@centrali-io/centrali-sdk 6.9.0 → 6.10.0

package/dist/index.d.ts

@@ -743,6 +743,39 @@ interface RealtimeOrchestrationRunEvent {
     /** ISO timestamp when the event occurred */
     timestamp: string;
 }
+/**
+ * Projection source tables for unified Event Log entries.
+ */
+type EventLogSourceTable = 'inbound_events' | 'record_change_log' | 'webhook_deliveries';
+/**
+ * Unified Event Log entry from the realtime service (CEN-1302 Part B).
+ *
+ * Metadata only — mirrors the Tier-1 projection's metadata view. It carries no
+ * event payload/body; fetch full payloads via the Event Log query / get-event
+ * endpoints. Delivered on the opt-in `eventlog` stream.
+ *
+ * Matches: services/backend/realtime/internal/redis/message.go EventLogEntry
+ */
+interface RealtimeEventLogEntry {
+    /** Projection discriminator, e.g. "inbound.http_trigger", "record.created", "outbound.webhook_delivery" */
+    eventType: string;
+    /** Projection source table */
+    sourceTable: EventLogSourceTable;
+    /** Source row id (matches the projection's sourceId) */
+    sourceId: string;
+    /** Workspace slug */
+    workspaceSlug: string;
+    /** Lineage chain id; empty/absent when the source row has none */
+    correlationId?: string;
+    /** 0 = inbound (host clock), 1 = record/webhook (DB clock) */
+    clockTier: 0 | 1;
+    /** Dead-letter marker (outbound deliveries); false otherwise */
+    dlq: boolean;
+    /** Inbound trigger id for per-integration scoping; empty/absent otherwise */
+    triggerId?: string;
+    /** ISO timestamp when the source event occurred */
+    timestamp: string;
+}
 /**
  * Close event payload from the realtime service.
  */
@@ -789,6 +822,21 @@ interface RealtimeSubscribeOptions {
     orchestrationId?: string;
     /** Filter orchestration events to a specific run ID */
     runId?: string;
+    /**
+     * Streams to subscribe to (records / compute / orchestration / eventlog).
+     * Empty defaults to the legacy {records, compute, orchestration} set; the
+     * unified Event Log stream is opt-in. Prefer subscribeEventLog() over
+     * setting this directly. (CEN-1302 Part B)
+     */
+    streams?: string[];
+    /** Event Log source-table filter (used with streams=['eventlog']) */
+    sources?: EventLogSourceTable[];
+    /** Event Log lineage-chain filter */
+    correlationId?: string;
+    /** Event Log inbound-trigger filter */
+    triggerId?: string;
+    /** Event Log dead-letter filter (true = DLQ only, false = non-DLQ only) */
+    dlq?: boolean;
     /** Callback for record events */
     onEvent: (event: RealtimeEvent) => void;
     /** Callback for errors */
@@ -798,6 +846,29 @@ interface RealtimeSubscribeOptions {
     /** Callback when disconnected */
     onDisconnected?: (reason?: string) => void;
 }
+/**
+ * Options for subscribing to the unified Event Log stream (CEN-1302 Part B).
+ */
+interface EventLogSubscribeOptions {
+    /** Filter to these projection source tables. Empty = all sources */
+    sources?: EventLogSourceTable[];
+    /** Filter to these eventType discriminators (e.g. ["inbound.http_trigger"]). Empty = all */
+    eventTypes?: string[];
+    /** Filter to a single lineage chain */
+    correlationId?: string;
+    /** Filter to a single inbound trigger */
+    triggerId?: string;
+    /** Filter by dead-letter state (true = DLQ only, false = non-DLQ only) */
+    dlq?: boolean;
+    /** Callback for Event Log entries */
+    onEvent: (entry: RealtimeEventLogEntry) => void;
+    /** Callback for errors */
+    onError?: (error: RealtimeError) => void;
+    /** Callback when connected */
+    onConnected?: () => void;
+    /** Callback when disconnected */
+    onDisconnected?: (reason?: string) => void;
+}
 /**
  * Realtime subscription handle returned by subscribe().
  */
@@ -2868,7 +2939,7 @@ interface AddAllowedDomainOptions {
 /**
  * Capabilities that can be encoded into an embed token.
  *
- * - `events:read` — list + retrieve event-log rows for the tenant.
+ * - `events:read` — list + retrieve the workspace's event-log rows.
  *   IAM unconditionally injects this on every minted token, so omitting
  *   `capabilities` is equivalent to `['events:read']`.
  * - `events:replay` — allow the iframe to replay a failed delivery. The
@@ -2876,13 +2947,6 @@ interface AddAllowedDomainOptions {
  */
 type EmbedCapability = 'events:read' | 'events:replay';
 interface IssueEmbedTokenInput {
-    /**
-     * Tenant id the embed is allowed to read. Burned into the token claim;
-     * the data-service auto-injects this as a filter on every query the
-     * iframe makes. Centrali never interprets the bytes — treat it as
-     * opaque (1-255 chars).
-     */
-    tenantId: string;
     /**
      * Defaults to `['events:read']`. Pass `['events:read', 'events:replay']`
      * to allow the iframe's "Replay" action. The issuing service account
@@ -2964,6 +3028,22 @@ declare class RealtimeManager {
      * @returns Subscription handle with unsubscribe() method
      */
     subscribe(options: RealtimeSubscribeOptions): RealtimeSubscription;
+    /**
+     * Subscribe to the unified Event Log stream (CEN-1302 Part B).
+     *
+     * Delivers metadata-only {@link RealtimeEventLogEntry} rows for the three
+     * Tier-1 projection sources (inbound, record-change, outbound delivery) on
+     * the opt-in `eventlog` stream — never mixed with raw record/compute/
+     * orchestration events. Entries match the shape the Event Log console list
+     * renders, so they can be prepended without translation.
+     *
+     * Like {@link subscribe}, this delivers only new entries after connect; load
+     * the historical page via the Event Log query endpoint first, then prepend.
+     *
+     * @param options - Event Log subscription options
+     * @returns Subscription handle with unsubscribe()
+     */
+    subscribeEventLog(options: EventLogSubscribeOptions): RealtimeSubscription;
 }
 
