@kici-dev/engine 0.1.14 → 0.1.16

package/dist/metrics/metric-catalog.generated.js

@@ -46,6 +46,7 @@ const MetricNames = {
 	KICI_ORCH_JOB_RUNS_TOTAL: "kici_orch_job_runs_total",
 	KICI_ORCH_LOG_BYTES_STORED_TOTAL: "kici_orch_log_bytes_stored_total",
 	KICI_ORCH_LOG_CHUNKS_RECEIVED_TOTAL: "kici_orch_log_chunks_received_total",
+	KICI_ORCH_PG_POOL_CLIENT_ERRORS_TOTAL: "kici_orch_pg_pool_client_errors_total",
 	KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "kici_orch_scaler_config_reloads_total",
 	KICI_ORCH_SCALER_CPUS_USED: "kici_orch_scaler_cpus_used",
 	KICI_ORCH_SCALER_MEMORY_BYTES_USED: "kici_orch_scaler_memory_bytes_used",
@@ -88,16 +89,25 @@ const MetricNames = {
 	KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: "kici_platform_mimir_relay_errors_total",
 	KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: "kici_platform_orch_metrics_filtered_total",
 	KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: "kici_platform_orphan_connections_swept_total",
+	KICI_PLATFORM_PG_POOL_CLIENT_ERRORS_TOTAL: "kici_platform_pg_pool_client_errors_total",
 	KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: "kici_platform_stale_orchestrators_total",
 	KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: "kici_platform_stale_platform_connections_evicted_total",
 	KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: "kici_platform_stale_runs_failed_total",
 	KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "kici_platform_step_status_forwards_total",
+	KICI_REGISTRATIONS_TOTAL: "kici_registrations_total",
 	KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "kici_universal_git_registration_errors_total",
 	KICI_VALKEY_CONNECTION_STATUS: "kici_valkey_connection_status",
 	KICI_VALKEY_PUBLISH_TOTAL: "kici_valkey_publish_total",
 	KICI_VALKEY_RELAY_LATENCY_SECONDS: "kici_valkey_relay_latency_seconds",
 	KICI_VALKEY_SUBSCRIBE_RECEIVE_TOTAL: "kici_valkey_subscribe_receive_total",
+	KICI_WEBHOOK_BUFFER_BYTES: "kici_webhook_buffer_bytes",
+	KICI_WEBHOOK_BUFFER_DEPTH: "kici_webhook_buffer_depth",
+	KICI_WEBHOOK_BUFFER_OLDEST_AGE_SECONDS: "kici_webhook_buffer_oldest_age_seconds",
+	KICI_WEBHOOK_PG_BREAKER_STATE: "kici_webhook_pg_breaker_state",
+	KICI_WEBHOOK_PG_BREAKER_TRANSITIONS_TOTAL: "kici_webhook_pg_breaker_transitions_total",
+	KICI_WEBHOOK_PG_DEGRADED_TOTAL: "kici_webhook_pg_degraded_total",
 	KICI_WEBHOOK_PROCESSING_SECONDS: "kici_webhook_processing_seconds",
+	KICI_WEBHOOK_REPLAY_DURATION_SECONDS: "kici_webhook_replay_duration_seconds",
 	KICI_WEBHOOK_SIGNATURE_FAILURES_TOTAL: "kici_webhook_signature_failures_total",
 	KICI_WEBHOOKS_RECEIVED_TOTAL: "kici_webhooks_received_total",
 	KICI_WS_CONNECTIONS_ACTIVE: "kici_ws_connections_active",
@@ -172,6 +182,7 @@ const MetricLabels = {
 	KICI_ORCH_JOB_RUNS_TOTAL: ["job", "result"],
 	KICI_ORCH_LOG_BYTES_STORED_TOTAL: [],
 	KICI_ORCH_LOG_CHUNKS_RECEIVED_TOTAL: [],
+	KICI_ORCH_PG_POOL_CLIENT_ERRORS_TOTAL: ["source"],
 	KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: ["result"],
 	KICI_ORCH_SCALER_CPUS_USED: ["scaler", "machinePool"],
 	KICI_ORCH_SCALER_MEMORY_BYTES_USED: ["scaler", "machinePool"],
@@ -214,16 +225,25 @@ const MetricLabels = {
 	KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: ["reason"],
 	KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: ["reason", "metric"],
 	KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: [],
+	KICI_PLATFORM_PG_POOL_CLIENT_ERRORS_TOTAL: ["source"],
 	KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: [],
 	KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: ["org_id"],
 	KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: [],
 	KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: ["state"],
+	KICI_REGISTRATIONS_TOTAL: [],
 	KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: ["reason"],
 	KICI_VALKEY_CONNECTION_STATUS: ["role"],
 	KICI_VALKEY_PUBLISH_TOTAL: ["channel"],
 	KICI_VALKEY_RELAY_LATENCY_SECONDS: ["status"],
 	KICI_VALKEY_SUBSCRIBE_RECEIVE_TOTAL: ["channel"],
+	KICI_WEBHOOK_BUFFER_BYTES: [],
+	KICI_WEBHOOK_BUFFER_DEPTH: [],
+	KICI_WEBHOOK_BUFFER_OLDEST_AGE_SECONDS: [],
+	KICI_WEBHOOK_PG_BREAKER_STATE: [],
+	KICI_WEBHOOK_PG_BREAKER_TRANSITIONS_TOTAL: [],
+	KICI_WEBHOOK_PG_DEGRADED_TOTAL: ["outcome", "org_id"],
 	KICI_WEBHOOK_PROCESSING_SECONDS: ["event"],
+	KICI_WEBHOOK_REPLAY_DURATION_SECONDS: [],
