodObject<{
+    reason: z.ZodEnum<typeof OrganizationEmailDomainSuspensionReason>;
+    organizationId: z.ZodString;
+    organizationEmailDomainId: z.ZodString;
+    domain: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_SUSPENDED>;
+}, z.core.$strip>, z.ZodObject<{
+    trigger: z.ZodEnum<typeof OrganizationEmailDomainRemovalTrigger>;
+    providerDomainDeleted: z.ZodBoolean;
+    organizationId: z.ZodString;
+    organizationEmailDomainId: z.ZodString;
+    domain: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_REMOVED>;
+}, z.core.$strip>, z.ZodObject<{
+    organizationId: z.ZodString;
+    clientMailboxId: z.ZodString;
+    address: z.ZodString;
+    emailDomainId: z.ZodString;
+    serviceProviderRelationshipId: z.ZodString;
+    firmOrganizationId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.CLIENT_MAILBOX_CREATED>;
+}, z.core.$strip>, z.ZodObject<{
+    organizationId: z.ZodString;
+    clientMailboxId: z.ZodString;
+    address: z.ZodString;
+    emailDomainId: z.ZodString;
+    serviceProviderRelationshipId: z.ZodString;
+    firmOrganizationId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.CLIENT_MAILBOX_REMOVED>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_EMAIL_ATTACHMENT_WITHHELD>;
+    organizationId: z.ZodString;
+    inboundEmailId: z.ZodString;
+    reason: z.ZodEnum<typeof InboundEmailWithheldReason>;
+    fileId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.INBOUND_EMAIL_REJECTED_LIMIT>;
+    organizationId: z.ZodString;
+    inboundEmailId: z.ZodString;
+    limit: z.ZodEnum<typeof InboundEmailLimit>;
+    sizeBytes: z.ZodNumber;
+    attachmentCount: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    autonomousAgentRef: z.ZodString;
+    organizationId: z.ZodString;
+    oauthClientId: z.ZodString;
+    principalSource: z.ZodEnum<typeof AutonomousPrincipalSource>;
+    providerOrganizationId: z.ZodOptional<z.ZodString>;
+    serviceProviderRelationshipId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.AUTONOMOUS_AGENT_BOUND>;
+}, z.core.$strip>, z.ZodObject<{
+    autonomousAgentRef: z.ZodString;
+    organizationId: z.ZodString;
+    oauthClientId: z.ZodString;
+    principalSource: z.ZodEnum<typeof AutonomousPrincipalSource>;
+    providerOrganizationId: z.ZodOptional<z.ZodString>;
+    serviceProviderRelationshipId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.AUTONOMOUS_AGENT_UNBOUND>;
+}, z.core.$strip>, z.ZodObject<{
+    executionId: z.ZodString;
+    systemRef: z.ZodString;
+    oauthClientId: z.ZodString;
+    principalSource: z.ZodEnum<typeof AutonomousPrincipalSource>;
+    autonomousAgentRef: z.ZodString;
+    organizationId: z.ZodString;
+    occurrenceKey: z.ZodString;
+    trigger: z.ZodEnum<typeof AutonomousTurnTrigger>;
+    caseRef: z.ZodOptional<z.ZodObject<{
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+    }, z.core.$strict>>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_STARTED>;
+}, z.core.$strip>, z.ZodObject<{
+    reason: z.ZodEnum<typeof AutonomousTurnRefusalReason>;
+    budgetDenialReason: z.ZodOptional<z.ZodString>;
+    runtimeErrorCode: z.ZodOptional<z.ZodString>;
+    oauthClientId: z.ZodOptional<z.ZodString>;
+    autonomousAgentRef: z.ZodString;
+    organizationId: z.ZodString;
+    occurrenceKey: z.ZodString;
+    trigger: z.ZodEnum<typeof AutonomousTurnTrigger>;
+    caseRef: z.ZodOptional<z.ZodObject<{
