@kici-dev/engine 0.0.0 → 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (129) hide show
  1. package/LICENSE +661 -0
  2. package/README.md +1 -6
  3. package/dist/audit/access-log-policy.d.ts +97 -0
  4. package/dist/audit/access-log-policy.js +195 -0
  5. package/dist/audit/activity.d.ts +156 -0
  6. package/dist/audit/activity.js +175 -0
  7. package/dist/audit/retention-policy.d.ts +157 -0
  8. package/dist/audit/retention-policy.js +364 -0
  9. package/dist/bundler/index.d.ts +3 -0
  10. package/dist/bundler/index.js +3 -0
  11. package/dist/bundler/rolldown-config.d.ts +41 -0
  12. package/dist/bundler/rolldown-config.js +40 -0
  13. package/dist/chunk-gOLHoazu.js +4 -0
  14. package/dist/env/environment-allowlist.d.ts +45 -0
  15. package/dist/env/environment-allowlist.js +69 -0
  16. package/dist/environment/index.d.ts +3 -0
  17. package/dist/environment/index.js +3 -0
  18. package/dist/environment/scope-resolver.d.ts +35 -0
  19. package/dist/environment/scope-resolver.js +77 -0
  20. package/dist/environment/types.d.ts +98 -0
  21. package/dist/environment/types.js +2 -0
  22. package/dist/index.d.ts +54 -0
  23. package/dist/index.js +45 -0
  24. package/dist/labels.d.ts +106 -0
  25. package/dist/labels.js +162 -0
  26. package/dist/metrics/metric-catalog.generated.d.ts +400 -0
  27. package/dist/metrics/metric-catalog.generated.js +510 -0
  28. package/dist/protocol/dashboard-global-workflows.d.ts +9 -0
  29. package/dist/protocol/dashboard-global-workflows.js +3 -0
  30. package/dist/protocol/event-log-payload.d.ts +16 -0
  31. package/dist/protocol/event-log-payload.js +21 -0
  32. package/dist/protocol/messages/access-log.d.ts +545 -0
  33. package/dist/protocol/messages/access-log.js +175 -0
  34. package/dist/protocol/messages/actor.d.ts +100 -0
  35. package/dist/protocol/messages/actor.js +139 -0
  36. package/dist/protocol/messages/auth.d.ts +25 -0
  37. package/dist/protocol/messages/auth.js +36 -0
  38. package/dist/protocol/messages/browser.d.ts +369 -0
  39. package/dist/protocol/messages/browser.js +225 -0
  40. package/dist/protocol/messages/capabilities.d.ts +46 -0
  41. package/dist/protocol/messages/capabilities.js +42 -0
  42. package/dist/protocol/messages/common.d.ts +53 -0
  43. package/dist/protocol/messages/common.js +55 -0
  44. package/dist/protocol/messages/dashboard-global-workflows.d.ts +166 -0
  45. package/dist/protocol/messages/dashboard-global-workflows.js +80 -0
  46. package/dist/protocol/messages/dashboard.d.ts +4068 -0
  47. package/dist/protocol/messages/dashboard.js +1237 -0
  48. package/dist/protocol/messages/event-log.d.ts +49 -0
  49. package/dist/protocol/messages/event-log.js +45 -0
  50. package/dist/protocol/messages/execution-status.d.ts +164 -0
  51. package/dist/protocol/messages/execution-status.js +166 -0
  52. package/dist/protocol/messages/join.d.ts +18 -0
  53. package/dist/protocol/messages/join.js +28 -0
  54. package/dist/protocol/messages/log-pull.d.ts +27 -0
  55. package/dist/protocol/messages/log-pull.js +36 -0
  56. package/dist/protocol/messages/observe.d.ts +75 -0
  57. package/dist/protocol/messages/observe.js +70 -0
  58. package/dist/protocol/messages/orchestrator-agent.d.ts +606 -0
  59. package/dist/protocol/messages/orchestrator-agent.js +481 -0
  60. package/dist/protocol/messages/peer.d.ts +795 -0
  61. package/dist/protocol/messages/peer.js +372 -0
  62. package/dist/protocol/messages/platform-orchestrator.d.ts +1888 -0
  63. package/dist/protocol/messages/platform-orchestrator.js +379 -0
  64. package/dist/protocol/messages/run-events.d.ts +155 -0
  65. package/dist/protocol/messages/run-events.js +115 -0
  66. package/dist/protocol/messages/saas-orchestrator.d.ts +2179 -0
  67. package/dist/protocol/messages/source-registration.d.ts +103 -0
  68. package/dist/protocol/messages/source-registration.js +109 -0
  69. package/dist/protocol/messages/test-run.d.ts +59 -0
  70. package/dist/protocol/messages/test-run.js +52 -0
  71. package/dist/protocol/version.d.ts +12 -0
  72. package/dist/protocol/version.js +17 -0
  73. package/dist/provider/changed-files-fetcher.d.ts +24 -0
  74. package/dist/provider/changed-files-fetcher.js +2 -0
  75. package/dist/provider/check-run-conclusion.d.ts +15 -0
  76. package/dist/provider/check-run-conclusion.js +19 -0
  77. package/dist/provider/check-status-poster.d.ts +15 -0
  78. package/dist/provider/check-status-poster.js +2 -0
  79. package/dist/provider/clone-token-provider.d.ts +58 -0
  80. package/dist/provider/clone-token-provider.js +2 -0
  81. package/dist/provider/contributor-resolver.d.ts +22 -0
  82. package/dist/provider/contributor-resolver.js +2 -0
  83. package/dist/provider/index.d.ts +23 -0
  84. package/dist/provider/index.js +3 -0
  85. package/dist/provider/lock-file-fetcher.d.ts +24 -0
  86. package/dist/provider/lock-file-fetcher.js +2 -0
  87. package/dist/provider/repo-url-builder.d.ts +35 -0
  88. package/dist/provider/repo-url-builder.js +2 -0
  89. package/dist/provider/types.d.ts +9 -0
  90. package/dist/provider/types.js +2 -0
  91. package/dist/provider/webhook-normalizer.d.ts +163 -0
  92. package/dist/provider/webhook-normalizer.js +2 -0
  93. package/dist/registration/registerable-trigger-type.d.ts +52 -0
  94. package/dist/registration/registerable-trigger-type.js +56 -0
  95. package/dist/scaler/resource-types.d.ts +90 -0
  96. package/dist/scaler/resource-types.js +99 -0
  97. package/dist/scaler/scaler-backend-type.d.ts +16 -0
  98. package/dist/scaler/scaler-backend-type.js +20 -0
  99. package/dist/secrets/index.d.ts +7 -0
  100. package/dist/secrets/index.js +2 -0
  101. package/dist/secrets/types.d.ts +138 -0
  102. package/dist/secrets/types.js +2 -0
  103. package/dist/state-machine/index.d.ts +2 -0
  104. package/dist/state-machine/index.js +3 -0
  105. package/dist/state-machine/machine.d.ts +34 -0
  106. package/dist/state-machine/machine.js +103 -0
  107. package/dist/state-machine/types.d.ts +34 -0
  108. package/dist/state-machine/types.js +15 -0
  109. package/dist/trigger/decision-trace.d.ts +41 -0
  110. package/dist/trigger/decision-trace.js +30 -0
