@kici-dev/engine 0.0.0 → 0.1.1

package/dist/protocol/messages/access-log.d.ts

@@ -0,0 +1,545 @@
+import { z } from 'zod';
+/**
+ * Access log enums + dashboard protocol schemas.
+ *
+ * The orchestrator `access_log` table captures every read AND
+ * orchestrator-admin mutation attributable to an ActorPrincipal. These enums
+ * are the single source of truth for the column values; SQL, CLI filters,
+ * dashboard UI, and tests all import from here.
+ *
+ * secret_audit_log stays as-is for secret *mutations* (create/update/delete).
+ * access_log covers secret *reveals* (read-side attribution) and all other
+ * reads/mutations surfaced via Platform proxy or orchestrator admin HTTP.
+ */
+/** Where the access-log entry was originated from. */
+export declare const AccessLogSource: z.ZodEnum<{
+    platform_proxy: "platform_proxy";
+    admin_http: "admin_http";
+    admin_cli: "admin_cli";
+}>;
+export type AccessLogSource = z.infer<typeof AccessLogSource>;
+/** Outcome of the attempted action. */
+export declare const AccessLogOutcome: z.ZodEnum<{
+    error: "error";
+    allowed: "allowed";
+    denied: "denied";
+}>;
+export type AccessLogOutcome = z.infer<typeof AccessLogOutcome>;
+/** Target object category. */
+export declare const AccessLogTargetType: z.ZodEnum<{
+    run: "run";
+    job: "job";
+    step: "step";
+    payload: "payload";
+    event_log: "event_log";
+    event_log_payload: "event_log_payload";
+    secret_scope: "secret_scope";
+    environment: "environment";
+    registration: "registration";
+    backend: "backend";
+    diagnostics: "diagnostics";
+    scaler: "scaler";
+    held_run: "held_run";
+    access_log: "access_log";
+    event_dlq: "event_dlq";
+}>;
+export type AccessLogTargetType = z.infer<typeof AccessLogTargetType>;
+/**
+ * Dotted-namespace action names. Every handler that writes an access_log
+ * row uses one of these values; a new handler means adding a new entry here.
+ */
+export declare const AccessLogAction: z.ZodEnum<{
+    "run.detail.read": "run.detail.read";
+    "run.payload.read": "run.payload.read";
+    "run.orch_logs.read": "run.orch_logs.read";
+    "step.logs.read": "step.logs.read";
+    "run.cancel": "run.cancel";
+    "run.rerun": "run.rerun";
+    "run.manual_schedule": "run.manual_schedule";
+    "job.cancel": "job.cancel";
+    "event_log.list.read": "event_log.list.read";
+    "event_log.detail.read": "event_log.detail.read";
+    "event_log.payload.read": "event_log.payload.read";
+    "environment.list.read": "environment.list.read";
+    "environment.get.read": "environment.get.read";
+    "environment.create": "environment.create";
+    "environment.update": "environment.update";
+    "environment.delete": "environment.delete";
+    "env_var.list.read": "env_var.list.read";
+    "env_var.set": "env_var.set";
+    "env_var.delete": "env_var.delete";
+    "source_override.list.read": "source_override.list.read";
+    "source_override.set": "source_override.set";
+    "source_override.delete": "source_override.delete";
+    "env_binding.list.read": "env_binding.list.read";
+    "env_binding.set": "env_binding.set";
+    "secret.list.read": "secret.list.read";
+    "secret.set": "secret.set";
+    "secret.delete": "secret.delete";
+    "secret.reveal": "secret.reveal";
+    "secret_scope.create": "secret_scope.create";
+    "secret_scope.rename": "secret_scope.rename";
+    "secret_scope.delete": "secret_scope.delete";
+    "environment.history.read": "environment.history.read";
+    "held_run.list.read": "held_run.list.read";
+    "held_run.approve": "held_run.approve";
+    "held_run.reject": "held_run.reject";
+    "registration.list.read": "registration.list.read";
+    "registration.disable": "registration.disable";
+    "registration.delete": "registration.delete";
+    "diagnostics.read": "diagnostics.read";
+    "scaler.capacity.read": "scaler.capacity.read";
+    "scaler.agents.read": "scaler.agents.read";
+    "backend.list.read": "backend.list.read";
+    "backend.get.read": "backend.get.read";
+    "backend.sync": "backend.sync";
+    "backend.sync.one": "backend.sync.one";
+    "backend.test": "backend.test";
+    "global_workflows.get.read": "global_workflows.get.read";
+    "global_workflows.update": "global_workflows.update";
+    "access_log.list.read": "access_log.list.read";
+    "event_dlq.list.read": "event_dlq.list.read";
+    "event_dlq.retry": "event_dlq.retry";
+    "event_dlq.discard": "event_dlq.discard";
+    archive_chunk: "archive_chunk";
+}>;
+export type AccessLogAction = z.infer<typeof AccessLogAction>;
+/**
+ * Single row as surfaced to the dashboard / CLI. Includes optional
+ * displayName/email for `user` and `platform_operator` actors — those are
+ * resolved Platform-side by joining `actor_id` against the ZITADEL-backed
+ * `users` table. The orchestrator never returns them; it emits a minimal
+ * row and Platform enriches before forwarding to the browser.