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+    }, z.core.$strict>>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_REFUSED>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.SCIM_TOKEN_CREATED>;
     organizationId: z.ZodString;
@@ -3745,6 +5086,204 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
         authMethod: z.ZodEnum<typeof import("../..").MachineAuthMethod>;
         credentialId: z.ZodString;
     }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    placedByUserId: z.ZodString;
+    holdId: z.ZodString;
+    heldOrganizationId: z.ZodString;
+    scopeKind: z.ZodEnum<typeof LegalHoldScopeKind>;
+    legalGround: z.ZodEnum<typeof LegalHoldGround>;
+    placementTier: z.ZodEnum<typeof LegalHoldPlacementTier>;
+    heldResourceType: z.ZodOptional<z.ZodString>;
+    heldRowCount: z.ZodOptional<z.ZodNumber>;
+    subjectUserId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.LEGAL_HOLD_PLACED>;
+}, z.core.$strip>, z.ZodObject<{
+    releasedByUserId: z.ZodString;
+    heldForSeconds: z.ZodNumber;
+    holdId: z.ZodString;
+    heldOrganizationId: z.ZodString;
+    scopeKind: z.ZodEnum<typeof LegalHoldScopeKind>;
+    legalGround: z.ZodEnum<typeof LegalHoldGround>;
+    placementTier: z.ZodEnum<typeof LegalHoldPlacementTier>;
+    heldResourceType: z.ZodOptional<z.ZodString>;
+    heldRowCount: z.ZodOptional<z.ZodNumber>;
+    subjectUserId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.LEGAL_HOLD_RELEASED>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.MODEL_COST_AGGREGATE_INVOICE_LINKED>;
+    aggregateId: z.ZodString;
+    billedOrganizationId: z.ZodString;
+    periodStart: z.ZodString;
+    currency: z.ZodString;
+    organizationInvoiceRefId: z.ZodString;
+    linkedByUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.CORRECTION_CAPTURE_SETTING_CHANGED>;
+    settingOrganizationId: z.ZodString;
+    previousContentCapture: z.ZodOptional<z.ZodString>;
+    contentCapture: z.ZodString;
+    purposeStated: z.ZodBoolean;
+    contentReaderRole: z.ZodOptional<z.ZodString>;
+    narrowedToCaseCount: z.ZodNumber;
+    changedByUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EVALUATION_EXPORT_AUTHORIZATION_CHANGED>;
+    authorizationOrganizationId: z.ZodString;
+    status: z.ZodString;
+    previousStatus: z.ZodOptional<z.ZodString>;
+    basis: z.ZodOptional<z.ZodString>;
+    clientConsentCount: z.ZodNumber;
+    excludedCaseCount: z.ZodNumber;
+    changedByUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EVALUATION_DATASET_EXPORTED>;
+    exportId: z.ZodString;
+    exportOrganizationId: z.ZodString;
+    agentRef: z.ZodString;
+    basis: z.ZodString;
+    recordCount: z.ZodNumber;
+    windowFrom: z.ZodString;
+    windowTo: z.ZodString;
+    destination: z.ZodString;
+    exportedByUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EVALUATION_DATASET_EXPORT_REFUSED>;
+    exportOrganizationId: z.ZodString;
+    agentRef: z.ZodString;
+    reason: z.ZodEnum<typeof EvaluationDatasetExportRefusalReason>;
+    attemptedByUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_RELATIONSHIP_LIFECYCLE>;
+    transition: z.ZodEnum<typeof ServiceProviderRelationshipTransition>;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    resultingStatus: z.ZodEnum<typeof ServiceProviderRelationshipStatus>;
+    role: z.ZodString;
+    organizationUnitIds: z.ZodArray<z.ZodString>;
+    endsAt: z.ZodOptional<z.ZodDate>;
+    proposedByOrganizationId: z.ZodString;