  111. package/dist/trigger/jsonpath-matcher.d.ts +27 -0
  112. package/dist/trigger/jsonpath-matcher.js +92 -0
  113. package/dist/trigger/matcher.d.ts +29 -0
  114. package/dist/trigger/matcher.js +704 -0
  115. package/dist/trigger/trigger-event-type.d.ts +14 -0
  116. package/dist/trigger/trigger-event-type.js +66 -0
  117. package/dist/trigger/types.d.ts +524 -0
  118. package/dist/trigger/types.js +48 -0
  119. package/dist/webhook/signature.d.ts +15 -0
  120. package/dist/webhook/signature.js +32 -0
  121. package/dist/ws/close-codes.d.ts +28 -0
  122. package/dist/ws/close-codes.js +33 -0
  123. package/dist/ws/rate-limiter.d.ts +86 -0
  124. package/dist/ws/rate-limiter.js +136 -0
  125. package/dist/ws/ws-like.d.ts +12 -0
  126. package/dist/ws/ws-like.js +2 -0
  127. package/package.json +54 -6
  128. package/sbom.spdx.json +202 -0
  129. package/index.js +0 -3
@@ -0,0 +1,1237 @@
1
+ import "../../chunk-gOLHoazu.js";
2
+ import { actorPrincipalSchema } from "./actor.js";
3
+ import { SourceSubtype } from "./source-registration.js";
4
+ import { dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema } from "./access-log.js";
5
+ import { dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema } from "./run-events.js";
6
+ import { EventLogSource, EventLogStatus, PayloadOmittedReason } from "./event-log.js";
7
+ import { globalWorkflowsGetRequestSchema, globalWorkflowsGetResponseSchema, globalWorkflowsUpdateRequestSchema, globalWorkflowsUpdateResponseSchema } from "./dashboard-global-workflows.js";
8
+ import { z } from "zod";
9
+ //#region src/protocol/messages/dashboard.ts
10
+ /** Request full run detail (jobs + steps) from orchestrator. */
11
+ const dashboardRunDetailRequestSchema = z.object({
12
+ type: z.literal("dashboard.run.detail"),
13
+ requestId: z.string(),
14
+ actor: actorPrincipalSchema,
15
+ runId: z.string()
16
+ });
17
+ /** Request step logs from orchestrator. */
18
+ const dashboardStepLogsRequestSchema = z.object({
19
+ type: z.literal("dashboard.step.logs"),
20
+ requestId: z.string(),
21
+ actor: actorPrincipalSchema,
22
+ runId: z.string(),
23
+ jobId: z.string(),
24
+ stepIndex: z.number()
25
+ });
26
+ /** Step detail within a job response. */
27
+ const dashboardStepDetailSchema = z.object({
28
+ stepIndex: z.number(),
29
+ stepName: z.string(),
30
+ status: z.string(),
31
+ startedAt: z.number().nullable(),
32
+ completedAt: z.number().nullable(),
33
+ durationMs: z.number().nullable(),
34
+ exitCode: z.number().nullable(),
35
+ errorMessage: z.string().nullable(),
36
+ /** Step type (e.g., 'hook:onCancel', 'hook:cleanup'). Omitted for regular steps. */
37
+ stepType: z.string().optional(),
38
+ /** Secret context names accessed by this step. null = tracking not available. */
39
+ secretsAccessed: z.array(z.string()).nullable().optional()
40
+ });
41
+ /** Job detail within a run detail response. */
42
+ const dashboardJobDetailSchema = z.object({
43
+ jobId: z.string(),
44
+ jobName: z.string(),
45
+ status: z.string(),
46
+ matrixValues: z.record(z.string(), z.unknown()).nullable(),
47
+ startedAt: z.number().nullable(),
48
+ completedAt: z.number().nullable(),
49
+ durationMs: z.number().nullable(),
50
+ agentId: z.string().nullable(),
51
+ orchestratorId: z.string().nullable().optional(),
52
+ errorMessage: z.string().nullable(),
53
+ /** Labels used for agent routing (e.g. ["kici:os:linux", "kici:arch:x64"]). */
54
+ runsOnLabels: z.array(z.string()).nullable().optional(),
55
+ /** Aggregated step outputs (step-keyed map). Present when job completed successfully with outputs. */
56
+ outputs: z.record(z.string(), z.record(z.string(), z.unknown())).nullable().optional(),
57
+ /** Secret output key names produced by this job (values are NOT included -- display masked). */
58
+ secretOutputKeys: z.array(z.string()).nullable().optional(),
59
+ steps: z.array(dashboardStepDetailSchema)
60
+ });
61
+ /** Trust context from orchestrator execution_runs (populated for PR-triggered runs). */
62
+ const trustContextSchema = z.object({
63
+ trustTier: z.enum([
64
+ "trusted",
65
+ "known",
66
+ "unknown"
67
+ ]).nullable(),
68
+ lockFileSource: z.enum(["head", "base"]).nullable(),
69
+ contributorUsername: z.string().nullable()
70
+ });
71
+ /** Response with full run detail (correlates to dashboard.run.detail). */
72
+ const dashboardRunDetailResponseSchema = z.object({
73
+ type: z.literal("dashboard.run.detail.response"),
74
+ requestId: z.string(),
75
+ jobs: z.array(dashboardJobDetailSchema),
76
+ trustContext: trustContextSchema.optional(),
77
+ error: z.string().optional()
78
+ });
79
+ /** Response with step log lines (correlates to dashboard.step.logs). */
80
+ const dashboardStepLogsResponseSchema = z.object({
81
+ type: z.literal("dashboard.step.logs.response"),
82
+ requestId: z.string(),
83
+ lines: z.array(z.string()),
84
+ totalLines: z.number(),
85
+ error: z.string().optional()
86
+ });
87
+ /** Request to re-run a completed run. */
88
+ const runRerunRequestSchema = z.object({
89
+ type: z.literal("run.rerun.request"),
90
+ requestId: z.string(),
91
+ actor: actorPrincipalSchema,
92
+ runId: z.string(),
93
+ /**
94
+ * Phase F — Platform forwards the original run's `routing_key` so the
95
+ * orchestrator can probe its cold-store under the right tenant prefix
96
+ * when the run is missing from PG. Optional for backwards compatibility
97
+ * with older Platform versions in mixed deploys; if absent, the
98
+ * orchestrator skips the cold-store probe and surfaces the legacy
99
+ * `runArchivedNotRerunnable` / "Run not found" branches.
100
+ */
101
+ routingKey: z.string().optional()
102
+ });
103
+ /** Response to a re-run request. */
104
+ const runRerunResponseSchema = z.object({
105
+ type: z.literal("run.rerun.response"),
106
+ requestId: z.string(),
107
+ newRunId: z.string().optional(),
108
+ error: z.string().optional(),
109
+ /**
110
+ * Stable, machine-readable error code. Set when the orchestrator
111
+ * needs to communicate a specific failure shape to the Platform proxy
112
+ * (e.g. `runArchivedNotRerunnable` → HTTP 410). Free-text `error`
113
+ * remains the human message.