 declare class OrchestrationsManager {
@@ -5280,12 +5360,12 @@ interface EmbedManagerOptions {
  * @example
  * ```ts
  * const { token, sessionId, expiresAt } = await client.embed.eventLog.issueToken({
- *   tenantId: customerOrgId,
  *   capabilities: ['events:read', 'events:replay'],
  *   ttlSeconds: 900,
  * });
  *
- * // Render in your frontend:
+ * // The token is workspace-scoped (it exposes the whole workspace's event
+ * // log), so render it only in your own internal/admin tooling.
  * // <iframe src={`https://embed.centrali.io/v1/event-log#token=${token}&o=${origin}`} />
  *
  * // On user logout:
@@ -5314,7 +5394,7 @@ declare class EventLogEmbed {
      * Mint a short-lived `ev_…` embed token. Hand the result to your
      * frontend and drop it into the iframe URL fragment as `#token=…&o=…`.
      */
-    issueToken(input: IssueEmbedTokenInput): Promise<IssueEmbedTokenResult>;
+    issueToken(input?: IssueEmbedTokenInput): Promise<IssueEmbedTokenResult>;
     /**
      * Revoke an embed session (typically tied to your user's logout).
      * Every embed token carrying this `sessionId` is rejected by
@@ -6282,4 +6362,4 @@ declare class CentraliSDK {
     checkAuthorization(options: CheckAuthorizationOptions): Promise<ApiResponse<AuthorizationResult>>;
 }
 
-export { type AcceptSuggestionResult, type AddAllowedDomainOptions, type AllowedDomain, type AllowedDomainsListResponse, AllowedDomainsManager, type AnomalyAnalysisResult, type AnomalyDetectionData, type AnomalyEventType, type AnomalyInsight, type AnomalyInsightData, AnomalyInsightsManager, type ApiResponse, type ArrayPropertyDefinition, AuditLogManager, type AuthorizationResult, type BasePropertyDefinition, type BatchScanResult, type BatchScanStatus, type BooleanPropertyDefinition, type BulkOperationResult, CANONICAL_OPERATORS, type CanonicalOperator, CentraliError, CentraliSDK, type CentraliSDKOptions, type CheckAuthorizationOptions, CollectionsManager, type ComputeEventType, type ComputeFunction, ComputeFunctionsManager, type ComputeJobStatus, type ComputeJobStatusResponse, type ConditionOperator, type CreateComputeFunctionInput, type CreateOrchestrationInput, type CreateSmartQueryInput, type CreateStructureInput, type CreateTriggerInput, type CreateWebhookSubscriptionInput, type DateTimePropertyDefinition, type DateWindowOption, type DeleteRecordOptions, type EmbedCapability, EmbedManager, type EndpointResponse, EventLogEmbed, type ExecuteSavedQueryValues, type ExecuteSmartQueryOptions, type ExpandOptions, type FieldCondition, type FieldConditionMap, type FileMetadata, FilesManager, type FilterOperators, type FilterValue, type FunctionMemoryUsage, type FunctionRun, type FunctionRunError, type FunctionRunExecutionSource, type FunctionRunStatus, FunctionRunsManager, type FunctionTrigger, type GetRecordOptions, type IncludeClause, type InsightSeverity, type InsightStatus, type InsightType, type InsightsSummary, type InvokeEndpointOptions, type InvokeTriggerOptions, type IssueEmbedTokenInput, type IssueEmbedTokenResult, JOINS_MAX_LENGTH, type JoinClause, type JoinType, type LegacyTranslateOptions, type LegacyTranslateResult, type LegacyTranslateWarning, type ListAllTriggersOptions, type ListCollectionsOptions, type ListComputeFunctionsOptions, type ListFunctionRunsOptions, type ListInsightsOptions, type ListOrchestrationRunsOptions, type ListOrchestrationsOptions, type ListSmartQueryOptions, type ListStructuresOptions, type ListValidationSuggestionsOptions, type ListWebhookDeliveriesOptions, type NumberPropertyDefinition, OPERATOR_METADATA, type ObjectPropertyDefinition, type OperatorMeta, type OperatorTypeApplicability, type OperatorValueShape, type Orchestration, type OrchestrationCaseEvaluation, type OrchestrationCondition, type OrchestrationConditionEvaluation, type OrchestrationDecisionCase, type OrchestrationDecisionResult, type OrchestrationDelayConfig, type OrchestrationEventType, type OrchestrationFailureReason, type OrchestrationOnFailure, type OrchestrationOnSuccess, type OrchestrationRetryConfig, type OrchestrationRun, type OrchestrationRunStatus, type OrchestrationRunStep, OrchestrationRunsManager, type OrchestrationScheduleType, type OrchestrationStatus, type OrchestrationStep, type OrchestrationStepError, type OrchestrationStepStatus, type OrchestrationStepType, type OrchestrationTrigger, type OrchestrationTriggerMetadata, type