 	KICI_WEBHOOK_SIGNATURE_FAILURES_TOTAL: ["source", "org_id"],
 	KICI_WEBHOOKS_RECEIVED_TOTAL: [
 		"event",
@@ -298,6 +318,7 @@ const MetricKind = {
 	KICI_ORCH_JOB_RUNS_TOTAL: "counter",
 	KICI_ORCH_LOG_BYTES_STORED_TOTAL: "counter",
 	KICI_ORCH_LOG_CHUNKS_RECEIVED_TOTAL: "counter",
+	KICI_ORCH_PG_POOL_CLIENT_ERRORS_TOTAL: "counter",
 	KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "counter",
 	KICI_ORCH_SCALER_CPUS_USED: "observableGauge",
 	KICI_ORCH_SCALER_MEMORY_BYTES_USED: "observableGauge",
@@ -340,16 +361,25 @@ const MetricKind = {
 	KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: "counter",
 	KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: "counter",
 	KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: "counter",
+	KICI_PLATFORM_PG_POOL_CLIENT_ERRORS_TOTAL: "counter",
 	KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: "counter",
 	KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: "counter",
 	KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: "counter",
 	KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "counter",
+	KICI_REGISTRATIONS_TOTAL: "counter",
 	KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "counter",
 	KICI_VALKEY_CONNECTION_STATUS: "observableGauge",
 	KICI_VALKEY_PUBLISH_TOTAL: "counter",
 	KICI_VALKEY_RELAY_LATENCY_SECONDS: "histogram",
 	KICI_VALKEY_SUBSCRIBE_RECEIVE_TOTAL: "counter",
+	KICI_WEBHOOK_BUFFER_BYTES: "observableGauge",
+	KICI_WEBHOOK_BUFFER_DEPTH: "observableGauge",
+	KICI_WEBHOOK_BUFFER_OLDEST_AGE_SECONDS: "observableGauge",
+	KICI_WEBHOOK_PG_BREAKER_STATE: "observableGauge",
+	KICI_WEBHOOK_PG_BREAKER_TRANSITIONS_TOTAL: "counter",
+	KICI_WEBHOOK_PG_DEGRADED_TOTAL: "counter",
 	KICI_WEBHOOK_PROCESSING_SECONDS: "histogram",
+	KICI_WEBHOOK_REPLAY_DURATION_SECONDS: "histogram",
 	KICI_WEBHOOK_SIGNATURE_FAILURES_TOTAL: "counter",
 	KICI_WEBHOOKS_RECEIVED_TOTAL: "counter",
 	KICI_WS_CONNECTIONS_ACTIVE: "upDownCounter",
@@ -420,6 +450,7 @@ const MetricDescription = {
 	KICI_ORCH_JOB_RUNS_TOTAL: "Scheduled job run outcomes, by job and result (success/failure)",
 	KICI_ORCH_LOG_BYTES_STORED_TOTAL: "Total bytes of log data written to storage",
 	KICI_ORCH_LOG_CHUNKS_RECEIVED_TOTAL: "Total number of log chunks received from agents",
+	KICI_ORCH_PG_POOL_CLIENT_ERRORS_TOTAL: "Total pg connection errors absorbed without a process restart",
 	KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "Total number of scaler config reload operations",
 	KICI_ORCH_SCALER_CPUS_USED: "Current CPU reservations summed by scaler / pool. scaler=\"__global__\" is the orchestrator-wide total; machinePool=\"<name>\" rows reflect the on-disk ledger.",
 	KICI_ORCH_SCALER_MEMORY_BYTES_USED: "Current memory reservations (bytes) summed by scaler / pool. scaler=\"__global__\" is the orchestrator-wide total; machinePool=\"<name>\" rows reflect the on-disk ledger.",
@@ -462,16 +493,25 @@ const MetricDescription = {
 	KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: "Total Mimir push-relay errors (Platform-embedded metrics). Labels: reason.",
 	KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: "Orchestrator-pushed metric data points dropped or rewritten by the catalog allow-list. Labels: reason, metric.",
 	KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: "Total orphan connections swept from platform_connections",
+	KICI_PLATFORM_PG_POOL_CLIENT_ERRORS_TOTAL: "Total pg connection errors absorbed without a process restart",
 	KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: "Total orchestrators detected as permanently disconnected",
 	KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: "platform_connections rows evicted by source.register DB dedup (same-instance reconnect path)",
 	KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: "Total execution runs failed due to orchestrator staleness",
 	KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "Total step status forwards received",
+	KICI_REGISTRATIONS_TOTAL: "Total user registrations (new personal orgs created on first login)",
 	KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "Errors encountered while registering universal-git provider bundles",
 	KICI_VALKEY_CONNECTION_STATUS: "Valkey connection status per role (1=connected, 0=disconnected)",
 	KICI_VALKEY_PUBLISH_TOTAL: "Total messages published to Valkey channels",