114
+ */
115
+ errorCode: z.string().optional()
116
+ });
117
+ /** Request to manually trigger a cron-scheduled workflow. */
118
+ const manualScheduleRequestSchema = z.object({
119
+ type: z.literal("run.manual_schedule.request"),
120
+ requestId: z.string(),
121
+ actor: actorPrincipalSchema,
122
+ registrationId: z.string()
123
+ });
124
+ /** Response to a manual schedule trigger request. */
125
+ const manualScheduleResponseSchema = z.object({
126
+ type: z.literal("run.manual_schedule.response"),
127
+ requestId: z.string(),
128
+ newRunId: z.string().optional(),
129
+ error: z.string().optional()
130
+ });
131
+ /** Request to cancel a running run. */
132
+ const runCancelRequestSchema = z.object({
133
+ type: z.literal("run.cancel.request"),
134
+ requestId: z.string(),
135
+ actor: actorPrincipalSchema,
136
+ runId: z.string(),
137
+ /** When true, force-cancel immediately without waiting for hooks. */
138
+ force: z.boolean().optional()
139
+ });
140
+ /** Response to a cancel request. */
141
+ const runCancelResponseSchema = z.object({
142
+ type: z.literal("run.cancel.response"),
143
+ requestId: z.string(),
144
+ cancelledJobs: z.number().optional(),
145
+ error: z.string().optional()
146
+ });
147
+ /** Request the original webhook payload for a run. */
148
+ const dashboardPayloadRequestSchema = z.object({
149
+ type: z.literal("dashboard.payload"),
150
+ requestId: z.string(),
151
+ actor: actorPrincipalSchema,
152
+ runId: z.string()
153
+ });
154
+ /** Response with the original webhook payload. */
155
+ const dashboardPayloadResponseSchema = z.object({
156
+ type: z.literal("dashboard.payload.response"),
157
+ requestId: z.string(),
158
+ payload: z.unknown().optional(),
159
+ error: z.string().optional()
160
+ });
161
+ /** Single run entry in a lineage chain. */
162
+ const runLineageSchema = z.object({
163
+ runId: z.string(),
164
+ status: z.string(),
165
+ createdAt: z.coerce.string()
166
+ });
167
+ /** Lineage response containing all re-runs of a root run. */
168
+ const runLineageResponseSchema = z.object({ reruns: z.array(runLineageSchema) });
169
+ /** Single delivery row in the list response (orchestrator-side projection). */
170
+ const eventLogListItemSchema = z.object({
171
+ deliveryId: z.string(),
172
+ routingKey: z.string(),
173
+ event: z.string(),
174
+ action: z.string().nullable(),
175
+ source: EventLogSource,
176
+ provider: z.string(),
177
+ repoIdentifier: z.string().nullable(),
178
+ ref: z.string().nullable(),
179
+ status: EventLogStatus,
180
+ matchedCount: z.number(),
181
+ runId: z.string().nullable(),
182
+ errorMessage: z.string().nullable(),
183
+ receivedAt: z.string(),
184
+ payloadOmitted: z.boolean(),
185
+ payloadOmittedReason: PayloadOmittedReason.nullable(),
186
+ payloadSizeBytes: z.number(),
187
+ payloadHash: z.string()
188
+ });
189
+ /** Request a paginated list of inbound webhook deliveries from the orchestrator. */
190
+ const dashboardEventLogListRequestSchema = z.object({
191
+ type: z.literal("dashboard.event-log.list"),
192
+ requestId: z.string(),
193
+ actor: actorPrincipalSchema,
194
+ /** Tenant ID -- the orchestrator scopes by org_id, NOT routing key. */
195
+ orgId: z.string(),
196
+ /** Optional filters. */
197
+ routingKey: z.string().optional(),
198
+ event: z.string().optional(),
199
+ status: EventLogStatus.optional(),
200
+ /** ISO timestamp lower bound (inclusive). */
201
+ fromTimestamp: z.string().optional(),
202
+ /** ISO timestamp upper bound (exclusive). */
203
+ toTimestamp: z.string().optional(),
204
+ /** Free-text delivery_id substring filter. */
205
+ deliveryId: z.string().optional(),
206
+ /** Page size (default 50, max 200). */
207
+ limit: z.number().optional(),
208
+ /** Cursor returned by the previous response. Server-defined opaque format
209
+ * (encodes received_at + id for stable pagination on ties). */
210
+ cursor: z.string().optional()
211
+ });
212
+ /** Response with the page of deliveries + next-page cursor (null = end). */
213
+ const dashboardEventLogListResponseSchema = z.object({
214
+ type: z.literal("dashboard.event-log.list.response"),
215
+ requestId: z.string(),
216
+ items: z.array(eventLogListItemSchema).optional(),
217
+ nextCursor: z.string().nullable().optional(),
218
+ error: z.string().optional()
219
+ });
220
+ /** Request the full detail (incl. payload) of a single delivery. */
221
+ const dashboardEventLogDetailRequestSchema = z.object({
222
+ type: z.literal("dashboard.event-log.detail"),
223
+ requestId: z.string(),
224
+ actor: actorPrincipalSchema,
225
+ orgId: z.string(),
226
+ deliveryId: z.string(),
227
+ /**
228
+ * Phase E cold-store hint: when the Platform side has resurrected the
229
+ * archived `event_log` row, it forwards the `routing_key` so the
230
+ * orchestrator can scope its own cold-store fetch to a single tenant
231
+ * prefix instead of scanning every routing_key for the org.
232
+ */
233
+ routingKey: z.string().optional()
234
+ });
235
+ /** Response with the orchestrator-side projection.
236
+ * The webhook body is NOT included here — it streams over the chunked
237
+ * transport (see `dashboardEventLogPayloadStreamRequestSchema`). When
238
+ * `payloadOmitted=true` the `payloadOmittedReason` field on the item carries
239
+ * the cause; the dashboard renders the empty state without issuing a
240
+ * payload-stream request in that case. */
241
+ const dashboardEventLogDetailResponseSchema = z.object({
242
+ type: z.literal("dashboard.event-log.detail.response"),
243
+ requestId: z.string(),
244
+ item: eventLogListItemSchema.optional(),
245
+ error: z.string().optional()
246
+ });
247
+ /**
248
+ * Reasons a chunked event-log payload stream may terminate without a body.
249
+ * The terminal chunk carries `isLast=true` plus one of these codes in
250
+ * `error`. A successful stream ends with `isLast=true` and no `error`.
251
+ *
252
+ * - `payload_unavailable`: orchestrator row exists but `payload_omitted=true`
253
+ * or `payload_key=null`. The dashboard renders the existing empty state
254
+ * (size cap exceeded / object-storage write failed at ingress).
255
+ * - `not_found`: no orchestrator row matched the deliveryId. The dashboard
256
+ * shows the existing "delivery not found" message.
257
+ * - `read_failed`: orchestrator could not read or gunzip the body.
258
+ * - `forbidden`: caller lacks `event_log:read_payload`. Platform synthesizes
259
+ * this code on its side and never forwards the upstream request.
260
+ * - `orch_stream_timeout`: Platform observed no inter-chunk activity for
261
+ * `KICI_EVENT_LOG_PAYLOAD_STREAM_IDLE_MS` and synthesized a terminal
262
+ * chunk to evict the stream entry.
263
+ * - `orchestrator_unavailable`: Platform could not select an orchestrator
264
+ * connection for the request (synthesized on Platform side).
265
+ */
266
+ const EventLogPayloadStreamError = z.enum([
267
+ "payload_unavailable",
268
+ "not_found",
269
+ "read_failed",
270
+ "forbidden",
271
+ "orch_stream_timeout",
272
+ "orchestrator_unavailable"
273
+ ]);
274
+ /** Platform → orchestrator: begin streaming the body for a delivery. */
275
+ const dashboardEventLogPayloadStreamRequestSchema = z.object({
276
+ type: z.literal("dashboard.event-log.payload.stream"),
277
+ requestId: z.string(),
278
+ actor: actorPrincipalSchema,
279
+ orgId: z.string(),
280
+ deliveryId: z.string(),
281
+ /**
282
+ * Phase E cold-store hint: when Platform has resurrected the archived
283
+ * `event_log` row, it forwards `routing_key` so the orchestrator can scope
284
+ * its own cold-store fetch to a single tenant prefix instead of scanning
285
+ * every routing_key for the org. Mirrors `dashboardEventLogDetailRequestSchema`.
286
+ */
287
+ routingKey: z.string().optional()
288
+ });
289
+ /**
290
+ * Orchestrator → Platform / Platform → browser: one chunk of the body.
291
+ *
292
+ * - `seq` is 0-based and monotonic. The orchestrator emits chunks strictly
293
+ * in order on a single WS connection, which guarantees in-order delivery.
294
+ * - `data` is base64-encoded UTF-8 bytes. Base64 sidesteps mid-multibyte
295
+ * slicing concerns when chunking by raw byte count.
296
+ * - `isLast=true` ends the stream. The terminal chunk may carry an `error`
297
+ * code (and `data` is empty) when streaming aborted before sending any
298
+ * body bytes; or it may carry the final body slice (with `error`
299
+ * undefined).
300
+ * - `totalBytes` is included only on `seq=0` so the dashboard can render
301
+ * "N KB / M KB" progress.
302
+ */
303
+ const dashboardEventLogPayloadChunkSchema = z.object({
304
+ type: z.literal("dashboard.event-log.payload.chunk"),
305
+ requestId: z.string(),
306
+ seq: z.number().int().min(0),
307
+ data: z.string(),
308
+ isLast: z.boolean(),
309
+ error: EventLogPayloadStreamError.optional(),
310
+ totalBytes: z.number().int().min(0).optional()
311
+ });
312
+ /**
313
+ * Platform → browser: forwarded chunk. Same shape as the orchestrator-side
314
+ * message, just renamed to keep the `dashboard.*` family for the
315
+ * Platform↔orchestrator hop and align with the browser-facing `log.lines` /
316
+ * `run.status` naming convention.