OrchestrationTriggerType, OrchestrationsManager, type PageClause, type PaginatedResponse, type ParsedUrlQuery, type PropertyDefinition, type PropertyType, type QueryDefinition, type QueryError, type QueryErrorCode, type QueryExecutionMode, type QueryHttpError, type QueryHttpErrorCode, QueryManager, type QueryRecordOptions, type QueryResult, type QueryResultMeta, type QueryValidateOptions, type QueryVariableDefinition, RECORDS_PAGE_DEFAULT_LIMIT, RECORDS_PAGE_MAX_LIMIT, type RealtimeAnomalyDetectionEvent, type RealtimeAnomalyInsightEvent, type RealtimeCloseEvent, type RealtimeError, type RealtimeEvent, type RealtimeEventType, type RealtimeFunctionRunEvent, RealtimeManager, type RealtimeOrchestrationRunEvent, type RealtimeRecordEvent, type RealtimeSubscribeOptions, type RealtimeSubscription, type RealtimeValidationBatchEvent, type RealtimeValidationSuggestionEvent, type RecordEventType, RecordEvents, type RecordTtlOptions, RecordsManager, type ReferencePropertyDefinition, type ResourceCategory, type RevokeEmbedSessionInput, type RevokeEmbedSessionResult, type SavedQueryDefinition, type SavedQueryScalarBinding, type ScalarValue, type SchemaDiscoveryMode, type SearchHit, type SearchOptions, type SearchResponse, type SelectClause, SmartQueriesManager, type SmartQuery, type SmartQueryDefinition, type SmartQueryExecuteResult, type SmartQueryFieldCondition, type SmartQueryJoin, type SmartQuerySort, type SmartQueryWhereClause, type SortClause, type StepEncryptedParam, type StringPropertyDefinition, type Structure, StructuresManager, type TestComputeFunctionInput, type TestComputeFunctionResult, type TestSmartQueryInput, type TextSearchClause, type TriggerExecutionType, type TriggerHealthMetrics, type TriggerHealthStatus, type TriggerInvokeResponse, type TriggerOrchestrationRunOptions, type TriggerScanOptions, type TriggerWithHealth, TriggersManager, type UpdateComputeFunctionInput, type UpdateOrchestrationInput, type UpdateSmartQueryInput, type UpdateStructureInput, type UpdateTriggerInput, type UpdateWebhookSubscriptionInput, type UrlParserOptions, type ValidateStructureInput, type ValidationBatchData, type ValidationEventType, type ValidationIssueType, ValidationManager, type ValidationResult, type ValidationSuggestion, type ValidationSuggestionData, type ValidationSuggestionStatus, type ValidationSummary, type VariableType, type WaitForScanOptions, type WebhookCancelResponse, type WebhookDeliveriesListMeta, type WebhookDelivery, type WebhookDeliveryStatus, type WebhookDeliverySummary, type WebhookPayloadVersions, type WebhookReplayResponse, type WebhookSubscription, WebhookSubscriptionsManager, type WhereExpression, fetchClientToken, getAllowedDomainsApiPath, getAnomalyAnalysisTriggerApiPath, getAnomalyInsightAcknowledgeApiPath, getAnomalyInsightDismissApiPath, getAnomalyInsightsApiPath, getAnomalyInsightsBulkAcknowledgeApiPath, getAnomalyInsightsSummaryApiPath, getApiUrl, getAuthUrl, getCollectionBySlugApiPath, getCollectionInsightsApiPath, getCollectionValidateApiPath, getCollectionsApiPath, getComputeFunctionTestApiPath, getComputeFunctionsApiPath, getComputeJobStatusApiPath, getEndpointApiPath, getFileUploadApiPath, getFilesCanonicalApiPath, getFunctionRunsApiPath, getFunctionRunsByFunctionApiPath, getFunctionRunsByTriggerApiPath, getFunctionTriggerExecuteApiPath, getFunctionTriggerPauseApiPath, getFunctionTriggerResumeApiPath, getFunctionTriggersApiPath, getOrchestrationRunStepsApiPath, getOrchestrationRunsApiPath, getOrchestrationRunsCanonicalApiPath, getOrchestrationsApiPath, getRealtimeUrl, getRecordApiPath, getSavedQueryCanonicalByIdPath, getSavedQueryCanonicalCollectionPath, getSavedQueryCanonicalExecutePath, getSavedQueryCanonicalTestPath, getSearchApiPath, getSmartQueriesApiPath, getSmartQueriesStructureApiPath, getSmartQueryByNameApiPath, getSmartQueryExecuteApiPath, getSmartQueryTestApiPath, getStructureBySlugApiPath, getStructureInsightsApiPath, getStructureValidateApiPath, getStructuresApiPath, getValidationBulkAcceptApiPath, getValidationBulkRejectApiPath, getValidationPendingCountApiPath, getValidationRecordSuggestionsApiPath, getValidationScanApiPath, getValidationSuggestionAcceptApiPath, getValidationSuggestionRejectApiPath, getValidationSuggestionsApiPath, getValidationSummaryApiPath, getWebhookDeliveryCancelApiPath, getWebhookDeliveryRetryApiPath, getWebhookPayloadVersionsApiPath, getWebhookSubscriptionDeliveriesApiPath, getWebhookSubscriptionRotateSecretApiPath, getWebhookSubscriptionsApiPath, isCentraliError, operatorsForFieldType };