+    actorUserId: z.ZodOptional<z.ZodString>;
+    actorOrganizationId: z.ZodOptional<z.ZodString>;
+    purpose: z.ZodOptional<z.ZodString>;
+    decisionReason: z.ZodOptional<z.ZodString>;
+    expertAdmissionPolicy: z.ZodOptional<z.ZodEnum<typeof ServiceProviderExpertAdmissionPolicy>>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_MACHINE_CLIENT_ADMISSION_CHANGED>;
+    admitted: z.ZodBoolean;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    oauthClientId: z.ZodString;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_ASSIGNED>;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_UNASSIGNED>;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    expertAdmissionPolicy: z.ZodEnum<typeof ServiceProviderExpertAdmissionPolicy>;
+    role: z.ZodString;
+    actorUserId: z.ZodOptional<z.ZodString>;
+    decisionRef: z.ZodString;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_REQUESTED>;
+}, z.core.$strip>, z.ZodObject<{
+    role: z.ZodString;
+    decisionRef: z.ZodString;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_GRANTED>;
+}, z.core.$strip>, z.ZodObject<{
+    denialReason: z.ZodEnum<typeof ServiceProviderExpertApprovalDenialReason>;
+    decisionRef: z.ZodString;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_DENIED>;
+}, z.core.$strip>, z.ZodObject<{
+    decisionRef: z.ZodString;
+    assignmentId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_LAPSED>;
+}, z.core.$strip>, z.ZodObject<{
+    grantId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    capability: z.ZodEnum<typeof DelegatedAdministrativeCapability>;
+    securityCritical: z.ZodBoolean;
+    endsAt: z.ZodDate;
+    actorUserId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_GRANTED>;
+}, z.core.$strip>, z.ZodObject<{
+    byRelationshipEnd: z.ZodBoolean;
+    endCause: z.ZodOptional<z.ZodEnum<typeof ServiceProviderCapabilityGrantEndCause>>;
+    endedCredentials: z.ZodOptional<z.ZodNumber>;
+    grantId: z.ZodString;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    capability: z.ZodEnum<typeof DelegatedAdministrativeCapability>;
+    securityCritical: z.ZodBoolean;
+    endsAt: z.ZodDate;
+    actorUserId: z.ZodOptional<z.ZodString>;
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_REVOKED>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_MFA_TRUST_CHANGED>;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    previousProviderMfaTrust: z.ZodEnum<typeof ServiceProviderMfaTrust>;
+    providerMfaTrust: z.ZodEnum<typeof ServiceProviderMfaTrust>;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_CLIENT_AUTHENTICATION_SATISFIED>;
+    organizationId: z.ZodString;
+    relationshipId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    expertUserId: z.ZodString;
+    factor: z.ZodEnum<typeof AuthMethod>;
+    source: z.ZodEnum<typeof FactorSatisfactionSource>;
+    identityProviderOrganizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DECIDED>;
+    providerOrganizationId: z.ZodString;
+    previousStatus: z.ZodEnum<typeof ServiceProviderActivityFeedStatus>;
+    status: z.ZodEnum<typeof ServiceProviderActivityFeedStatus>;
+    acknowledgedWorkerConsultationNotice: z.ZodBoolean;
+    actorUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DISCLOSURE_CHANGED>;
+    relationshipId: z.ZodString;
+    clientOrganizationId: z.ZodString;
+    providerOrganizationId: z.ZodString;
+    previousActivityFeedDisclosure: z.ZodEnum<typeof ServiceProviderActivityFeedDisclosure>;