317
+ */
318
+ const browserEventLogPayloadChunkSchema = z.object({
319
+ type: z.literal("event-log.payload.chunk"),
320
+ requestId: z.string(),
321
+ seq: z.number().int().min(0),
322
+ data: z.string(),
323
+ isLast: z.boolean(),
324
+ error: EventLogPayloadStreamError.optional(),
325
+ totalBytes: z.number().int().min(0).optional()
326
+ });
327
+ const environmentTypeSchema = z.enum(["fixed", "glob"]);
328
+ const concurrencyStrategySchema = z.enum(["queue", "cancel-pending"]);
329
+ /** List all environments for the org. */
330
+ const envListRequestSchema = z.object({
331
+ type: z.literal("dashboard.environments.list"),
332
+ requestId: z.string(),
333
+ actor: actorPrincipalSchema
334
+ });
335
+ const envListResponseSchema = z.object({
336
+ type: z.literal("dashboard.environments.list.response"),
337
+ requestId: z.string(),
338
+ environments: z.array(z.object({
339
+ id: z.string(),
340
+ name: z.string(),
341
+ type: environmentTypeSchema,
342
+ globPattern: z.string().nullable(),
343
+ enabled: z.boolean(),
344
+ createdAt: z.coerce.string(),
345
+ updatedAt: z.coerce.string()
346
+ })).optional(),
347
+ error: z.string().optional()
348
+ });
349
+ /** Get a single environment by ID. */
350
+ const envGetRequestSchema = z.object({
351
+ type: z.literal("dashboard.environments.get"),
352
+ requestId: z.string(),
353
+ actor: actorPrincipalSchema,
354
+ environmentId: z.string()
355
+ });
356
+ const envGetResponseSchema = z.object({
357
+ type: z.literal("dashboard.environments.get.response"),
358
+ requestId: z.string(),
359
+ environment: z.object({
360
+ id: z.string(),
361
+ name: z.string(),
362
+ type: environmentTypeSchema,
363
+ globPattern: z.string().nullable(),
364
+ branchRestrictions: z.array(z.string()).nullable(),
365
+ concurrencyLimit: z.number().nullable(),
366
+ concurrencyStrategy: concurrencyStrategySchema.nullable(),
367
+ requiredReviewers: z.number().nullable(),
368
+ waitTimerSeconds: z.number().nullable(),
369
+ holdExpirySeconds: z.number().nullable(),
370
+ enabled: z.boolean(),
371
+ createdAt: z.coerce.string(),
372
+ updatedAt: z.coerce.string()
373
+ }).optional(),
374
+ error: z.string().optional()
375
+ });
376
+ /** Create a new environment. */
377
+ const envCreateRequestSchema = z.object({
378
+ type: z.literal("dashboard.environments.create"),
379
+ requestId: z.string(),
380
+ actor: actorPrincipalSchema,
381
+ name: z.string(),
382
+ envType: environmentTypeSchema,
383
+ globPattern: z.string().optional(),
384
+ branchRestrictions: z.array(z.string()).optional(),
385
+ concurrencyLimit: z.number().optional(),
386
+ concurrencyStrategy: concurrencyStrategySchema.optional(),
387
+ requiredReviewers: z.number().optional(),
388
+ waitTimerSeconds: z.number().optional(),
389
+ holdExpirySeconds: z.number().optional(),
390
+ enabled: z.boolean().optional()
391
+ });
392
+ const envCreateResponseSchema = z.object({
393
+ type: z.literal("dashboard.environments.create.response"),
394
+ requestId: z.string(),
395
+ environmentId: z.string().optional(),
396
+ error: z.string().optional()
397
+ });
398
+ /** Update an existing environment. */
399
+ const envUpdateRequestSchema = z.object({
400
+ type: z.literal("dashboard.environments.update"),
401
+ requestId: z.string(),
402
+ actor: actorPrincipalSchema,
403
+ environmentId: z.string(),
404
+ updates: z.object({
405
+ name: z.string().optional(),
406
+ envType: environmentTypeSchema.optional(),
407
+ globPattern: z.string().nullable().optional(),
408
+ branchRestrictions: z.array(z.string()).nullable().optional(),
409
+ concurrencyLimit: z.number().nullable().optional(),
410
+ concurrencyStrategy: concurrencyStrategySchema.nullable().optional(),
411
+ requiredReviewers: z.number().nullable().optional(),
412
+ waitTimerSeconds: z.number().nullable().optional(),
413
+ holdExpirySeconds: z.number().nullable().optional(),
414
+ enabled: z.boolean().optional()
415
+ })
416
+ });
417
+ const envUpdateResponseSchema = z.object({
418
+ type: z.literal("dashboard.environments.update.response"),
419
+ requestId: z.string(),
420
+ error: z.string().optional()
421
+ });
422
+ /** Delete an environment. */
423
+ const envDeleteRequestSchema = z.object({
424
+ type: z.literal("dashboard.environments.delete"),
425
+ requestId: z.string(),
426
+ actor: actorPrincipalSchema,
427
+ environmentId: z.string()
428
+ });
429
+ const envDeleteResponseSchema = z.object({
430
+ type: z.literal("dashboard.environments.delete.response"),
431
+ requestId: z.string(),
432
+ error: z.string().optional()
433
+ });
434
+ /** List variables for an environment. */
435
+ const envVarsListRequestSchema = z.object({
436
+ type: z.literal("dashboard.environments.variables.list"),
437
+ requestId: z.string(),
438
+ actor: actorPrincipalSchema,
439
+ environmentId: z.string()
440
+ });
441
+ const envVarsListResponseSchema = z.object({
442
+ type: z.literal("dashboard.environments.variables.list.response"),
443
+ requestId: z.string(),
444
+ variables: z.array(z.object({
445
+ key: z.string(),
446
+ value: z.string(),
447
+ locked: z.boolean()
448
+ })).optional(),
449
+ error: z.string().optional()
450
+ });
451
+ /** Set (create or update) a variable on an environment. */
452
+ const envVarSetRequestSchema = z.object({
453
+ type: z.literal("dashboard.environments.variables.set"),
454
+ requestId: z.string(),
455
+ actor: actorPrincipalSchema,
456
+ environmentId: z.string(),
457
+ key: z.string(),
458
+ value: z.string(),
459
+ locked: z.boolean().optional()
460
+ });
461
+ const envVarSetResponseSchema = z.object({
462
+ type: z.literal("dashboard.environments.variables.set.response"),
463
+ requestId: z.string(),
464
+ error: z.string().optional()
465
+ });
466
+ /** Delete a variable from an environment. */
467
+ const envVarDeleteRequestSchema = z.object({
468
+ type: z.literal("dashboard.environments.variables.delete"),
469
+ requestId: z.string(),
470
+ actor: actorPrincipalSchema,
471
+ environmentId: z.string(),
472
+ key: z.string()
473
+ });
474
+ const envVarDeleteResponseSchema = z.object({
475
+ type: z.literal("dashboard.environments.variables.delete.response"),
476
+ requestId: z.string(),
477
+ error: z.string().optional()
478
+ });
479
+ /** List source overrides for an environment + routing key. */
480
+ const envSourceOverridesListRequestSchema = z.object({
481
+ type: z.literal("dashboard.environments.source-overrides.list"),
482
+ requestId: z.string(),
483
+ actor: actorPrincipalSchema,
484
+ environmentId: z.string(),
485
+ routingKey: z.string()
486
+ });
487
+ const envSourceOverridesListResponseSchema = z.object({
488
+ type: z.literal("dashboard.environments.source-overrides.list.response"),
489
+ requestId: z.string(),
490
+ overrides: z.array(z.object({
491
+ key: z.string(),
492
+ value: z.string()
493
+ })).optional(),
494
+ error: z.string().optional()
495
+ });
496
+ /** Set a source override variable. */
497
+ const envSourceOverrideSetRequestSchema = z.object({
498
+ type: z.literal("dashboard.environments.source-overrides.set"),
499
+ requestId: z.string(),
500
+ actor: actorPrincipalSchema,
501
+ environmentId: z.string(),
502
+ routingKey: z.string(),
503
+ key: z.string(),
504
+ value: z.string()
505
+ });
506
+ const envSourceOverrideSetResponseSchema = z.object({
507
+ type: z.literal("dashboard.environments.source-overrides.set.response"),
508
+ requestId: z.string(),
509
+ error: z.string().optional()
510
+ });
511
+ /** Delete a source override variable. */
512
+ const envSourceOverrideDeleteRequestSchema = z.object({
513
+ type: z.literal("dashboard.environments.source-overrides.delete"),
514
+ requestId: z.string(),
515
+ actor: actorPrincipalSchema,
516
+ environmentId: z.string(),
517
+ routingKey: z.string(),
518
+ key: z.string()
519
+ });
520
+ const envSourceOverrideDeleteResponseSchema = z.object({
521
+ type: z.literal("dashboard.environments.source-overrides.delete.response"),
522
+ requestId: z.string(),
523
+ error: z.string().optional()
524
+ });
525
+ /** List bindings for an environment. */
526
+ const envBindingsListRequestSchema = z.object({
527
+ type: z.literal("dashboard.environments.bindings.list"),
528
+ requestId: z.string(),
529
+ actor: actorPrincipalSchema,