+export { type AcceptSuggestionResult, type AddAllowedDomainOptions, type AllowedDomain, type AllowedDomainsListResponse, AllowedDomainsManager, type AnomalyAnalysisResult, type AnomalyDetectionData, type AnomalyEventType, type AnomalyInsight, type AnomalyInsightData, AnomalyInsightsManager, type ApiResponse, type ArrayPropertyDefinition, AuditLogManager, type AuthorizationResult, type BasePropertyDefinition, type BatchScanResult, type BatchScanStatus, type BooleanPropertyDefinition, type BulkOperationResult, CANONICAL_OPERATORS, type CanonicalOperator, CentraliError, CentraliSDK, type CentraliSDKOptions, type CheckAuthorizationOptions, CollectionsManager, type ComputeEventType, type ComputeFunction, ComputeFunctionsManager, type ComputeJobStatus, type ComputeJobStatusResponse, type ConditionOperator, type CreateComputeFunctionInput, type CreateOrchestrationInput, type CreateSmartQueryInput, type CreateStructureInput, type CreateTriggerInput, type CreateWebhookSubscriptionInput, type DateTimePropertyDefinition, type DateWindowOption, type DeleteRecordOptions, type EmbedCapability, EmbedManager, type EndpointResponse, EventLogEmbed, type EventLogSourceTable, type EventLogSubscribeOptions, type ExecuteSavedQueryValues, type ExecuteSmartQueryOptions, type ExpandOptions, type FieldCondition, type FieldConditionMap, type FileMetadata, FilesManager, type FilterOperators, type FilterValue, type FunctionMemoryUsage, type FunctionRun, type FunctionRunError, type FunctionRunExecutionSource, type FunctionRunStatus, FunctionRunsManager, type FunctionTrigger, type GetRecordOptions, type IncludeClause, type InsightSeverity, type InsightStatus, type InsightType, type InsightsSummary, type InvokeEndpointOptions, type InvokeTriggerOptions, type IssueEmbedTokenInput, type IssueEmbedTokenResult, JOINS_MAX_LENGTH, type JoinClause, type JoinType, type LegacyTranslateOptions, type LegacyTranslateResult, type LegacyTranslateWarning, type ListAllTriggersOptions, type ListCollectionsOptions, type ListComputeFunctionsOptions, type ListFunctionRunsOptions, type ListInsightsOptions, type ListOrchestrationRunsOptions, type ListOrchestrationsOptions, type ListSmartQueryOptions, type ListStructuresOptions, type ListValidationSuggestionsOptions, type ListWebhookDeliveriesOptions, type NumberPropertyDefinition, OPERATOR_METADATA, type ObjectPropertyDefinition, type OperatorMeta, type OperatorTypeApplicability, type OperatorValueShape, type Orchestration, type OrchestrationCaseEvaluation, type OrchestrationCondition, type OrchestrationConditionEvaluation, type OrchestrationDecisionCase, type OrchestrationDecisionResult, type OrchestrationDelayConfig, type OrchestrationEventType, type OrchestrationFailureReason, type OrchestrationOnFailure, type OrchestrationOnSuccess, type OrchestrationRetryConfig, type OrchestrationRun, type OrchestrationRunStatus, type OrchestrationRunStep, OrchestrationRunsManager, type OrchestrationScheduleType, type OrchestrationStatus, type OrchestrationStep, type OrchestrationStepError, type OrchestrationStepStatus, type OrchestrationStepType, type OrchestrationTrigger, type OrchestrationTriggerMetadata, type OrchestrationTriggerType, OrchestrationsManager, type PageClause, type PaginatedResponse, type ParsedUrlQuery, type PropertyDefinition, type PropertyType, type QueryDefinition, type QueryError, type QueryErrorCode, type QueryExecutionMode, type QueryHttpError, type QueryHttpErrorCode, QueryManager, type QueryRecordOptions, type QueryResult, type QueryResultMeta, type QueryValidateOptions, type QueryVariableDefinition, RECORDS_PAGE_DEFAULT_LIMIT, RECORDS_PAGE_MAX_LIMIT, type RealtimeAnomalyDetectionEvent, type RealtimeAnomalyInsightEvent, type RealtimeCloseEvent, type RealtimeError, type RealtimeEvent, type RealtimeEventLogEntry, type RealtimeEventType, type RealtimeFunctionRunEvent, RealtimeManager, type RealtimeOrchestrationRunEvent, type RealtimeRecordEvent, type RealtimeSubscribeOptions, type RealtimeSubscription, type RealtimeValidationBatchEvent, type RealtimeValidationSuggestionEvent, type RecordEventType, RecordEvents, type RecordTtlOptions, RecordsManager, type ReferencePropertyDefinition, type ResourceCategory, type RevokeEmbedSessionInput, type RevokeEmbedSessionResult, type