@kici-dev/engine 0.1.14 → 0.1.15

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (43) hide show
  1. package/README.md +13 -1
  2. package/dist/audit/access-log-policy.js +12 -0
  3. package/dist/audit/retention-policy.js +6 -0
  4. package/dist/index.d.ts +1 -1
  5. package/dist/index.js +8 -7
  6. package/dist/labels.d.ts +7 -0
  7. package/dist/labels.js +11 -2
  8. package/dist/metrics/metric-catalog.generated.d.ts +50 -0
  9. package/dist/metrics/metric-catalog.generated.js +60 -0
  10. package/dist/protocol/analytics-events.d.ts +16 -0
  11. package/dist/protocol/analytics-events.js +20 -0
  12. package/dist/protocol/dashboard-write-operations.d.ts +4 -1
  13. package/dist/protocol/dashboard-write-operations.js +11 -1
  14. package/dist/protocol/messages/access-log.d.ts +16 -0
  15. package/dist/protocol/messages/access-log.js +3 -0
  16. package/dist/protocol/messages/actor.d.ts +2 -0
  17. package/dist/protocol/messages/actor.js +12 -2
  18. package/dist/protocol/messages/auth.d.ts +1 -0
  19. package/dist/protocol/messages/capabilities.d.ts +1 -0
  20. package/dist/protocol/messages/dashboard-global-workflows.d.ts +2 -0
  21. package/dist/protocol/messages/dashboard.d.ts +559 -6
  22. package/dist/protocol/messages/dashboard.js +164 -9
  23. package/dist/protocol/messages/event-log.d.ts +4 -0
  24. package/dist/protocol/messages/event-log.js +4 -0
  25. package/dist/protocol/messages/execution-status.d.ts +56 -3
  26. package/dist/protocol/messages/execution-status.js +44 -4
  27. package/dist/protocol/messages/orchestrator-agent.d.ts +164 -0
  28. package/dist/protocol/messages/orchestrator-agent.js +118 -2
  29. package/dist/protocol/messages/peer.d.ts +13 -0
  30. package/dist/protocol/messages/peer.js +14 -1
  31. package/dist/protocol/messages/platform-orchestrator.d.ts +152 -0
  32. package/dist/protocol/messages/platform-orchestrator.js +3 -55
  33. package/dist/protocol/messages/run-events.d.ts +1 -0
  34. package/dist/provider/index.d.ts +1 -0
  35. package/dist/provider/index.js +2 -1
  36. package/dist/provider/lock-file-parse-error.d.ts +14 -0
  37. package/dist/provider/lock-file-parse-error.js +22 -0
  38. package/dist/trigger/types.d.ts +8 -1
  39. package/dist/trigger/types.js +3 -1
  40. package/dist/ws/close-codes.d.ts +7 -0
  41. package/dist/ws/close-codes.js +8 -1
  42. package/package.json +15 -8
  43. package/sbom.spdx.json +5 -5
package/dist/protocol/dashboard-write-operations.d.ts CHANGED
@@ -29,6 +29,7 @@ export declare const DashboardWriteOperation: z.ZodEnum<{
29
29
  "variables.delete": "variables.delete";
30
30
  "environments.create": "environments.create";
31
31
  "environments.update": "environments.update";
32
+ "environments.test_access.set": "environments.test_access.set";
32
33
  "environments.delete": "environments.delete";
33
34
  "environments.bindings.set": "environments.bindings.set";
34
35
  "environments.source_overrides.set": "environments.source_overrides.set";
@@ -114,6 +115,7 @@ export declare const dashboardWritePolicyMap: z.ZodRecord<z.ZodEnum<{
114
115
  "variables.delete": "variables.delete";
115
116
  "environments.create": "environments.create";
116
117
  "environments.update": "environments.update";
118
+ "environments.test_access.set": "environments.test_access.set";
117
119