+ */
+export declare const accessLogItemSchema: z.ZodObject<{
+    id: z.ZodString;
+    orgId: z.ZodNullable<z.ZodString>;
+    routingKey: z.ZodNullable<z.ZodString>;
+    actorType: z.ZodEnum<{
+        user: "user";
+        api_key: "api_key";
+        service_account: "service_account";
+        platform_operator: "platform_operator";
+        system: "system";
+    }>;
+    actorId: z.ZodString;
+    actorMeta: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    actorEmail: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    actorDisplayName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    action: z.ZodEnum<{
+        "run.detail.read": "run.detail.read";
+        "run.payload.read": "run.payload.read";
+        "run.orch_logs.read": "run.orch_logs.read";
+        "step.logs.read": "step.logs.read";
+        "run.cancel": "run.cancel";
+        "run.rerun": "run.rerun";
+        "run.manual_schedule": "run.manual_schedule";
+        "job.cancel": "job.cancel";
+        "event_log.list.read": "event_log.list.read";
+        "event_log.detail.read": "event_log.detail.read";
+        "event_log.payload.read": "event_log.payload.read";
+        "environment.list.read": "environment.list.read";
+        "environment.get.read": "environment.get.read";
+        "environment.create": "environment.create";
+        "environment.update": "environment.update";
+        "environment.delete": "environment.delete";
+        "env_var.list.read": "env_var.list.read";
+        "env_var.set": "env_var.set";
+        "env_var.delete": "env_var.delete";
+        "source_override.list.read": "source_override.list.read";
+        "source_override.set": "source_override.set";
+        "source_override.delete": "source_override.delete";
+        "env_binding.list.read": "env_binding.list.read";
+        "env_binding.set": "env_binding.set";
+        "secret.list.read": "secret.list.read";
+        "secret.set": "secret.set";
+        "secret.delete": "secret.delete";
+        "secret.reveal": "secret.reveal";
+        "secret_scope.create": "secret_scope.create";
+        "secret_scope.rename": "secret_scope.rename";
+        "secret_scope.delete": "secret_scope.delete";
+        "environment.history.read": "environment.history.read";
+        "held_run.list.read": "held_run.list.read";
+        "held_run.approve": "held_run.approve";
+        "held_run.reject": "held_run.reject";
+        "registration.list.read": "registration.list.read";
+        "registration.disable": "registration.disable";
+        "registration.delete": "registration.delete";
+        "diagnostics.read": "diagnostics.read";
+        "scaler.capacity.read": "scaler.capacity.read";
+        "scaler.agents.read": "scaler.agents.read";
+        "backend.list.read": "backend.list.read";
+        "backend.get.read": "backend.get.read";
+        "backend.sync": "backend.sync";
+        "backend.sync.one": "backend.sync.one";
+        "backend.test": "backend.test";
+        "global_workflows.get.read": "global_workflows.get.read";
+        "global_workflows.update": "global_workflows.update";
+        "access_log.list.read": "access_log.list.read";
+        "event_dlq.list.read": "event_dlq.list.read";
+        "event_dlq.retry": "event_dlq.retry";
+        "event_dlq.discard": "event_dlq.discard";
+        archive_chunk: "archive_chunk";
+    }>;
+    targetType: z.ZodNullable<z.ZodEnum<{
+        run: "run";
+        job: "job";
+        step: "step";
+        payload: "payload";
+        event_log: "event_log";
+        event_log_payload: "event_log_payload";
+        secret_scope: "secret_scope";
+        environment: "environment";
+        registration: "registration";
+        backend: "backend";
+        diagnostics: "diagnostics";
+        scaler: "scaler";
+        held_run: "held_run";
+        access_log: "access_log";
+        event_dlq: "event_dlq";
+    }>>;
+    targetId: z.ZodNullable<z.ZodString>;
+    requestId: z.ZodNullable<z.ZodString>;
+    source: z.ZodEnum<{
+        platform_proxy: "platform_proxy";
+        admin_http: "admin_http";
+        admin_cli: "admin_cli";
+    }>;
+    outcome: z.ZodEnum<{
+        error: "error";
+        allowed: "allowed";
+        denied: "denied";
+    }>;
+    errorMessage: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+}, z.core.$strip>;
+export type AccessLogItem = z.infer<typeof accessLogItemSchema>;
+/** Shared filter shape reused by Platform proxy + orchestrator HTTP + CLI. */
+export declare const accessLogFilterSchema: z.ZodObject<{