530
+ environmentId: z.string()
531
+ });
532
+ const envBindingsListResponseSchema = z.object({
533
+ type: z.literal("dashboard.environments.bindings.list.response"),
534
+ requestId: z.string(),
535
+ scopePatterns: z.array(z.string()).optional(),
536
+ error: z.string().optional()
537
+ });
538
+ /** Set bindings (scope patterns) for an environment. */
539
+ const envBindingsSetRequestSchema = z.object({
540
+ type: z.literal("dashboard.environments.bindings.set"),
541
+ requestId: z.string(),
542
+ actor: actorPrincipalSchema,
543
+ environmentId: z.string(),
544
+ scopePatterns: z.array(z.string())
545
+ });
546
+ const envBindingsSetResponseSchema = z.object({
547
+ type: z.literal("dashboard.environments.bindings.set.response"),
548
+ requestId: z.string(),
549
+ error: z.string().optional()
550
+ });
551
+ /** List all scoped secrets for the org. */
552
+ const envSecretsListRequestSchema = z.object({
553
+ type: z.literal("dashboard.environments.secrets.list"),
554
+ requestId: z.string(),
555
+ actor: actorPrincipalSchema
556
+ });
557
+ const envSecretsListResponseSchema = z.object({
558
+ type: z.literal("dashboard.environments.secrets.list.response"),
559
+ requestId: z.string(),
560
+ secrets: z.array(z.object({
561
+ scope: z.string(),
562
+ key: z.string(),
563
+ createdAt: z.coerce.string(),
564
+ updatedAt: z.coerce.string()
565
+ })).optional(),
566
+ error: z.string().optional()
567
+ });
568
+ /** Set (create or update) a scoped secret. */
569
+ const envSecretSetRequestSchema = z.object({
570
+ type: z.literal("dashboard.environments.secrets.set"),
571
+ requestId: z.string(),
572
+ actor: actorPrincipalSchema,
573
+ scope: z.string(),
574
+ key: z.string(),
575
+ value: z.string()
576
+ });
577
+ const envSecretSetResponseSchema = z.object({
578
+ type: z.literal("dashboard.environments.secrets.set.response"),
579
+ requestId: z.string(),
580
+ error: z.string().optional()
581
+ });
582
+ /** Delete a scoped secret. */
583
+ const envSecretDeleteRequestSchema = z.object({
584
+ type: z.literal("dashboard.environments.secrets.delete"),
585
+ requestId: z.string(),
586
+ actor: actorPrincipalSchema,
587
+ scope: z.string(),
588
+ key: z.string()
589
+ });
590
+ const envSecretDeleteResponseSchema = z.object({
591
+ type: z.literal("dashboard.environments.secrets.delete.response"),
592
+ requestId: z.string(),
593
+ error: z.string().optional()
594
+ });
595
+ /** Create an empty scope. */
596
+ const envSecretScopeCreateRequestSchema = z.object({
597
+ type: z.literal("dashboard.environments.secrets.scope.create"),
598
+ requestId: z.string(),
599
+ actor: actorPrincipalSchema,
600
+ scope: z.string()
601
+ });
602
+ const envSecretScopeCreateResponseSchema = z.object({
603
+ type: z.literal("dashboard.environments.secrets.scope.create.response"),
604
+ requestId: z.string(),
605
+ error: z.string().optional()
606
+ });
607
+ /** Rename a scope -- also updates all environment bindings referencing old scope. */
608
+ const envSecretScopeRenameRequestSchema = z.object({
609
+ type: z.literal("dashboard.environments.secrets.scope.rename"),
610
+ requestId: z.string(),
611
+ actor: actorPrincipalSchema,
612
+ oldScope: z.string(),
613
+ newScope: z.string()
614
+ });
615
+ const envSecretScopeRenameResponseSchema = z.object({
616
+ type: z.literal("dashboard.environments.secrets.scope.rename.response"),
617
+ requestId: z.string(),
618
+ error: z.string().optional()
619
+ });
620
+ /** Delete a scope and all its secrets. Also removes environment bindings referencing this scope. */
621
+ const envSecretScopeDeleteRequestSchema = z.object({
622
+ type: z.literal("dashboard.environments.secrets.scope.delete"),
623
+ requestId: z.string(),
624
+ actor: actorPrincipalSchema,
625
+ scope: z.string()
626
+ });
627
+ const envSecretScopeDeleteResponseSchema = z.object({
628
+ type: z.literal("dashboard.environments.secrets.scope.delete.response"),
629
+ requestId: z.string(),
630
+ error: z.string().optional()
631
+ });
632
+ /** Fetch runs that targeted a specific environment. */
633
+ const envHistoryRequestSchema = z.object({
634
+ type: z.literal("dashboard.environments.history"),
635
+ requestId: z.string(),
636
+ actor: actorPrincipalSchema,
637
+ environmentName: z.string(),
638
+ limit: z.number().optional(),
639
+ offset: z.number().optional()
640
+ });
641
+ const envHistoryResponseSchema = z.object({
642
+ type: z.literal("dashboard.environments.history.response"),
643
+ requestId: z.string(),
644
+ runs: z.array(z.object({
645
+ id: z.string(),
646
+ runId: z.string(),
647
+ workflowName: z.string(),
648
+ status: z.string(),
649
+ branch: z.string().nullable(),
650
+ commitSha: z.string().nullable(),
651
+ startedAt: z.coerce.string().nullable(),
652
+ completedAt: z.coerce.string().nullable(),
653
+ environment: z.string().nullable()
654
+ })).optional(),
655
+ error: z.string().optional()
656
+ });
657
+ /** Status values for held runs (approval queue). */
658
+ const HeldRunStatus = z.enum([
659
+ "pending",
660
+ "approved",
661
+ "rejected",
662
+ "expired"
663
+ ]);
664
+ /** Queue type for held runs. */
665
+ const HeldRunQueueType = z.enum(["environment", "security"]);
666
+ /** List held runs. */
667
+ const heldRunsListRequestSchema = z.object({
668
+ type: z.literal("dashboard.held-runs.list"),
669
+ requestId: z.string(),
670
+ actor: actorPrincipalSchema,
671
+ status: HeldRunStatus.optional(),
672
+ queueType: HeldRunQueueType.optional(),
673
+ runId: z.string().optional()
674
+ });
675
+ const heldRunsListResponseSchema = z.object({
676
+ type: z.literal("dashboard.held-runs.list.response"),
677
+ requestId: z.string(),
678
+ heldRuns: z.array(z.object({
679
+ id: z.string(),
680
+ runId: z.string(),
681
+ environmentId: z.string(),
682
+ environmentName: z.string(),
683
+ holdType: z.string(),
684
+ queueType: HeldRunQueueType,
685
+ status: HeldRunStatus,
686
+ requestedAt: z.coerce.string(),
687
+ resolvedAt: z.coerce.string().nullable(),
688
+ resolvedBy: z.string().nullable(),
689
+ reason: z.string().nullable(),
690
+ expiresAt: z.coerce.string().nullable(),
691
+ contributorUsername: z.string().nullable().optional(),
692
+ trustTier: z.string().nullable().optional()
693
+ })).optional(),
694
+ error: z.string().optional()
695
+ });
696
+ /** Approve a held run. */
697
+ const heldRunApproveRequestSchema = z.object({
698
+ type: z.literal("dashboard.held-runs.approve"),
699
+ requestId: z.string(),
700
+ actor: actorPrincipalSchema,
701
+ heldRunId: z.string()
702
+ });
703
+ const heldRunApproveResponseSchema = z.object({
704
+ type: z.literal("dashboard.held-runs.approve.response"),
705
+ requestId: z.string(),
706
+ error: z.string().optional()
707
+ });
708
+ /** Reject a held run. */
709
+ const heldRunRejectRequestSchema = z.object({
710
+ type: z.literal("dashboard.held-runs.reject"),
711
+ requestId: z.string(),
712
+ actor: actorPrincipalSchema,
713
+ heldRunId: z.string(),
714
+ reason: z.string().optional()
715
+ });
716
+ const heldRunRejectResponseSchema = z.object({
717
+ type: z.literal("dashboard.held-runs.reject.response"),
718
+ requestId: z.string(),
719
+ error: z.string().optional()
720
+ });
721
+ /** Request diagnostics info (orchestrator metadata + agent list) from orchestrator. */
722
+ const dashboardDiagnosticsRequestSchema = z.object({
723
+ type: z.literal("dashboard.diagnostics"),
724
+ requestId: z.string(),
725
+ actor: actorPrincipalSchema,
726
+ /** When false or omitted, agents[] is empty and aggregate fields are populated instead. */
727
+ includeAgents: z.boolean().optional()
728
+ });
729
+ /** Agent info within the diagnostics response. */
730
+ const diagnosticsAgentSchema = z.object({
731
+ agentId: z.string(),
732
+ labels: z.array(z.string()),
733
+ platform: z.string(),
734
+ arch: z.string(),
735
+ activeJobs: z.number(),
736
+ maxConcurrency: z.number(),
737
+ lastHeartbeatAt: z.number(),
738
+ registeredAt: z.number(),
739
+ version: z.string().nullable(),
740
+ hostname: z.string().nullable().optional(),
741
+ osRelease: z.string().nullable().optional(),
742
+ osVersion: z.string().nullable().optional(),
743
+ totalMemoryMb: z.number().nullable().optional(),
744