 	KICI_VALKEY_RELAY_LATENCY_SECONDS: "Latency of cross-instance Valkey relay operations in seconds",
 	KICI_VALKEY_SUBSCRIBE_RECEIVE_TOTAL: "Total messages received from Valkey subscriptions",
+	KICI_WEBHOOK_BUFFER_BYTES: "Total buffered webhook bytes (global Valkey counter)",
+	KICI_WEBHOOK_BUFFER_DEPTH: "Buffered webhook count per org",
+	KICI_WEBHOOK_BUFFER_OLDEST_AGE_SECONDS: "Age of the oldest buffered webhook per org, in seconds",
+	KICI_WEBHOOK_PG_BREAKER_STATE: "PG circuit-breaker state on this instance (0=closed,1=degraded,2=open)",
+	KICI_WEBHOOK_PG_BREAKER_TRANSITIONS_TOTAL: "PG circuit-breaker state transitions",
+	KICI_WEBHOOK_PG_DEGRADED_TOTAL: "Webhooks handled in PG-degraded mode, by outcome",
 	KICI_WEBHOOK_PROCESSING_SECONDS: "Webhook processing duration in seconds",
+	KICI_WEBHOOK_REPLAY_DURATION_SECONDS: "Buffered-webhook replay latency (enqueue → delivered) in seconds",
 	KICI_WEBHOOK_SIGNATURE_FAILURES_TOTAL: "Total number of webhooks rejected at orchestrator signature verification",
 	KICI_WEBHOOKS_RECEIVED_TOTAL: "Total number of webhooks received",
 	KICI_WS_CONNECTIONS_ACTIVE: "Current number of active WebSocket connections",
@@ -549,6 +589,7 @@ const MetricService = {
 	KICI_ORCH_JOB_RUNS_TOTAL: "orchestrator",
 	KICI_ORCH_LOG_BYTES_STORED_TOTAL: "orchestrator",
 	KICI_ORCH_LOG_CHUNKS_RECEIVED_TOTAL: "orchestrator",
+	KICI_ORCH_PG_POOL_CLIENT_ERRORS_TOTAL: "orchestrator",
 	KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "orchestrator",
 	KICI_ORCH_SCALER_CPUS_USED: "orchestrator",
 	KICI_ORCH_SCALER_MEMORY_BYTES_USED: "orchestrator",
@@ -591,16 +632,25 @@ const MetricService = {
 	KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: "platform",
 	KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: "platform",
 	KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: "platform",
+	KICI_PLATFORM_PG_POOL_CLIENT_ERRORS_TOTAL: "platform",
 	KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: "platform",
 	KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: "platform",
 	KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: "platform",
 	KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "platform",
+	KICI_REGISTRATIONS_TOTAL: "platform",
 	KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "orchestrator",
 	KICI_VALKEY_CONNECTION_STATUS: "platform",
 	KICI_VALKEY_PUBLISH_TOTAL: "platform",
 	KICI_VALKEY_RELAY_LATENCY_SECONDS: "platform",
 	KICI_VALKEY_SUBSCRIBE_RECEIVE_TOTAL: "platform",
+	KICI_WEBHOOK_BUFFER_BYTES: "platform",
+	KICI_WEBHOOK_BUFFER_DEPTH: "platform",
+	KICI_WEBHOOK_BUFFER_OLDEST_AGE_SECONDS: "platform",
+	KICI_WEBHOOK_PG_BREAKER_STATE: "platform",
+	KICI_WEBHOOK_PG_BREAKER_TRANSITIONS_TOTAL: "platform",
+	KICI_WEBHOOK_PG_DEGRADED_TOTAL: "platform",
 	KICI_WEBHOOK_PROCESSING_SECONDS: "platform",
+	KICI_WEBHOOK_REPLAY_DURATION_SECONDS: "platform",
 	KICI_WEBHOOK_SIGNATURE_FAILURES_TOTAL: "platform",
 	KICI_WEBHOOKS_RECEIVED_TOTAL: "platform",
 	KICI_WS_CONNECTIONS_ACTIVE: "platform",
@@ -672,6 +722,7 @@ const ALL_METRIC_NAMES = [
 	"kici_orch_job_runs_total",
 	"kici_orch_log_bytes_stored_total",
 	"kici_orch_log_chunks_received_total",
+	"kici_orch_pg_pool_client_errors_total",
 	"kici_orch_scaler_config_reloads_total",
 	"kici_orch_scaler_cpus_used",
 	"kici_orch_scaler_memory_bytes_used",
@@ -714,16 +765,25 @@ const ALL_METRIC_NAMES = [
 	"kici_platform_mimir_relay_errors_total",
 	"kici_platform_orch_metrics_filtered_total",
 	"kici_platform_orphan_connections_swept_total",
+	"kici_platform_pg_pool_client_errors_total",
 	"kici_platform_stale_orchestrators_total",
 	"kici_platform_stale_platform_connections_evicted_total",
 	"kici_platform_stale_runs_failed_total",
 	"kici_platform_step_status_forwards_total",
+	"kici_registrations_total",
 	"kici_universal_git_registration_errors_total",
 	"kici_valkey_connection_status",
 	"kici_valkey_publish_total",
 	"kici_valkey_relay_latency_seconds",
 	"kici_valkey_subscribe_receive_total",
+	"kici_webhook_buffer_bytes",
+	"kici_webhook_buffer_depth",
+	"kici_webhook_buffer_oldest_age_seconds",
+	"kici_webhook_pg_breaker_state",
+	"kici_webhook_pg_breaker_transitions_total",
+	"kici_webhook_pg_degraded_total",
 	"kici_webhook_processing_seconds",
+	"kici_webhook_replay_duration_seconds",
 	"kici_webhook_signature_failures_total",
 	"kici_webhooks_received_total",
 	"kici_ws_connections_active",