+    activityFeedDisclosure: z.ZodEnum<typeof ServiceProviderActivityFeedDisclosure>;
+    actorUserId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_LIFECYCLE>;
     transition: z.ZodEnum<typeof SystemOfRecordPartitionAssignmentTransition>;
@@ -3800,6 +5339,8 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     fieldsExcludedAsDerived: z.ZodArray<z.ZodString>;
     fieldsWithheldAsNonDisclosable: z.ZodArray<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
+    recipientsStatus: z.ZodEnum<typeof SubjectDataRecipientsStatementStatus>;
+    recipientRefs: z.ZodArray<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.COLLECTION_DATA_EXPORT>;
     resourceType: z.ZodString;
@@ -3820,7 +5361,7 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     eventType: z.ZodLiteral<CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS>;
     resourceType: z.ZodString;
     operationIdentifier: z.ZodString;
-    providerRef: z.ZodString;
+    systemOfRecord: z.ZodString;
     remoteEntityRef: z.ZodString;
     dialect: z.ZodString;
     initiatorUserId: z.ZodOptional<z.ZodString>;
@@ -3828,6 +5369,90 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     organizationId: z.ZodOptional<z.ZodString>;
     resourceId: z.ZodOptional<z.ZodString>;
     rowCount: z.ZodOptional<z.ZodNumber>;
+    rejectedRows: z.ZodOptional<z.ZodNumber>;
+    completedPass: z.ZodOptional<z.ZodBoolean>;
+    pipelinePassMode: z.ZodOptional<z.ZodEnum<typeof ExternalDataPipelinePassMode>>;
+    suppressedRows: z.ZodOptional<z.ZodNumber>;
+    liveSuppressedRows: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.HTTP_API_WRITE_THROUGH>;
+    resourceType: z.ZodString;
+    operationIdentifier: z.ZodString;
+    systemOfRecord: z.ZodString;
+    remoteEntityRef: z.ZodString;
+    dialect: z.ZodString;
+    outcome: z.ZodEnum<typeof HttpApiWriteThroughOutcome>;
+    resourceId: z.ZodOptional<z.ZodString>;
+    writtenFieldNames: z.ZodArray<z.ZodString>;
+    refusalCode: z.ZodOptional<z.ZodString>;
+    initiatorUserId: z.ZodOptional<z.ZodString>;
+    executionType: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    organizationUnitId: z.ZodOptional<z.ZodString>;
+    localResourceId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_EXECUTED>;
+    systemOfRecord: z.ZodString;
+    action: z.ZodString;
+    resourceType: z.ZodString;
+    remoteEntityRef: z.ZodString;
+    callShape: z.ZodString;
+    outcome: z.ZodEnum<typeof SystemOfRecordActionOutcome>;
+    writes: z.ZodBoolean;
+    targetResourceId: z.ZodOptional<z.ZodString>;
+    inputFieldNames: z.ZodArray<z.ZodString>;
+    failureCode: z.ZodOptional<z.ZodString>;
+    initiatorUserId: z.ZodOptional<z.ZodString>;
+    executionType: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    organizationUnitId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_REFUSED>;
+    systemOfRecord: z.ZodString;
+    action: z.ZodString;
+    resourceType: z.ZodOptional<z.ZodString>;
+    targetResourceId: z.ZodOptional<z.ZodString>;
+    refusalCode: z.ZodString;
+    refusalReason: z.ZodOptional<z.ZodString>;
+    initiatorUserId: z.ZodOptional<z.ZodString>;
+    executionType: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EXTERNAL_DATA_PIPELINE_RESET>;
+    pipelineResourceType: z.ZodString;
+    systemOfRecord: z.ZodString;
+    resetMode: z.ZodEnum<typeof ExternalDataPipelineResetMode>;