  "environments.delete": "environments.delete";
118
120
  "environments.bindings.set": "environments.bindings.set";
119
121
  "environments.source_overrides.set": "environments.source_overrides.set";
@@ -139,6 +141,7 @@ export declare const dashboardWritePolicyMapSchema: z.ZodDefault<z.ZodRecord<z.Z
139
141
  "variables.delete": "variables.delete";
140
142
  "environments.create": "environments.create";
141
143
  "environments.update": "environments.update";
144
+ "environments.test_access.set": "environments.test_access.set";
142
145
  "environments.delete": "environments.delete";
143
146
  "environments.bindings.set": "environments.bindings.set";
144
147
  "environments.source_overrides.set": "environments.source_overrides.set";
@@ -161,7 +164,7 @@ export declare const dashboardWritePolicyMapSchema: z.ZodDefault<z.ZodRecord<z.Z
161
164
  export declare function isDashboardWriteOperationEnabled(policy: DashboardWritePolicyMap | null | undefined, op: DashboardWriteOperation): boolean;
162
165
  /**
163
166
  * Expand a (possibly sparse) policy map into the full effective state
164
- * for all 23 operations. Operations the policy doesn't mention come
167
+ * for all 24 operations. Operations the policy doesn't mention come
165
168
  * back as `true` (permissive). Used by the orch HTTP admin response,
166
169
  * the WS `orch.capabilities` broadcast, and the dashboard's policy
167
170
  * page so consumers see the full picture, not the sparse storage shape.
package/dist/protocol/dashboard-write-operations.js CHANGED
@@ -31,6 +31,7 @@ const DashboardWriteOperation = z.enum([
31
31
  "variables.delete",
32
32
  "environments.create",
33
33
  "environments.update",
34
+ "environments.test_access.set",
34
35
  "environments.delete",
35
36
  "environments.bindings.set",
36
37
  "environments.source_overrides.set",
@@ -57,6 +58,7 @@ const DASHBOARD_WRITE_OPERATION_VALUES = Object.freeze([
57
58
  "variables.delete",
58
59
  "environments.create",
59
60
  "environments.update",
61
+ "environments.test_access.set",
60
62
  "environments.delete",
61
63
  "environments.bindings.set",
62
64
  "environments.source_overrides.set",
@@ -160,6 +162,14 @@ const DASHBOARD_WRITE_OPERATIONS = Object.freeze([
160
162
  sensitivity: "authority",
161
163
  cliEquivalent: "kici-admin environment set-policy"
162
164
  },
165
+ {
166
+ name: "environments.test_access.set",
167
+ wireMessageType: "dashboard.environments.test_access.set",
168
+ category: "Environments",
169
+ label: "Set environment test access",
170
+ sensitivity: "authority",
171
+ cliEquivalent: "kici-admin environment set-policy --allow-local-execution"
172
+ },
163
173
  {
164
174
  name: "environments.delete",
165
175
  wireMessageType: "dashboard.environments.delete",
@@ -308,7 +318,7 @@ function isDashboardWriteOperationEnabled(policy, op) {
308
318
  }
309
319
  /**
310
320
  * Expand a (possibly sparse) policy map into the full effective state
311
- * for all 23 operations. Operations the policy doesn't mention come
321
+ * for all 24 operations. Operations the policy doesn't mention come
312
322
  * back as `true` (permissive). Used by the orch HTTP admin response,
313
323
  * the WS `orch.capabilities` broadcast, and the dashboard's policy
314
324
  * page so consumers see the full picture, not the sparse storage shape.