+ cpuCount: z.number().nullable().optional(),
745
+ nodeVersion: z.string().nullable().optional(),
746
+ memoryUsedMb: z.number().nullable().optional(),
747
+ memoryAvailableMb: z.number().nullable().optional(),
748
+ uptimeSeconds: z.number().nullable().optional(),
749
+ runningAsUser: z.string().nullable().optional(),
750
+ runningAsUid: z.number().nullable().optional(),
751
+ scalerName: z.string().nullable().optional()
752
+ });
753
+ /** Single scaler backend within the diagnostics response. */
754
+ const diagnosticsScalerSchema = z.object({
755
+ name: z.string(),
756
+ type: z.string(),
757
+ maxAgents: z.number(),
758
+ activeAgents: z.number(),
759
+ labelSets: z.array(z.array(z.string())),
760
+ config: z.record(z.string(), z.unknown()).optional()
761
+ });
762
+ /** Agent info within a peer diagnostics entry (subset of full agent schema). */
763
+ const diagnosticsPeerAgentSchema = z.object({
764
+ agentId: z.string(),
765
+ labels: z.array(z.string()),
766
+ platform: z.string(),
767
+ arch: z.string(),
768
+ activeJobs: z.number(),
769
+ maxConcurrency: z.number()
770
+ });
771
+ /** Peer orchestrator reported by coordinator in diagnostics. */
772
+ const diagnosticsPeerSchema = z.object({
773
+ instanceId: z.string(),
774
+ role: z.enum(["coordinator", "worker"]),
775
+ connected: z.boolean(),
776
+ lastHeartbeatAt: z.number(),
777
+ draining: z.boolean(),
778
+ agents: z.array(diagnosticsPeerAgentSchema),
779
+ hostname: z.string().optional(),
780
+ osRelease: z.string().optional(),
781
+ totalMemoryMb: z.number().optional(),
782
+ memoryUsedMb: z.number().optional(),
783
+ memoryAvailableMb: z.number().optional(),
784
+ cpuCount: z.number().optional(),
785
+ uptimeSeconds: z.number().optional(),
786
+ nodeVersion: z.string().optional(),
787
+ runningAsUser: z.string().nullable().optional(),
788
+ runningAsUid: z.number().nullable().optional(),
789
+ version: z.string().nullable().optional(),
790
+ scalerCapacity: z.array(z.object({
791
+ name: z.string().optional(),
792
+ type: z.string().optional(),
793
+ activeCount: z.number(),
794
+ maxAgents: z.number(),
795
+ labelSets: z.array(z.array(z.string()))
796
+ })).optional(),
797
+ dependencyHealth: z.array(z.object({
798
+ name: z.string(),
799
+ status: z.enum([
800
+ "pass",
801
+ "warn",
802
+ "fail"
803
+ ]),
804
+ message: z.string().nullable(),
805
+ details: z.record(z.string(), z.unknown()).optional(),
806
+ durationMs: z.number().optional()
807
+ })).optional(),
808
+ raftTerm: z.number().optional(),
809
+ raftLeaderId: z.string().nullable().optional()
810
+ });
811
+ /** Response with orchestrator metadata and connected agents. */
812
+ const dashboardDiagnosticsResponseSchema = z.object({
813
+ type: z.literal("dashboard.diagnostics.response"),
814
+ requestId: z.string(),
815
+ orchestrator: z.object({
816
+ version: z.string().nullable(),
817
+ mode: z.string().nullable(),
818
+ /** Cluster role: coordinator or worker. Null for non-clustered orchestrators. */
819
+ role: z.enum(["coordinator", "worker"]).nullable().optional(),
820
+ scalerBackends: z.array(z.string()),
821
+ runningJobs: z.number(),
822
+ queuedJobs: z.number(),
823
+ pendingLabelGaps: z.array(z.string()),
824
+ instanceId: z.string().optional(),
825
+ hostname: z.string().nullable().optional(),
826
+ osRelease: z.string().nullable().optional(),
827
+ osVersion: z.string().nullable().optional(),
828
+ totalMemoryMb: z.number().nullable().optional(),
829
+ cpuCount: z.number().nullable().optional(),
830
+ nodeVersion: z.string().nullable().optional(),
831
+ memoryUsedMb: z.number().nullable().optional(),
832
+ memoryAvailableMb: z.number().nullable().optional(),
833
+ uptimeSeconds: z.number().nullable().optional(),
834
+ runningAsUser: z.string().nullable().optional(),
835
+ runningAsUid: z.number().nullable().optional(),
836
+ /** Current Raft role: leader, follower, or candidate. Null for non-clustered orchestrators. */
837
+ raftRole: z.enum([
838
+ "follower",
839
+ "candidate",
840
+ "leader"
841
+ ]).nullable().optional(),
842
+ /** Current Raft term number. Increments with each election. */
843
+ raftTerm: z.number().nullable().optional(),
844
+ /** Instance ID of the current Raft leader. Null if no leader elected. */
845
+ raftLeaderId: z.string().nullable().optional(),
846
+ /** Total number of registered agents (always populated regardless of includeAgents). */
847
+ agentCount: z.number().nullable().optional(),
848
+ /** Number of agents not bound to any scaler. */
849
+ statefulAgentCount: z.number().nullable().optional()
850
+ }),
851
+ agents: z.array(diagnosticsAgentSchema),
852
+ scalers: z.array(diagnosticsScalerSchema).optional(),
853
+ peers: z.array(diagnosticsPeerSchema).optional(),
854
+ error: z.string().optional()
855
+ });
856
+ /** Request per-scaler capacity info from orchestrator. */
857
+ const dashboardScalerCapacityRequestSchema = z.object({
858
+ type: z.literal("dashboard.scaler.capacity"),
859
+ requestId: z.string(),
860
+ actor: actorPrincipalSchema
861
+ });
862
+ /** Single scaler backend capacity info. */
863
+ const scalerCapacityItemSchema = z.object({
864
+ scalerType: z.string(),
865
+ name: z.string(),
866
+ activeAgents: z.number(),
867
+ maxAgents: z.number(),
868
+ history: z.array(z.number())
869
+ });
870
+ /** Response with per-scaler capacity data. */
871
+ const dashboardScalerCapacityResponseSchema = z.object({
872
+ type: z.literal("dashboard.scaler.capacity.response"),
873
+ requestId: z.string(),
874
+ scalers: z.array(scalerCapacityItemSchema),
875
+ error: z.string().optional()
876
+ });
877
+ /** Request agents for a specific scaler (or stateful agents when scalerName is null). */
878
+ const dashboardScalerAgentsRequestSchema = z.object({
879
+ type: z.literal("dashboard.scaler.agents"),
880
+ requestId: z.string(),
881
+ actor: actorPrincipalSchema,
882
+ scalerName: z.string().nullable()
883
+ });
884
+ /** Response with agents for a specific scaler. */
885
+ const dashboardScalerAgentsResponseSchema = z.object({
886
+ type: z.literal("dashboard.scaler.agents.response"),
887
+ requestId: z.string(),
888
+ scalerName: z.string().nullable(),
889
+ agents: z.array(diagnosticsAgentSchema),
890
+ error: z.string().optional()
891
+ });
892
+ /** Request to disable or enable a workflow registration. */
893
+ const registrationDisableRequestSchema = z.object({
894
+ type: z.literal("dashboard.registration.disable"),
895
+ requestId: z.string(),
896
+ actor: actorPrincipalSchema,
897
+ registrationId: z.string(),
898
+ disabled: z.boolean()
899
+ });
900
+ /** Response to a registration disable/enable request. */
901
+ const registrationDisableResponseSchema = z.object({
902
+ type: z.literal("dashboard.registration.disable.result"),
903
+ requestId: z.string(),
904
+ success: z.boolean(),
905
+ error: z.string().optional()
906
+ });
907
+ /** Request to delete a workflow registration. */
908
+ const registrationDeleteRequestSchema = z.object({
909
+ type: z.literal("dashboard.registration.delete"),
910
+ requestId: z.string(),
911
+ actor: actorPrincipalSchema,
912
+ registrationId: z.string(),
913
+ cancelActiveRuns: z.boolean().optional()
914
+ });
915
+ /** Response to a registration delete request. */
916
+ const registrationDeleteResponseSchema = z.object({
917
+ type: z.literal("dashboard.registration.delete.result"),
918
+ requestId: z.string(),
919
+ success: z.boolean(),
920
+ error: z.string().optional()
921
+ });
922
+ /** Request workflow registrations from orchestrator. */
923
+ const registrationsListRequestSchema = z.object({
924
+ type: z.literal("dashboard.registrations.list"),
925
+ requestId: z.string(),
926
+ actor: actorPrincipalSchema,
927
+ triggerType: z.string().optional(),
928
+ repoIdentifier: z.string().optional()
929
+ });
930
+ /**
931
+ * Source identity attached to a registration — fed by a batch lookup against
932
+ * the orchestrator-side `sources` and `generic_webhook_sources` tables keyed
933
+ * on `routing_key`. `name` and `subtype` may be null when the source row was
934
+ * deleted but the registration row still exists (rare; the column degrades
935
+ * gracefully to a synthetic `{ routingKey, provider }` derived from the
936
+ * routing key prefix).
