@zitadel/api 0.1.0-alpha.9 → 1.0.0-alpha.21

package/src/generated/model/listEvents200DataItem.ts

@@ -0,0 +1,1878 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Discriminated wide-event union (ADR 048 / ADR 049). Clients select the
+member via event_type; each member carries a typed payload.
+
+ */
+export type ListEvents200DataItem =
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "auth.attempt.created";
+      /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+   */
+      payload: { [key: string]: unknown };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "auth.attempt.handed_off";
+      /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+   */
+      payload: { [key: string]: unknown };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "auth.check.failed";
+      /** Payload for `auth.check.failed` / `auth.check.succeeded`.
+  `auth_attempt_id` joins the check to its attempt for SIEM correlation.
+   */
+      payload: {
+        check_id: string;
+        check_type?: string;
+        auth_attempt_id?: string;
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "auth.check.succeeded";
+      /** Payload for `auth.check.failed` / `auth.check.succeeded`.
+  `auth_attempt_id` joins the check to its attempt for SIEM correlation.
+   */
+      payload: {
+        check_id: string;
+        check_type?: string;
+        auth_attempt_id?: string;
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "auth.factor.passkey.enrolled";
+      /** Payload for `auth.factor.*` events. */
+      payload: {
+        user_id: string;
+        factor_id?: string;
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "auth.factor.password.set";
+      /** Payload for `auth.factor.*` events. */
+      payload: {
+        user_id: string;
+        factor_id?: string;
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "auth.token.issued";
+      /** Payload for `auth.token.issued` events. */
+      payload: {
+        scopes?: string[];
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "auth.token.revoked";
+      /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+   */
+      payload: { [key: string]: unknown };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "authz.granted";
+      /** Payload for `authz.granted` events. */
+      payload: {
+        principal_type?: string;
+        principal_id?: string;
+        relation?: string;
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "authz.revoked";
+      /** Payload for `authz.granted` events. */
+      payload: {
+        principal_type?: string;
+        principal_id?: string;
+        relation?: string;
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "branding.created";
+      /** Allowlisted fields for `branding.created`. Omits `liquid_template`.
+       */
+      payload: {
+        layout?: string;
+        logo_url?: string;
+        font_url?: string;
+        hero_url?: string;
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "environment.created";
+      /** Allowlisted fields for `environment.created`. The environment id is already
+  the event's `entity_id`, so the name is the only field carried here.
+   */
+      payload: {
+        name?: string;
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "flowdef.created";
+      /** Shared allowlisted fields for `flowdef.created` (full snapshot) and
+  `flowdef.updated` (delta: only changed fields present). Steps are omitted.
+   */
+      payload: {
+        name?: string;
+        status?: string;
+        user_schema?: string;
+        purposes?: { [key: string]: string };
+        audience?: {
+          app_ids?: string[];
+          team_ids?: string[];
+        };
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "flowdef.deleted";
+      /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+   */
+      payload: { [key: string]: unknown };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "flowdef.updated";
+      /** Shared allowlisted fields for `flowdef.created` (full snapshot) and
+  `flowdef.updated` (delta: only changed fields present). Steps are omitted.
+   */
+      payload: {
+        name?: string;
+        status?: string;
+        user_schema?: string;
+        purposes?: { [key: string]: string };
+        audience?: {
+          app_ids?: string[];
+          team_ids?: string[];
+        };
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "project.created";
+      /** Shared allowlisted fields for `project.created` (full snapshot) and
+  `project.updated` (delta: only changed fields present).
+   */
+      payload: {
+        name?: string;
+        preview_origins?: string[];
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "project.deleted";
+      /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+   */
+      payload: { [key: string]: unknown };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "project.updated";
+      /** Shared allowlisted fields for `project.created` (full snapshot) and
+  `project.updated` (delta: only changed fields present).
+   */
+      payload: {
+        name?: string;
+        preview_origins?: string[];
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "request.api";
+      /** Payload for `request.api` events. */
+      payload: {
+        operation_id: string;
+        /** HTTP method. */
+        method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
+        route_template: string;
+        /**
+         * @minimum 100
+         * @maximum 599
+         */
+        status: number;
+        /** @minimum 0 */
+        duration_ms: number;
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "schema.created";
+      /** Allowlisted fields for `schema.created`. The schema document itself is
+  omitted — it is customer-authored and unbounded, and the event's `entity_id`
+  already identifies which schema was created.
+   */
+      payload: {
+        /** The kind the stored document declares. `unknown` when the schema was
+  persisted without its document being parsed.
+   */
+        kind?: string;
+        /** The customer-chosen object type the schema describes. Absent when the
+  document declares none.
+   */
+        object_type?: string;
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "session.deleted";
+      /** Payload for `session.deleted` events. */
+      payload: {
+        reason?: string;
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "session.established";
+      /** Payload for `session.established` events. */
+      payload: {
+        user_id?: string;
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "team.created";
+      /** Shared allowlisted fields for `team.created` (snapshot) and
+  `team.updated` (delta: only changed fields present).
+   */
+      payload: {
+        name?: string;
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "team.deactivated";
+      /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+   */
+      payload: { [key: string]: unknown };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "team.updated";
+      /** Shared allowlisted fields for `team.created` (snapshot) and
+  `team.updated` (delta: only changed fields present).
+   */
+      payload: {
+        name?: string;
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "user.create.failed";
+      /** Payload for `user.create.failed` events. */
+      payload: {
+        key_name?: string;
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "user.created";
+      /** Payload for `user.created`. Identity is `entity_id`; attribute values
+  appear only for schema fields marked `x-audit`.
+   */
+      payload: {
+        schema_id?: string;
+        attribute_keys?: string[];
+        attributes?: { [key: string]: unknown };
+      };
+    })
+  | ({
+      /** Managed event id (`evt_<opaque>`). */
+      id: string;
+      /** @pattern ^[a-zA-Z0-9_-]+$ */
+      project_id: string;
+      /** Emit-time team scope, when the actor operated under a team. */
+      team_id?: string | null;
+      /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+   */
+      event_type: string;
+      /** Wide-event category. */
+      category: "request" | "auth" | "session" | "admin" | "entity" | "signal";
+      /** When the action happened (server/storage clock, dialect-owned). */
+      occurred_at: string;
+      /** When the row was inserted (server/storage clock, dialect-owned). */
+      created_at: string;
+      /** Who triggered the event. */
+      actor_id?: string | null;
+      /** Actor kind. */
+      actor_type?: "human" | "service" | "system" | "agent" | null;
+      /** Resource type affected. */
+      entity_type?: string | null;
+      /** Resource id affected. */
+      entity_id?: string | null;
+      /** Application or agent that produced the event. */
+      client_id: string;
+      /** Token id present at emit time, when any. */
+      token_id?: string;
+      /** Delegation kind (omit when unset). */
+      delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+      delegation_id?: string;
+      grantor?: string;
+      /** Device fingerprint correlation id. */
+      fingerprint?: string;
+      /** HTTP request correlation id. */
+      request_id?: string | null;
+      /** Session correlation id. */
+      session_id?: string | null;
+      /** Login flow correlation id. */
+      flow_id?: string | null;
+      /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+   */
+      metadata?: {
+        /** Observed HTTP requestor context on Path A request.api only. */
+        client?: {
+          /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */
+          ip?: string;
+          /** Observed User-Agent header. */
+          user_agent?: string;
+          /** Origin header when present. */
+          origin?: string;
+        };
+        [key: string]: unknown;
+      };
+    } & {
+      event_type: "user.deleted";
+      /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+   */
+      payload: { [key: string]: unknown };
+    });