+    reason: z.ZodString;
+    statedOperator: z.ZodOptional<z.ZodString>;
+    stateFound: z.ZodBoolean;
+    discardedPassId: z.ZodNullable<z.ZodString>;
+    discardedCursor: z.ZodNullable<z.ZodString>;
+    discardedPassStartedAt: z.ZodNullable<z.ZodString>;
+    discardedIncrementalWatermark: z.ZodNullable<z.ZodString>;
+    discardedIncrementalCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EXTERNAL_DATA_OUTBOUND_UNKNOWN_RESOLVED>;
+    pipelineResourceType: z.ZodString;
+    systemOfRecord: z.ZodString;
+    localResourceId: z.ZodString;
+    operationIdentifier: z.ZodString;
+    answer: z.ZodEnum<typeof ExternalDataOutboundUnknownAnswer>;
+    remoteKey: z.ZodNullable<z.ZodString>;
+    remoteKeyWritten: z.ZodBoolean;
+    changeStillOwed: z.ZodBoolean;
+    reason: z.ZodString;
+    statedOperator: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.EXTERNAL_DATA_CONFLICT_RESOLVED>;
+    pipelineResourceType: z.ZodString;
+    systemOfRecord: z.ZodString;
+    localResourceId: z.ZodString;
+    remoteKey: z.ZodString;
+    winner: z.ZodEnum<typeof ExternalDataConflictWinner>;
+    decidedBy: z.ZodEnum<typeof ExternalDataConflictDecisionSource>;
+    overwrittenFieldNames: z.ZodArray<z.ZodString>;
+    remoteVersion: z.ZodNullable<z.ZodString>;
+    agreedVersion: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.PROVIDER_OPERATION_CALL>;
     providerRef: z.ZodString;
@@ -3845,6 +5470,17 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     initiatorUserId: z.ZodOptional<z.ZodString>;
     executionType: z.ZodOptional<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
+    augmentationPackage: z.ZodOptional<z.ZodString>;
+    augmentationPackageVersion: z.ZodOptional<z.ZodString>;
+    connectionRef: z.ZodOptional<z.ZodString>;
+    providerPackageName: z.ZodOptional<z.ZodString>;
+    tokenAudience: z.ZodOptional<z.ZodString>;
+    rateBudget: z.ZodOptional<z.ZodObject<{
+        budgetKeys: z.ZodArray<z.ZodString>;
+        counting: z.ZodEnum<typeof RateBudgetCounting>;
+        waitedMs: z.ZodNumber;
+        exhaustedBudgetKey: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.PROVIDER_OPERATION_DENIED>;
     denialReason: z.ZodEnum<typeof ProviderOperationDenialReason>;
@@ -3863,7 +5499,7 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     subjectResourceType: z.ZodString;
     subjectIds: z.ZodArray<z.ZodString>;
     resourceType: z.ZodString;
-    providerRef: z.ZodString;
+    systemOfRecord: z.ZodString;
     remoteEntityRef: z.ZodString;
     dialect: z.ZodString;
     deletedRowCount: z.ZodNumber;
@@ -3873,11 +5509,22 @@ export declare const AuditableEvent_TypedDataSchema: z.ZodDiscriminatedUnion<[z.
     subjectResourceType: z.ZodString;
     subjectIds: z.ZodArray<z.ZodString>;
     resourceType: z.ZodString;
-    providerRef: z.ZodString;
+    systemOfRecord: z.ZodString;
     remoteEntityRef: z.ZodString;
     dialect: z.ZodString;
     remainingRowCount: z.ZodOptional<z.ZodNumber>;
     organizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    eventType: z.ZodLiteral<CoreAuditableEventType.SUBJECT_ERASURE_RECIPIENT_OUTCOME>;
+    subjectResourceType: z.ZodString;
+    subjectIds: z.ZodArray<z.ZodString>;
+    recipientRef: z.ZodString;
+    reach: z.ZodEnum<typeof SubjectDataRecipientReach>;
+    obligation: z.ZodEnum<typeof SubjectDataRecipientObligation>;
+    relevance: z.ZodEnum<typeof SubjectDataRecipientRelevance>;