937
+ */
938
+ const registrationSourceSchema = z.object({
939
+ routingKey: z.string(),
940
+ name: z.string().nullable(),
941
+ subtype: SourceSubtype.nullable(),
942
+ provider: z.string()
943
+ });
944
+ /** Single registration item in the list response. */
945
+ const registrationItemSchema = z.object({
946
+ id: z.string(),
947
+ repoIdentifier: z.string(),
948
+ workflowName: z.string(),
949
+ triggerTypes: z.array(z.string()),
950
+ triggers: z.array(z.unknown()),
951
+ lastTriggeredAt: z.string().nullable(),
952
+ nextFireAt: z.string().nullable(),
953
+ sourceRepos: z.array(z.string()),
954
+ createdAt: z.string(),
955
+ updatedAt: z.string(),
956
+ disabled: z.boolean().optional(),
957
+ commitSha: z.string().optional(),
958
+ sourceFile: z.string().optional(),
959
+ /**
960
+ * Source identity (routingKey + friendly name + fine-grained subtype +
961
+ * coarse provider). `null` when the registration has no `routing_key`
962
+ * (legacy / global-workflow rows). Mirrors the shape attached to run
963
+ * summaries so the dashboard can reuse the same icon/label helpers.
964
+ */
965
+ source: registrationSourceSchema.nullable().optional()
966
+ });
967
+ /** Response with workflow registrations. */
968
+ const registrationsListResponseSchema = z.object({
969
+ type: z.literal("dashboard.registrations.list.response"),
970
+ requestId: z.string(),
971
+ registrations: z.array(registrationItemSchema).optional(),
972
+ registryVersion: z.number(),
973
+ registryUpdatedAt: z.string(),
974
+ error: z.string().optional()
975
+ });
976
+ /** Request to list all secret backends. */
977
+ const backendsListRequestSchema = z.object({
978
+ type: z.literal("dashboard.backends.list"),
979
+ requestId: z.string(),
980
+ actor: actorPrincipalSchema
981
+ });
982
+ /** Single backend item in the list response. */
983
+ const backendItemSchema = z.object({
984
+ id: z.string(),
985
+ name: z.string(),
986
+ backendType: z.enum(["pg", "vault"]),
987
+ scopeFilter: z.string(),
988
+ syncIntervalMs: z.number(),
989
+ enabled: z.boolean(),
990
+ healthStatus: z.enum([
991
+ "healthy",
992
+ "degraded",
993
+ "unreachable",
994
+ "unknown"
995
+ ]),
996
+ scopeCount: z.number(),
997
+ lastSyncAt: z.string().nullable(),
998
+ lastSyncError: z.string().nullable(),
999
+ lastHealthCheckAt: z.string().nullable(),
1000
+ createdAt: z.string(),
1001
+ updatedAt: z.string()
1002
+ });
1003
+ /** Response with all secret backends. */
1004
+ const backendsListResponseSchema = z.object({
1005
+ type: z.literal("dashboard.backends.list.response"),
1006
+ requestId: z.string(),
1007
+ backends: z.array(backendItemSchema).optional(),
1008
+ error: z.string().optional()
1009
+ });
1010
+ /** Request to get a single backend by name. */
1011
+ const backendGetRequestSchema = z.object({
1012
+ type: z.literal("dashboard.backends.get"),
1013
+ requestId: z.string(),
1014
+ actor: actorPrincipalSchema,
1015
+ name: z.string()
1016
+ });
1017
+ /** Response with a single backend. */
1018
+ const backendGetResponseSchema = z.object({
1019
+ type: z.literal("dashboard.backends.get.response"),
1020
+ requestId: z.string(),
1021
+ backend: backendItemSchema.optional(),
1022
+ error: z.string().optional()
1023
+ });
1024
+ /** Request to sync all backends. */
1025
+ const backendsSyncAllRequestSchema = z.object({
1026
+ type: z.literal("dashboard.backends.sync"),
1027
+ requestId: z.string(),
1028
+ actor: actorPrincipalSchema
1029
+ });
1030
+ /** Response to sync all backends. */
1031
+ const backendsSyncAllResponseSchema = z.object({
1032
+ type: z.literal("dashboard.backends.sync.response"),
1033
+ requestId: z.string(),
1034
+ results: z.array(z.unknown()).optional(),
1035
+ error: z.string().optional()
1036
+ });
1037
+ /** Request to sync a single backend. */
1038
+ const backendSyncRequestSchema = z.object({
1039
+ type: z.literal("dashboard.backends.sync.one"),
1040
+ requestId: z.string(),
1041
+ actor: actorPrincipalSchema,
1042
+ name: z.string()
1043
+ });
1044
+ /** Response to sync a single backend. */
1045
+ const backendSyncResponseSchema = z.object({
1046
+ type: z.literal("dashboard.backends.sync.one.response"),
1047
+ requestId: z.string(),
1048
+ synced: z.boolean().optional(),
1049
+ scopeCount: z.number().optional(),
1050
+ error: z.string().optional()
1051
+ });
1052
+ /** Request to test a named backend connection. */
1053
+ const backendTestRequestSchema = z.object({
1054
+ type: z.literal("dashboard.backends.test"),
1055
+ requestId: z.string(),
1056
+ actor: actorPrincipalSchema,
1057
+ name: z.string()
1058
+ });
1059
+ /** Response to test a backend connection. */
1060
+ const backendTestResponseSchema = z.object({
1061
+ type: z.literal("dashboard.backends.test.response"),
1062
+ requestId: z.string(),
1063
+ ok: z.boolean().optional(),
1064
+ latencyMs: z.number().optional(),
1065
+ error: z.string().optional()
1066
+ });
1067
+ /** Dashboard messages flowing from Platform to Orchestrator. */
1068
+ const dashboardPlatformToOrchSchema = z.discriminatedUnion("type", [
1069
+ dashboardRunDetailRequestSchema,
1070
+ dashboardStepLogsRequestSchema,
1071
+ runRerunRequestSchema,
1072
+ manualScheduleRequestSchema,
1073
+ runCancelRequestSchema,
1074
+ dashboardPayloadRequestSchema,
1075
+ dashboardOrchLogsRequestSchema,
1076
+ envListRequestSchema,
1077
+ envGetRequestSchema,
1078
+ envCreateRequestSchema,
1079
+ envUpdateRequestSchema,
1080
+ envDeleteRequestSchema,
1081
+ envVarsListRequestSchema,
1082
+ envVarSetRequestSchema,
1083
+ envVarDeleteRequestSchema,
1084
+ envSourceOverridesListRequestSchema,
1085
+ envSourceOverrideSetRequestSchema,
1086
+ envSourceOverrideDeleteRequestSchema,
1087
+ envBindingsListRequestSchema,
1088
+ envBindingsSetRequestSchema,
1089
+ envSecretsListRequestSchema,
1090
+ envSecretSetRequestSchema,
1091
+ envSecretDeleteRequestSchema,
1092
+ envSecretScopeCreateRequestSchema,