SavedQueryDefinition, type SavedQueryScalarBinding, type ScalarValue, type SchemaDiscoveryMode, type SearchHit, type SearchOptions, type SearchResponse, type SelectClause, SmartQueriesManager, type SmartQuery, type SmartQueryDefinition, type SmartQueryExecuteResult, type SmartQueryFieldCondition, type SmartQueryJoin, type SmartQuerySort, type SmartQueryWhereClause, type SortClause, type StepEncryptedParam, type StringPropertyDefinition, type Structure, StructuresManager, type TestComputeFunctionInput, type TestComputeFunctionResult, type TestSmartQueryInput, type TextSearchClause, type TriggerExecutionType, type TriggerHealthMetrics, type TriggerHealthStatus, type TriggerInvokeResponse, type TriggerOrchestrationRunOptions, type TriggerScanOptions, type TriggerWithHealth, TriggersManager, type UpdateComputeFunctionInput, type UpdateOrchestrationInput, type UpdateSmartQueryInput, type UpdateStructureInput, type UpdateTriggerInput, type UpdateWebhookSubscriptionInput, type UrlParserOptions, type ValidateStructureInput, type ValidationBatchData, type ValidationEventType, type ValidationIssueType, ValidationManager, type ValidationResult, type ValidationSuggestion, type ValidationSuggestionData, type ValidationSuggestionStatus, type ValidationSummary, type VariableType, type WaitForScanOptions, type WebhookCancelResponse, type WebhookDeliveriesListMeta, type WebhookDelivery, type WebhookDeliveryStatus, type WebhookDeliverySummary, type WebhookPayloadVersions, type WebhookReplayResponse, type WebhookSubscription, WebhookSubscriptionsManager, type WhereExpression, fetchClientToken, getAllowedDomainsApiPath, getAnomalyAnalysisTriggerApiPath, getAnomalyInsightAcknowledgeApiPath, getAnomalyInsightDismissApiPath, getAnomalyInsightsApiPath, getAnomalyInsightsBulkAcknowledgeApiPath, getAnomalyInsightsSummaryApiPath, getApiUrl, getAuthUrl, getCollectionBySlugApiPath, getCollectionInsightsApiPath, getCollectionValidateApiPath, getCollectionsApiPath, getComputeFunctionTestApiPath, getComputeFunctionsApiPath, getComputeJobStatusApiPath, getEndpointApiPath, getFileUploadApiPath, getFilesCanonicalApiPath, getFunctionRunsApiPath, getFunctionRunsByFunctionApiPath, getFunctionRunsByTriggerApiPath, getFunctionTriggerExecuteApiPath, getFunctionTriggerPauseApiPath, getFunctionTriggerResumeApiPath, getFunctionTriggersApiPath, getOrchestrationRunStepsApiPath, getOrchestrationRunsApiPath, getOrchestrationRunsCanonicalApiPath, getOrchestrationsApiPath, getRealtimeUrl, getRecordApiPath, getSavedQueryCanonicalByIdPath, getSavedQueryCanonicalCollectionPath, getSavedQueryCanonicalExecutePath, getSavedQueryCanonicalTestPath, getSearchApiPath, getSmartQueriesApiPath, getSmartQueriesStructureApiPath, getSmartQueryByNameApiPath, getSmartQueryExecuteApiPath, getSmartQueryTestApiPath, getStructureBySlugApiPath, getStructureInsightsApiPath, getStructureValidateApiPath, getStructuresApiPath, getValidationBulkAcceptApiPath, getValidationBulkRejectApiPath, getValidationPendingCountApiPath, getValidationRecordSuggestionsApiPath, getValidationScanApiPath, getValidationSuggestionAcceptApiPath, getValidationSuggestionRejectApiPath, getValidationSuggestionsApiPath, getValidationSummaryApiPath, getWebhookDeliveryCancelApiPath, getWebhookDeliveryRetryApiPath, getWebhookPayloadVersionsApiPath, getWebhookSubscriptionDeliveriesApiPath, getWebhookSubscriptionRotateSecretApiPath, getWebhookSubscriptionsApiPath, isCentraliError, operatorsForFieldType };

package/dist/index.js

@@ -619,7 +619,7 @@ var RealtimeManager = class {
     let reconnectAttempt = 0;
     let reconnectTimeout = null;
     const connect = () => __async(this, null, function* () {
-      var _a, _b, _c, _d, _e;
+      var _a, _b, _c, _d, _e, _f, _g;
       if (unsubscribed) {
         return;
       }
@@ -664,6 +664,21 @@ var RealtimeManager = class {
         if (options.runId) {
           url.searchParams.set("runId", options.runId);
         }
+        if ((_e = options.streams) == null ? void 0 : _e.length) {
+          url.searchParams.set("streams", options.streams.join(","));
+        }
+        if ((_f = options.sources) == null ? void 0 : _f.length) {
+          url.searchParams.set("sources", options.sources.join(","));
+        }
+        if (options.correlationId) {
+          url.searchParams.set("correlationId", options.correlationId);
+        }
+        if (options.triggerId) {