+    status: z.ZodOptional<z.ZodEnum<typeof SubjectErasureExternalEffectStatus>>;
+    effectRefs: z.ZodArray<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     eventType: z.ZodLiteral<CoreAuditableEventType.USER_CROSS_FRONTEND_HANDOFF_ISSUED>;
     userId: z.ZodString;
@@ -4013,7 +5660,29 @@ export type AuditableEvent_UserProviderConnection_GrantedEventData = z.infer<typ
 export type AuditableEvent_OrganizationProviderConnection_GrantedEventData = z.infer<typeof AuditableEvent_OrganizationProviderConnection_GrantedEventDataSchema>;
 export type ApplicationAuthPolicySnapshot = z.infer<typeof ApplicationAuthPolicySnapshotSchema>;
 export type AuditableEvent_ApplicationAuthPolicyChanged_EventData = z.infer<typeof AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema>;
+export type AuditableEvent_RetentionEnforcementRecorded_EventData = z.infer<typeof AuditableEvent_RetentionEnforcementRecorded_EventDataSchema>;
 export type AuditableEvent_Webhook_EndpointTestDispatchedEventData = z.infer<typeof AuditableEvent_Webhook_EndpointTestDispatchedEventDataSchema>;
+export type AuditableEvent_InboundDelivery_RejectedEventData = z.infer<typeof AuditableEvent_InboundDelivery_RejectedEventDataSchema>;
+export type AuditableEvent_InboundDelivery_AcceptedEventData = z.infer<typeof AuditableEvent_InboundDelivery_AcceptedEventDataSchema>;
+export type AuditableEvent_InboundDelivery_UnroutableEventData = z.infer<typeof AuditableEvent_InboundDelivery_UnroutableEventDataSchema>;
+export type AuditableEvent_InboundDelivery_ProcessedEventData = z.infer<typeof AuditableEvent_InboundDelivery_ProcessedEventDataSchema>;
+export type AuditableEvent_InboundDelivery_FailedEventData = z.infer<typeof AuditableEvent_InboundDelivery_FailedEventDataSchema>;
+export type AuditableEvent_InboundDelivery_DeadEventData = z.infer<typeof AuditableEvent_InboundDelivery_DeadEventDataSchema>;
+export type AuditableEvent_InboundDelivery_ReplayedEventData = z.infer<typeof AuditableEvent_InboundDelivery_ReplayedEventDataSchema>;
+export type AuditableEvent_InboundDelivery_BelowAssuranceEventData = z.infer<typeof AuditableEvent_InboundDelivery_BelowAssuranceEventDataSchema>;
+export type AuditableEvent_InboundReply_SentEventData = z.infer<typeof AuditableEvent_InboundReply_SentEventDataSchema>;
+export type AuditableEvent_InboundReply_FailedEventData = z.infer<typeof AuditableEvent_InboundReply_FailedEventDataSchema>;
+export type AuditableEvent_InboundReplyToken_RevokedEventData = z.infer<typeof AuditableEvent_InboundReplyToken_RevokedEventDataSchema>;
+export type AuditableEvent_InboundReplyToken_DowngradedEventData = z.infer<typeof AuditableEvent_InboundReplyToken_DowngradedEventDataSchema>;
+export type AuditableEvent_OrganizationEmailDomain_ClaimedEventData = z.infer<typeof AuditableEvent_OrganizationEmailDomain_ClaimedEventDataSchema>;
+export type AuditableEvent_OrganizationEmailDomain_OwnershipVerifiedEventData = z.infer<typeof AuditableEvent_OrganizationEmailDomain_OwnershipVerifiedEventDataSchema>;
+export type AuditableEvent_OrganizationEmailDomain_VerifiedEventData = z.infer<typeof AuditableEvent_OrganizationEmailDomain_VerifiedEventDataSchema>;
+export type AuditableEvent_OrganizationEmailDomain_SuspendedEventData = z.infer<typeof AuditableEvent_OrganizationEmailDomain_SuspendedEventDataSchema>;
+export type AuditableEvent_OrganizationEmailDomain_RemovedEventData = z.infer<typeof AuditableEvent_OrganizationEmailDomain_RemovedEventDataSchema>;