+    actorType: z.ZodOptional<z.ZodEnum<{
+        user: "user";
+        api_key: "api_key";
+        service_account: "service_account";
+        platform_operator: "platform_operator";
+        system: "system";
+    }>>;
+    actorId: z.ZodOptional<z.ZodString>;
+    action: z.ZodOptional<z.ZodEnum<{
+        "run.detail.read": "run.detail.read";
+        "run.payload.read": "run.payload.read";
+        "run.orch_logs.read": "run.orch_logs.read";
+        "step.logs.read": "step.logs.read";
+        "run.cancel": "run.cancel";
+        "run.rerun": "run.rerun";
+        "run.manual_schedule": "run.manual_schedule";
+        "job.cancel": "job.cancel";
+        "event_log.list.read": "event_log.list.read";
+        "event_log.detail.read": "event_log.detail.read";
+        "event_log.payload.read": "event_log.payload.read";
+        "environment.list.read": "environment.list.read";
+        "environment.get.read": "environment.get.read";
+        "environment.create": "environment.create";
+        "environment.update": "environment.update";
+        "environment.delete": "environment.delete";
+        "env_var.list.read": "env_var.list.read";
+        "env_var.set": "env_var.set";
+        "env_var.delete": "env_var.delete";
+        "source_override.list.read": "source_override.list.read";
+        "source_override.set": "source_override.set";
+        "source_override.delete": "source_override.delete";
+        "env_binding.list.read": "env_binding.list.read";
+        "env_binding.set": "env_binding.set";
+        "secret.list.read": "secret.list.read";
+        "secret.set": "secret.set";
+        "secret.delete": "secret.delete";
+        "secret.reveal": "secret.reveal";
+        "secret_scope.create": "secret_scope.create";
+        "secret_scope.rename": "secret_scope.rename";
+        "secret_scope.delete": "secret_scope.delete";
+        "environment.history.read": "environment.history.read";
+        "held_run.list.read": "held_run.list.read";
+        "held_run.approve": "held_run.approve";
+        "held_run.reject": "held_run.reject";
+        "registration.list.read": "registration.list.read";
+        "registration.disable": "registration.disable";
+        "registration.delete": "registration.delete";
+        "diagnostics.read": "diagnostics.read";
+        "scaler.capacity.read": "scaler.capacity.read";
+        "scaler.agents.read": "scaler.agents.read";
+        "backend.list.read": "backend.list.read";
+        "backend.get.read": "backend.get.read";
+        "backend.sync": "backend.sync";
+        "backend.sync.one": "backend.sync.one";
+        "backend.test": "backend.test";
+        "global_workflows.get.read": "global_workflows.get.read";
+        "global_workflows.update": "global_workflows.update";
+        "access_log.list.read": "access_log.list.read";
+        "event_dlq.list.read": "event_dlq.list.read";
+        "event_dlq.retry": "event_dlq.retry";
+        "event_dlq.discard": "event_dlq.discard";
+        archive_chunk: "archive_chunk";
+    }>>;
+    source: z.ZodOptional<z.ZodEnum<{
+        platform_proxy: "platform_proxy";
+        admin_http: "admin_http";
+        admin_cli: "admin_cli";
+    }>>;
+    outcome: z.ZodOptional<z.ZodEnum<{
+        error: "error";
+        allowed: "allowed";
+        denied: "denied";
+    }>>;
+    targetType: z.ZodOptional<z.ZodEnum<{
+        run: "run";
+        job: "job";
+        step: "step";
+        payload: "payload";
+        event_log: "event_log";
+        event_log_payload: "event_log_payload";
+        secret_scope: "secret_scope";
+        environment: "environment";
+        registration: "registration";
+        backend: "backend";
+        diagnostics: "diagnostics";
+        scaler: "scaler";
+        held_run: "held_run";
+        access_log: "access_log";
+        event_dlq: "event_dlq";
+    }>>;
+    targetId: z.ZodOptional<z.ZodString>;
+    fromTimestamp: z.ZodOptional<z.ZodString>;
+    toTimestamp: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodNumber>;
+    cursor: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AccessLogFilter = z.infer<typeof accessLogFilterSchema>;
+export declare const dashboardAccessLogListRequestSchema: z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.access-log.list">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    orgId: z.ZodString;
+    actorType: z.ZodOptional<z.ZodEnum<{
+        user: "user";
+        api_key: "api_key";
+        service_account: "service_account";
+        platform_operator: "platform_operator";
+        system: "system";