+          url.searchParams.set("triggerId", options.triggerId);
+        }
+        if (options.dlq !== void 0) {
+          url.searchParams.set("dlq", String(options.dlq));
+        }
         eventSource = new EventSourceImpl(url.toString());
         eventSource.onopen = () => {
           var _a2;
@@ -720,7 +735,7 @@ var RealtimeManager = class {
           scheduleReconnect();
         };
       } catch (err) {
-        (_e = options.onError) == null ? void 0 : _e.call(options, {
+        (_g = options.onError) == null ? void 0 : _g.call(options, {
           code: "CONNECTION_ERROR",
           message: `Failed to connect: ${err}`,
           recoverable: true
@@ -770,6 +785,36 @@ var RealtimeManager = class {
       }
     };
   }
+  /**
+   * Subscribe to the unified Event Log stream (CEN-1302 Part B).
+   *
+   * Delivers metadata-only {@link RealtimeEventLogEntry} rows for the three
+   * Tier-1 projection sources (inbound, record-change, outbound delivery) on
+   * the opt-in `eventlog` stream — never mixed with raw record/compute/
+   * orchestration events. Entries match the shape the Event Log console list
+   * renders, so they can be prepended without translation.
+   *
+   * Like {@link subscribe}, this delivers only new entries after connect; load
+   * the historical page via the Event Log query endpoint first, then prepend.
+   *
+   * @param options - Event Log subscription options
+   * @returns Subscription handle with unsubscribe()
+   */
+  subscribeEventLog(options) {
+    return this.subscribe({
+      streams: ["eventlog"],
+      sources: options.sources,
+      // eventType filtering reuses the shared `events` query param server-side.
+      events: options.eventTypes,
+      correlationId: options.correlationId,
+      triggerId: options.triggerId,
+      dlq: options.dlq,
+      onEvent: (event) => options.onEvent(event),
+      onError: options.onError,
+      onConnected: options.onConnected,
+      onDisconnected: options.onDisconnected
+    });
+  }
 };
 
 // src/managers/orchestrations.ts
@@ -8065,8 +8110,8 @@ var EventLogEmbed = class {
    * Mint a short-lived `ev_…` embed token. Hand the result to your
    * frontend and drop it into the iframe URL fragment as `#token=…&o=…`.
    */
-  issueToken(input) {
-    return __async(this, null, function* () {
+  issueToken() {
+    return __async(this, arguments, function* (input = {}) {
       const path = `/workspace/${this.workspaceId}/embed/event-log/issue-token`;
       return this.postWithIamToken(path, this.serializeIssueBody(input));
     });
@@ -8083,7 +8128,7 @@ var EventLogEmbed = class {
     });
   }
   serializeIssueBody(input) {
-    const body = { tenantId: input.tenantId };
+    const body = {};
     if (input.capabilities) body.capabilities = input.capabilities;
     if (input.sessionId) body.sessionId = input.sessionId;
     if (input.ttlSeconds !== void 0) body.ttlSeconds = input.ttlSeconds;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@centrali-io/centrali-sdk",
-  "version": "6.9.0",
+  "version": "6.10.0",
   "description": "Centrali Node SDK",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/managers/embed.ts

@@ -47,12 +47,12 @@ interface EmbedManagerOptions {
  * @example
  * ```ts
  * const { token, sessionId, expiresAt } = await client.embed.eventLog.issueToken({
- *   tenantId: customerOrgId,
  *   capabilities: ['events:read', 'events:replay'],
  *   ttlSeconds: 900,
  * });
  *
- * // Render in your frontend:
+ * // The token is workspace-scoped (it exposes the whole workspace's event
+ * // log), so render it only in your own internal/admin tooling.
  * // <iframe src={`https://embed.centrali.io/v1/event-log#token=${token}&o=${origin}`} />
  *
  * // On user logout:
@@ -107,7 +107,7 @@ export class EventLogEmbed {
      * Mint a short-lived `ev_…` embed token. Hand the result to your
      * frontend and drop it into the iframe URL fragment as `#token=…&o=…`.
      */
-    public async issueToken(input: IssueEmbedTokenInput): Promise<IssueEmbedTokenResult> {
+    public async issueToken(input: IssueEmbedTokenInput = {}): Promise<IssueEmbedTokenResult> {
         const path = `/workspace/${this.workspaceId}/embed/event-log/issue-token`;
         return this.postWithIamToken<IssueEmbedTokenResult>(path, this.serializeIssueBody(input));
     }
@@ -123,7 +123,7 @@ export class EventLogEmbed {
     }
 