package/dist/protocol/messages/access-log.d.ts CHANGED
@@ -57,6 +57,9 @@ export declare const AccessLogAction: z.ZodEnum<{
57
57
  "registration.delete": "registration.delete";
58
58
  "global_workflows.update": "global_workflows.update";
59
59
  "run.detail.read": "run.detail.read";
60
+ "runs.list.read": "runs.list.read";
61
+ "runs.filters.read": "runs.filters.read";
62
+ "sources.list.read": "sources.list.read";
60
63
  "run.payload.read": "run.payload.read";
61
64
  "run.orch_logs.read": "run.orch_logs.read";
62
65
  "step.logs.read": "step.logs.read";
@@ -138,6 +141,9 @@ export declare const accessLogItemSchema: z.ZodObject<{
138
141
  "registration.delete": "registration.delete";
139
142
  "global_workflows.update": "global_workflows.update";
140
143
  "run.detail.read": "run.detail.read";
144
+ "runs.list.read": "runs.list.read";
145
+ "runs.filters.read": "runs.filters.read";
146
+ "sources.list.read": "sources.list.read";
141
147
  "run.payload.read": "run.payload.read";
142
148
  "run.orch_logs.read": "run.orch_logs.read";
143
149
  "step.logs.read": "step.logs.read";
@@ -241,6 +247,9 @@ export declare const accessLogFilterSchema: z.ZodObject<{
241
247
  "registration.delete": "registration.delete";
242
248
  "global_workflows.update": "global_workflows.update";
243
249
  "run.detail.read": "run.detail.read";
250
+ "runs.list.read": "runs.list.read";
251
+ "runs.filters.read": "runs.filters.read";
252
+ "sources.list.read": "sources.list.read";
244
253
  "run.payload.read": "run.payload.read";
245
254
  "run.orch_logs.read": "run.orch_logs.read";
246
255
  "step.logs.read": "step.logs.read";
@@ -345,6 +354,7 @@ export declare const dashboardAccessLogListRequestSchema: z.ZodObject<{
345
354
  type: z.ZodLiteral<"platform_operator">;
346
355
  sub: z.ZodString;
347
356
  reason: z.ZodString;
357
+ sessionId: z.ZodOptional<z.ZodString>;
348
358
  }, z.core.$strip>, z.ZodObject<{
349
359
  type: z.ZodLiteral<"system">;
350
360
  component: z.ZodString;
@@ -365,6 +375,9 @@ export declare const dashboardAccessLogListRequestSchema: z.ZodObject<{
365
375
  "registration.delete": "registration.delete";
366
376
  "global_workflows.update": "global_workflows.update";
367
377
  "run.detail.read": "run.detail.read";
378
+ "runs.list.read": "runs.list.read";
379
+ "runs.filters.read": "runs.filters.read";
380
+ "sources.list.read": "sources.list.read";
368
381
  "run.payload.read": "run.payload.read";
369
382
  "run.orch_logs.read": "run.orch_logs.read";
370
383
  "step.logs.read": "step.logs.read";
@@ -478,6 +491,9 @@ export declare const dashboardAccessLogListResponseSchema: z.ZodObject<{
478
491
  "registration.delete": "registration.delete";
479
492
  "global_workflows.update": "global_workflows.update";
480
493
  "run.detail.read": "run.detail.read";
494
+ "runs.list.read": "runs.list.read";
495
+ "runs.filters.read": "runs.filters.read";
496
+ "sources.list.read": "sources.list.read";
481
497
  "run.payload.read": "run.payload.read";
482
498
  "run.orch_logs.read": "run.orch_logs.read";
483
499
  "step.logs.read": "step.logs.read";
package/dist/protocol/messages/access-log.js CHANGED
@@ -52,6 +52,9 @@ const AccessLogTargetType = z.enum([
52
52
  */
53
53
  const AccessLogAction = z.enum([
54
54
  "run.detail.read",
55
+ "runs.list.read",
56
+ "runs.filters.read",
57
+ "sources.list.read",
55
58
  "run.payload.read",
56
59
  "run.orch_logs.read",
57
60
  "step.logs.read",
package/dist/protocol/messages/actor.d.ts CHANGED
@@ -37,6 +37,7 @@ export declare const platformOperatorActorSchema: z.ZodObject<{
37
37
  type: z.ZodLiteral<"platform_operator">;
38
38
  sub: z.ZodString;
39
39
  reason: z.ZodString;
40
+ sessionId: z.ZodOptional<z.ZodString>;
40
41
  }, z.core.$strip>;
41
42
  export type PlatformOperatorActor = z.infer<typeof platformOperatorActorSchema>;
42
43
  export declare const systemActorSchema: z.ZodObject<{
@@ -58,6 +59,7 @@ export declare const actorPrincipalSchema: z.ZodDiscriminatedUnion<[z.ZodObject<
58
59
  type: z.ZodLiteral<"platform_operator">;
59
60
  sub: z.ZodString;
60
61
  reason: z.ZodString;
62
+ sessionId: z.ZodOptional<z.ZodString>;
61
63
  }, z.core.$strip>, z.ZodObject<{
62
64
  type: z.ZodLiteral<"system">;
63
65
  component: z.ZodString;
package/dist/protocol/messages/actor.js CHANGED
@@ -44,7 +44,14 @@ const platformOperatorActorSchema = z.object({
44
44
  * Length bounds reject empty / obviously-bad-faith values; not a ticket
45
45
  * pattern (we support multiple incident systems).