+    }>>;
+    actorId: z.ZodOptional<z.ZodString>;
+    action: z.ZodOptional<z.ZodEnum<{
+        "run.detail.read": "run.detail.read";
+        "run.payload.read": "run.payload.read";
+        "run.orch_logs.read": "run.orch_logs.read";
+        "step.logs.read": "step.logs.read";
+        "run.cancel": "run.cancel";
+        "run.rerun": "run.rerun";
+        "run.manual_schedule": "run.manual_schedule";
+        "job.cancel": "job.cancel";
+        "event_log.list.read": "event_log.list.read";
+        "event_log.detail.read": "event_log.detail.read";
+        "event_log.payload.read": "event_log.payload.read";
+        "environment.list.read": "environment.list.read";
+        "environment.get.read": "environment.get.read";
+        "environment.create": "environment.create";
+        "environment.update": "environment.update";
+        "environment.delete": "environment.delete";
+        "env_var.list.read": "env_var.list.read";
+        "env_var.set": "env_var.set";
+        "env_var.delete": "env_var.delete";
+        "source_override.list.read": "source_override.list.read";
+        "source_override.set": "source_override.set";
+        "source_override.delete": "source_override.delete";
+        "env_binding.list.read": "env_binding.list.read";
+        "env_binding.set": "env_binding.set";
+        "secret.list.read": "secret.list.read";
+        "secret.set": "secret.set";
+        "secret.delete": "secret.delete";
+        "secret.reveal": "secret.reveal";
+        "secret_scope.create": "secret_scope.create";
+        "secret_scope.rename": "secret_scope.rename";
+        "secret_scope.delete": "secret_scope.delete";
+        "environment.history.read": "environment.history.read";
+        "held_run.list.read": "held_run.list.read";
+        "held_run.approve": "held_run.approve";
+        "held_run.reject": "held_run.reject";
+        "registration.list.read": "registration.list.read";
+        "registration.disable": "registration.disable";
+        "registration.delete": "registration.delete";
+        "diagnostics.read": "diagnostics.read";
+        "scaler.capacity.read": "scaler.capacity.read";
+        "scaler.agents.read": "scaler.agents.read";
+        "backend.list.read": "backend.list.read";
+        "backend.get.read": "backend.get.read";
+        "backend.sync": "backend.sync";
+        "backend.sync.one": "backend.sync.one";
+        "backend.test": "backend.test";
+        "global_workflows.get.read": "global_workflows.get.read";
+        "global_workflows.update": "global_workflows.update";
+        "access_log.list.read": "access_log.list.read";
+        "event_dlq.list.read": "event_dlq.list.read";
+        "event_dlq.retry": "event_dlq.retry";
+        "event_dlq.discard": "event_dlq.discard";
+        archive_chunk: "archive_chunk";
+    }>>;
+    source: z.ZodOptional<z.ZodEnum<{
+        platform_proxy: "platform_proxy";
+        admin_http: "admin_http";
+        admin_cli: "admin_cli";
+    }>>;
+    outcome: z.ZodOptional<z.ZodEnum<{
+        error: "error";
+        allowed: "allowed";
+        denied: "denied";
+    }>>;
+    targetType: z.ZodOptional<z.ZodEnum<{
+        run: "run";
+        job: "job";
+        step: "step";
+        payload: "payload";
+        event_log: "event_log";
+        event_log_payload: "event_log_payload";
+        secret_scope: "secret_scope";
+        environment: "environment";
+        registration: "registration";
+        backend: "backend";
+        diagnostics: "diagnostics";
+        scaler: "scaler";
+        held_run: "held_run";
+        access_log: "access_log";
+        event_dlq: "event_dlq";
+    }>>;
+    targetId: z.ZodOptional<z.ZodString>;
+    fromTimestamp: z.ZodOptional<z.ZodString>;
+    toTimestamp: z.ZodOptional<z.ZodString>;
+    q: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodNumber>;
+    cursor: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type DashboardAccessLogListRequest = z.infer<typeof dashboardAccessLogListRequestSchema>;
+export declare const dashboardAccessLogListResponseSchema: z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.access-log.list.response">;
+    requestId: z.ZodString;
+    items: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        orgId: z.ZodNullable<z.ZodString>;
+        routingKey: z.ZodNullable<z.ZodString>;
+        actorType: z.ZodEnum<{
+            user: "user";
+            api_key: "api_key";
+            service_account: "service_account";
+            platform_operator: "platform_operator";