+export type AuditableEvent_ClientMailbox_CreatedEventData = z.infer<typeof AuditableEvent_ClientMailbox_CreatedEventDataSchema>;
+export type AuditableEvent_ClientMailbox_RemovedEventData = z.infer<typeof AuditableEvent_ClientMailbox_RemovedEventDataSchema>;
+export type AuditableEvent_InboundEmail_AttachmentWithheldEventData = z.infer<typeof AuditableEvent_InboundEmail_AttachmentWithheldEventDataSchema>;
+export type AuditableEvent_InboundEmail_RejectedLimitEventData = z.infer<typeof AuditableEvent_InboundEmail_RejectedLimitEventDataSchema>;
 export type AuditableEvent_SCIM_TokenCreatedEventData = z.infer<typeof AuditableEvent_SCIM_TokenCreatedEventDataSchema>;
 export type AuditableEvent_SCIM_TokenRevokedEventData = z.infer<typeof AuditableEvent_SCIM_TokenRevokedEventDataSchema>;
 export type AuditableEvent_SCIM_UserProvisionedEventData = z.infer<typeof AuditableEvent_SCIM_UserProvisionedEventDataSchema>;
@@ -4052,10 +5721,17 @@ export type AuditableEvent_SubjectDataExport_EventData = z.infer<typeof Auditabl
 export type AuditableEvent_CollectionDataExport_EventData = z.infer<typeof AuditableEvent_CollectionDataExport_EventDataSchema>;
 export type AuditableEvent_User_SessionEvictedEventData = z.infer<typeof AuditableEvent_User_SessionEvictedEventDataSchema>;
 export type AuditableEvent_HttpApiReadThroughAccess_EventData = z.infer<typeof AuditableEvent_HttpApiReadThroughAccess_EventDataSchema>;
+export type AuditableEvent_HttpApiWriteThrough_EventData = z.infer<typeof AuditableEvent_HttpApiWriteThrough_EventDataSchema>;
+export type AuditableEvent_SystemOfRecordActionExecuted_EventData = z.infer<typeof AuditableEvent_SystemOfRecordActionExecuted_EventDataSchema>;
+export type AuditableEvent_SystemOfRecordActionRefused_EventData = z.infer<typeof AuditableEvent_SystemOfRecordActionRefused_EventDataSchema>;
+export type AuditableEvent_ExternalDataPipelineReset_EventData = z.infer<typeof AuditableEvent_ExternalDataPipelineReset_EventDataSchema>;
+export type AuditableEvent_ExternalDataOutboundUnknownResolved_EventData = z.infer<typeof AuditableEvent_ExternalDataOutboundUnknownResolved_EventDataSchema>;
+export type AuditableEvent_ExternalDataConflictResolved_EventData = z.infer<typeof AuditableEvent_ExternalDataConflictResolved_EventDataSchema>;
 export type AuditableEvent_ProviderOperationCall_EventData = z.infer<typeof AuditableEvent_ProviderOperationCall_EventDataSchema>;
 export type AuditableEvent_ProviderOperationDenied_EventData = z.infer<typeof AuditableEvent_ProviderOperationDenied_EventDataSchema>;
 export type AuditableEvent_HttpApiExternalErasure_EventData = z.infer<typeof AuditableEvent_HttpApiExternalErasure_EventDataSchema>;
 export type AuditableEvent_HttpApiNonErasureAcknowledged_EventData = z.infer<typeof AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema>;
+export type AuditableEvent_SubjectErasureRecipientOutcome_EventData = z.infer<typeof AuditableEvent_SubjectErasureRecipientOutcome_EventDataSchema>;
 export type AuditableEvent_User_CrossFrontendHandoffIssuedEventData = z.infer<typeof AuditableEvent_User_CrossFrontendHandoffIssuedEventDataSchema>;
 export type AuditableEvent_OAuth_DelegatedTokenIssuedEventData = z.infer<typeof AuditableEvent_OAuth_DelegatedTokenIssuedEventDataSchema>;
 export type AuditableEvent_OAuth_ConsentGrantedEventData = z.infer<typeof AuditableEvent_OAuth_ConsentGrantedEventDataSchema>;