1093
+ envSecretScopeRenameRequestSchema,
1094
+ envSecretScopeDeleteRequestSchema,
1095
+ envHistoryRequestSchema,
1096
+ heldRunsListRequestSchema,
1097
+ heldRunApproveRequestSchema,
1098
+ heldRunRejectRequestSchema,
1099
+ registrationsListRequestSchema,
1100
+ registrationDisableRequestSchema,
1101
+ registrationDeleteRequestSchema,
1102
+ dashboardDiagnosticsRequestSchema,
1103
+ dashboardScalerCapacityRequestSchema,
1104
+ dashboardScalerAgentsRequestSchema,
1105
+ backendsListRequestSchema,
1106
+ backendGetRequestSchema,
1107
+ backendsSyncAllRequestSchema,
1108
+ backendSyncRequestSchema,
1109
+ backendTestRequestSchema,
1110
+ dashboardEventLogListRequestSchema,
1111
+ dashboardEventLogDetailRequestSchema,
1112
+ dashboardEventLogPayloadStreamRequestSchema,
1113
+ globalWorkflowsGetRequestSchema,
1114
+ globalWorkflowsUpdateRequestSchema,
1115
+ dashboardAccessLogListRequestSchema
1116
+ ]);
1117
+ /** Dashboard messages flowing from Orchestrator to Platform. */
1118
+ const dashboardOrchToPlatformSchema = z.discriminatedUnion("type", [
1119
+ dashboardRunDetailResponseSchema,
1120
+ dashboardStepLogsResponseSchema,
1121
+ runRerunResponseSchema,
1122
+ manualScheduleResponseSchema,
1123
+ runCancelResponseSchema,
1124
+ dashboardPayloadResponseSchema,
1125
+ dashboardOrchLogsResponseSchema,
1126
+ envListResponseSchema,
1127
+ envGetResponseSchema,
1128
+ envCreateResponseSchema,
1129
+ envUpdateResponseSchema,
1130
+ envDeleteResponseSchema,
1131
+ envVarsListResponseSchema,
1132
+ envVarSetResponseSchema,
1133
+ envVarDeleteResponseSchema,
1134
+ envSourceOverridesListResponseSchema,
1135
+ envSourceOverrideSetResponseSchema,
1136
+ envSourceOverrideDeleteResponseSchema,
1137
+ envBindingsListResponseSchema,
1138
+ envBindingsSetResponseSchema,
1139
+ envSecretsListResponseSchema,
1140
+ envSecretSetResponseSchema,
1141
+ envSecretDeleteResponseSchema,
1142
+ envSecretScopeCreateResponseSchema,
1143
+ envSecretScopeRenameResponseSchema,
1144
+ envSecretScopeDeleteResponseSchema,
1145
+ envHistoryResponseSchema,
1146
+ heldRunsListResponseSchema,
1147
+ heldRunApproveResponseSchema,
1148
+ heldRunRejectResponseSchema,
1149
+ registrationsListResponseSchema,
1150
+ registrationDisableResponseSchema,
1151
+ registrationDeleteResponseSchema,
1152
+ dashboardDiagnosticsResponseSchema,
1153
+ dashboardScalerCapacityResponseSchema,
1154
+ dashboardScalerAgentsResponseSchema,
1155
+ backendsListResponseSchema,
1156
+ backendGetResponseSchema,
1157
+ backendsSyncAllResponseSchema,
1158
+ backendSyncResponseSchema,
1159
+ backendTestResponseSchema,
1160
+ dashboardEventLogListResponseSchema,
1161
+ dashboardEventLogDetailResponseSchema,
1162
+ dashboardEventLogPayloadChunkSchema,
1163
+ globalWorkflowsGetResponseSchema,
1164
+ globalWorkflowsUpdateResponseSchema,
1165
+ dashboardAccessLogListResponseSchema
1166
+ ]);
1167
+ /** REST API response for run detail (jobs with nested steps). */
1168
+ const dashboardRunDetailApiResponseSchema = z.object({
1169
+ jobs: z.array(dashboardJobDetailSchema),
1170
+ trustContext: trustContextSchema.optional()
1171
+ });
1172
+ /** REST API response for step logs. */
1173
+ const dashboardStepLogsApiResponseSchema = z.object({
1174
+ lines: z.array(z.string()),
1175
+ totalLines: z.number()
1176
+ });
1177
+ /** Single infrastructure event for a run (from run_events table). */
1178
+ const runEventSchema = z.object({
1179
+ id: z.string(),
1180
+ runId: z.string(),
1181
+ eventType: z.string(),
1182
+ timestampMs: z.number(),
1183
+ sourceService: z.string(),
1184
+ metadata: z.record(z.string(), z.unknown()).nullable(),
1185
+ durationMs: z.number().nullable(),
1186
+ jobId: z.string().nullable(),
1187
+ stepIndex: z.number().nullable(),
1188
+ traceId: z.string().nullable(),
1189
+ spanId: z.string().nullable(),
1190
+ parentSpanId: z.string().nullable()
1191
+ });
1192
+ /** Trust policy response (from trust_policies table). */
1193
+ const trustPolicyResponseSchema = z.object({
1194
+ forkPolicy: z.string(),
1195
+ unknownContributorPolicy: z.string(),
1196
+ workflowChangePolicy: z.string(),
1197
+ approvalExpiryHours: z.number()
1198
+ });
1199
+ /** Single identity link item. */
1200
+ const identityLinkItemSchema = z.object({
1201
+ id: z.string(),
1202
+ provider: z.string(),
1203
+ providerUsername: z.string(),
1204
+ linkMethod: z.string(),
1205
+ linkedAt: z.string()
1206
+ });
1207
+ /** Response for identity links list endpoint. */
1208
+ const identityLinkListResponseSchema = z.object({ identityLinks: z.array(identityLinkItemSchema) });
1209
+ /** Single identity link in a member context (no id/method/date). */
1210
+ const memberIdentityLinkSchema = z.object({
1211
+ provider: z.string(),
1212
+ providerUsername: z.string()
1213
+ });
1214
+ /** Role assignment within a member response. */
1215
+ const memberRoleAssignmentSchema = z.object({
1216
+ roleId: z.string(),
1217
+ roleName: z.string(),
1218
+ isOwner: z.boolean()
1219
+ });
1220
+ /** Single org member with identity and trust info. */
1221
+ const orgMemberSchema = z.object({
1222
+ userId: z.string(),
1223
+ email: z.string().nullable(),
1224
+ displayName: z.string().nullable(),
1225
+ roles: z.array(z.string()),
1226
+ roleAssignments: z.array(memberRoleAssignmentSchema),
1227
+ suspendedAt: z.coerce.string().nullable(),
1228
+ joinedAt: z.coerce.string(),
1229
+ ciTrustLevel: z.string(),
1230
+ identityLinks: z.array(memberIdentityLinkSchema)
1231
+ });
1232
+ /** Response for org members list endpoint. */
1233
+ const memberListResponseSchema = z.object({ members: z.array(orgMemberSchema) });
1234
+ //#endregion
1235
+ export { EventLogPayloadStreamError, HeldRunQueueType, HeldRunStatus, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runRerunRequestSchema, trustPolicyResponseSchema };
1236
+
1237
+ //# sourceMappingURL=dashboard.js.map