46
46
  */
47
- reason: z.string().min(10).max(200)
47
+ reason: z.string().min(4).max(200),
48
+ /**
49
+ * Support-session id, when the operator is reading through a dashboard
50
+ * support session (not the kici-platform-admin CLI break-glass path).
51
+ * Recorded in `access_log.actor_meta.sessionId` so the customer's activity
52
+ * page can tie each operator read back to the session that authorised it.
53
+ */
54
+ sessionId: z.string().min(1).optional()
48
55
  });
49
56
  const systemActorSchema = z.object({
50
57
  type: z.literal(ActorType.enum.system),
@@ -124,7 +131,10 @@ function flattenActor(actor) {
124
131
  case "platform_operator": return {
125
132
  actorType: "platform_operator",
126
133
  actorId: actor.sub,
127
- actorMeta: { reason: actor.reason }
134
+ actorMeta: {
135
+ reason: actor.reason,
136
+ ...actor.sessionId ? { sessionId: actor.sessionId } : {}
137
+ }
128
138
  };
129
139
  case "system": return {
130
140
  actorType: "system",
package/dist/protocol/messages/auth.d.ts CHANGED
@@ -19,6 +19,7 @@ export declare const authRequestSchema: z.ZodObject<{
19
19
  "variables.delete": "variables.delete";
20
20
  "environments.create": "environments.create";
21
21
  "environments.update": "environments.update";
22
+ "environments.test_access.set": "environments.test_access.set";
22
23
  "environments.delete": "environments.delete";
23
24
  "environments.bindings.set": "environments.bindings.set";
24
25
  "environments.source_overrides.set": "environments.source_overrides.set";
package/dist/protocol/messages/capabilities.d.ts CHANGED
@@ -38,6 +38,7 @@ export declare const orchCapabilitiesSchema: z.ZodObject<{
38
38
  "variables.delete": "variables.delete";
39
39
  "environments.create": "environments.create";
40
40
  "environments.update": "environments.update";
41
+ "environments.test_access.set": "environments.test_access.set";
41
42
  "environments.delete": "environments.delete";
42
43
  "environments.bindings.set": "environments.bindings.set";
43
44
  "environments.source_overrides.set": "environments.source_overrides.set";
package/dist/protocol/messages/dashboard-global-workflows.d.ts CHANGED
@@ -67,6 +67,7 @@ export declare const globalWorkflowsGetRequestSchema: z.ZodObject<{
67
67
  type: z.ZodLiteral<"platform_operator">;
68
68
  sub: z.ZodString;
69
69
  reason: z.ZodString;
70
+ sessionId: z.ZodOptional<z.ZodString>;
70
71
  }, z.core.$strip>, z.ZodObject<{
71
72
  type: z.ZodLiteral<"system">;
72
73
  component: z.ZodString;
@@ -95,6 +96,7 @@ export declare const globalWorkflowsUpdateRequestSchema: z.ZodObject<{
95
96
  type: z.ZodLiteral<"platform_operator">;
96
97
  sub: z.ZodString;
97
98
  reason: z.ZodString;
99
+ sessionId: z.ZodOptional<z.ZodString>;
98
100
  }, z.core.$strip>, z.ZodObject<{
99
101
  type: z.ZodLiteral<"system">;
100
102
  component: z.ZodString;