     private serializeIssueBody(input: IssueEmbedTokenInput): Record<string, unknown> {
-        const body: Record<string, unknown> = { tenantId: input.tenantId };
+        const body: Record<string, unknown> = {};
         if (input.capabilities) body.capabilities = input.capabilities;
         if (input.sessionId) body.sessionId = input.sessionId;
         if (input.ttlSeconds !== undefined) body.ttlSeconds = input.ttlSeconds;

package/src/realtime/manager.ts

@@ -6,6 +6,9 @@ import type {
     RealtimeSubscription,
     RealtimeRecordEvent,
     RealtimeCloseEvent,
+    EventLogSubscribeOptions,
+    RealtimeEventLogEntry,
+    RealtimeEvent,
 } from '../types/realtime';
 
 // Use native EventSource in browser, polyfill in Node.js
@@ -158,6 +161,23 @@ export class RealtimeManager {
                     url.searchParams.set('runId', options.runId);
                 }
 
+                // Add stream selection + Event Log filters (CEN-1302 Part B)
+                if (options.streams?.length) {
+                    url.searchParams.set('streams', options.streams.join(','));
+                }
+                if (options.sources?.length) {
+                    url.searchParams.set('sources', options.sources.join(','));
+                }
+                if (options.correlationId) {
+                    url.searchParams.set('correlationId', options.correlationId);
+                }
+                if (options.triggerId) {
+                    url.searchParams.set('triggerId', options.triggerId);
+                }
+                if (options.dlq !== undefined) {
+                    url.searchParams.set('dlq', String(options.dlq));
+                }
+
                 // Create EventSource (uses polyfill in Node.js)
                 eventSource = new EventSourceImpl(url.toString());
 
@@ -289,4 +309,36 @@ export class RealtimeManager {
             },
         };
     }
+
+    /**
+     * Subscribe to the unified Event Log stream (CEN-1302 Part B).
+     *
+     * Delivers metadata-only {@link RealtimeEventLogEntry} rows for the three
+     * Tier-1 projection sources (inbound, record-change, outbound delivery) on
+     * the opt-in `eventlog` stream — never mixed with raw record/compute/
+     * orchestration events. Entries match the shape the Event Log console list
+     * renders, so they can be prepended without translation.
+     *
+     * Like {@link subscribe}, this delivers only new entries after connect; load
+     * the historical page via the Event Log query endpoint first, then prepend.
+     *
+     * @param options - Event Log subscription options
+     * @returns Subscription handle with unsubscribe()
+     */
+    public subscribeEventLog(options: EventLogSubscribeOptions): RealtimeSubscription {
+        return this.subscribe({
+            streams: ['eventlog'],
+            sources: options.sources,
+            // eventType filtering reuses the shared `events` query param server-side.
+            events: options.eventTypes as RealtimeSubscribeOptions['events'],
+            correlationId: options.correlationId,
+            triggerId: options.triggerId,
+            dlq: options.dlq,
+            onEvent: (event: RealtimeEvent) =>
+                options.onEvent(event as unknown as RealtimeEventLogEntry),
+            onError: options.onError,
+            onConnected: options.onConnected,
+            onDisconnected: options.onDisconnected,
+        });
+    }
 }