+            system: "system";
+        }>;
+        actorId: z.ZodString;
+        actorMeta: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        actorEmail: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        actorDisplayName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        action: z.ZodEnum<{
+            "run.detail.read": "run.detail.read";
+            "run.payload.read": "run.payload.read";
+            "run.orch_logs.read": "run.orch_logs.read";
+            "step.logs.read": "step.logs.read";
+            "run.cancel": "run.cancel";
+            "run.rerun": "run.rerun";
+            "run.manual_schedule": "run.manual_schedule";
+            "job.cancel": "job.cancel";
+            "event_log.list.read": "event_log.list.read";
+            "event_log.detail.read": "event_log.detail.read";
+            "event_log.payload.read": "event_log.payload.read";
+            "environment.list.read": "environment.list.read";
+            "environment.get.read": "environment.get.read";
+            "environment.create": "environment.create";
+            "environment.update": "environment.update";
+            "environment.delete": "environment.delete";
+            "env_var.list.read": "env_var.list.read";
+            "env_var.set": "env_var.set";
+            "env_var.delete": "env_var.delete";
+            "source_override.list.read": "source_override.list.read";
+            "source_override.set": "source_override.set";
+            "source_override.delete": "source_override.delete";
+            "env_binding.list.read": "env_binding.list.read";
+            "env_binding.set": "env_binding.set";
+            "secret.list.read": "secret.list.read";
+            "secret.set": "secret.set";
+            "secret.delete": "secret.delete";
+            "secret.reveal": "secret.reveal";
+            "secret_scope.create": "secret_scope.create";
+            "secret_scope.rename": "secret_scope.rename";
+            "secret_scope.delete": "secret_scope.delete";
+            "environment.history.read": "environment.history.read";
+            "held_run.list.read": "held_run.list.read";
+            "held_run.approve": "held_run.approve";
+            "held_run.reject": "held_run.reject";
+            "registration.list.read": "registration.list.read";
+            "registration.disable": "registration.disable";
+            "registration.delete": "registration.delete";
+            "diagnostics.read": "diagnostics.read";
+            "scaler.capacity.read": "scaler.capacity.read";
+            "scaler.agents.read": "scaler.agents.read";
+            "backend.list.read": "backend.list.read";
+            "backend.get.read": "backend.get.read";
+            "backend.sync": "backend.sync";
+            "backend.sync.one": "backend.sync.one";
+            "backend.test": "backend.test";
+            "global_workflows.get.read": "global_workflows.get.read";
+            "global_workflows.update": "global_workflows.update";
+            "access_log.list.read": "access_log.list.read";
+            "event_dlq.list.read": "event_dlq.list.read";
+            "event_dlq.retry": "event_dlq.retry";
+            "event_dlq.discard": "event_dlq.discard";
+            archive_chunk: "archive_chunk";
+        }>;
+        targetType: z.ZodNullable<z.ZodEnum<{
+            run: "run";
+            job: "job";
+            step: "step";
+            payload: "payload";
+            event_log: "event_log";
+            event_log_payload: "event_log_payload";
+            secret_scope: "secret_scope";
+            environment: "environment";
+            registration: "registration";
+            backend: "backend";
+            diagnostics: "diagnostics";
+            scaler: "scaler";
+            held_run: "held_run";
+            access_log: "access_log";
+            event_dlq: "event_dlq";
+        }>>;
+        targetId: z.ZodNullable<z.ZodString>;
+        requestId: z.ZodNullable<z.ZodString>;
+        source: z.ZodEnum<{
+            platform_proxy: "platform_proxy";
+            admin_http: "admin_http";
+            admin_cli: "admin_cli";
+        }>;
+        outcome: z.ZodEnum<{
+            error: "error";
+            allowed: "allowed";
+            denied: "denied";
+        }>;
+        errorMessage: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+    }, z.core.$strip>>>;
+    nextCursor: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type DashboardAccessLogListResponse = z.infer<typeof dashboardAccessLogListResponseSchema>;
+//# sourceMappingURL=access-log.d.ts.map