package/src/types/embed.ts

@@ -9,7 +9,7 @@
 /**
  * Capabilities that can be encoded into an embed token.
  *
- * - `events:read` — list + retrieve event-log rows for the tenant.
+ * - `events:read` — list + retrieve the workspace's event-log rows.
  *   IAM unconditionally injects this on every minted token, so omitting
  *   `capabilities` is equivalent to `['events:read']`.
  * - `events:replay` — allow the iframe to replay a failed delivery. The
@@ -18,14 +18,6 @@
 export type EmbedCapability = 'events:read' | 'events:replay';
 
 export interface IssueEmbedTokenInput {
-    /**
-     * Tenant id the embed is allowed to read. Burned into the token claim;
-     * the data-service auto-injects this as a filter on every query the
-     * iframe makes. Centrali never interprets the bytes — treat it as
-     * opaque (1-255 chars).
-     */
-    tenantId: string;
-
     /**
      * Defaults to `['events:read']`. Pass `['events:read', 'events:replay']`
      * to allow the iframe's "Replay" action. The issuing service account

package/src/types/realtime.ts

@@ -332,6 +332,41 @@ export interface RealtimeOrchestrationRunEvent {
     timestamp: string;
 }
 
+/**
+ * Projection source tables for unified Event Log entries.
+ */
+export type EventLogSourceTable = 'inbound_events' | 'record_change_log' | 'webhook_deliveries';
+
+/**
+ * Unified Event Log entry from the realtime service (CEN-1302 Part B).
+ *
+ * Metadata only — mirrors the Tier-1 projection's metadata view. It carries no
+ * event payload/body; fetch full payloads via the Event Log query / get-event
+ * endpoints. Delivered on the opt-in `eventlog` stream.
+ *
+ * Matches: services/backend/realtime/internal/redis/message.go EventLogEntry
+ */
+export interface RealtimeEventLogEntry {
+    /** Projection discriminator, e.g. "inbound.http_trigger", "record.created", "outbound.webhook_delivery" */
+    eventType: string;
+    /** Projection source table */
+    sourceTable: EventLogSourceTable;
+    /** Source row id (matches the projection's sourceId) */
+    sourceId: string;
+    /** Workspace slug */
+    workspaceSlug: string;
+    /** Lineage chain id; empty/absent when the source row has none */
+    correlationId?: string;
+    /** 0 = inbound (host clock), 1 = record/webhook (DB clock) */
+    clockTier: 0 | 1;
+    /** Dead-letter marker (outbound deliveries); false otherwise */
+    dlq: boolean;
+    /** Inbound trigger id for per-integration scoping; empty/absent otherwise */
+    triggerId?: string;
+    /** ISO timestamp when the source event occurred */
+    timestamp: string;
+}
+
 /**
  * Close event payload from the realtime service.
  */
@@ -381,6 +416,21 @@ export interface RealtimeSubscribeOptions {
     orchestrationId?: string;
     /** Filter orchestration events to a specific run ID */
     runId?: string;
+    /**
+     * Streams to subscribe to (records / compute / orchestration / eventlog).
+     * Empty defaults to the legacy {records, compute, orchestration} set; the
+     * unified Event Log stream is opt-in. Prefer subscribeEventLog() over
+     * setting this directly. (CEN-1302 Part B)
+     */
+    streams?: string[];
+    /** Event Log source-table filter (used with streams=['eventlog']) */
+    sources?: EventLogSourceTable[];
+    /** Event Log lineage-chain filter */
+    correlationId?: string;
+    /** Event Log inbound-trigger filter */
+    triggerId?: string;
+    /** Event Log dead-letter filter (true = DLQ only, false = non-DLQ only) */
+    dlq?: boolean;
     /** Callback for record events */
     onEvent: (event: RealtimeEvent) => void;
     /** Callback for errors */
@@ -391,6 +441,30 @@ export interface RealtimeSubscribeOptions {
     onDisconnected?: (reason?: string) => void;
 }
 
+/**
+ * Options for subscribing to the unified Event Log stream (CEN-1302 Part B).
+ */
+export interface EventLogSubscribeOptions {
+    /** Filter to these projection source tables. Empty = all sources */
+    sources?: EventLogSourceTable[];
+    /** Filter to these eventType discriminators (e.g. ["inbound.http_trigger"]). Empty = all */
+    eventTypes?: string[];
+    /** Filter to a single lineage chain */
+    correlationId?: string;
+    /** Filter to a single inbound trigger */
+    triggerId?: string;
+    /** Filter by dead-letter state (true = DLQ only, false = non-DLQ only) */
+    dlq?: boolean;
+    /** Callback for Event Log entries */
+    onEvent: (entry: RealtimeEventLogEntry) => void;
+    /** Callback for errors */
+    onError?: (error: RealtimeError) => void;
+    /** Callback when connected */
+    onConnected?: () => void;
+    /** Callback when disconnected */
+    onDisconnected?: (reason?: string) => void;
+}
+
 /**
  * Realtime subscription handle returned by subscribe().
  */