package/dist/protocol/analytics-events.d.ts

@@ -0,0 +1,16 @@
+import { z } from 'zod';
+export declare const AnalyticsEvent: z.ZodEnum<{
+    login: "login";
+    org_created: "org_created";
+    secret_created: "secret_created";
+    workflow_run_triggered: "workflow_run_triggered";
+    run_viewed: "run_viewed";
+    billing_plan_selected: "billing_plan_selected";
+    code_copy: "code_copy";
+    docs_search: "docs_search";
+    cta_dashboard: "cta_dashboard";
+}>;
+export type AnalyticsEvent = z.infer<typeof AnalyticsEvent>;
+/** The catalogue as a plain array (for build-time mirroring + tests). */
+export declare const ANALYTICS_EVENTS: ("login" | "org_created" | "secret_created" | "workflow_run_triggered" | "run_viewed" | "billing_plan_selected" | "code_copy" | "docs_search" | "cta_dashboard")[];
+//# sourceMappingURL=analytics-events.d.ts.map

package/dist/protocol/analytics-events.js

@@ -0,0 +1,20 @@
+import "../chunk-gOLHoazu.js";
+import { z } from "zod";
+//#region src/protocol/analytics-events.ts
+const AnalyticsEvent = z.enum([
+	"login",
+	"org_created",
+	"secret_created",
+	"workflow_run_triggered",
+	"run_viewed",
+	"billing_plan_selected",
+	"code_copy",
+	"docs_search",
+	"cta_dashboard"
+]);
+/** The catalogue as a plain array (for build-time mirroring + tests). */
+const ANALYTICS_EVENTS = AnalyticsEvent.options;
+//#endregion
+export { ANALYTICS_EVENTS, AnalyticsEvent };
+
+//# sourceMappingURL=analytics-events.js.map

package/dist/protocol/dashboard-write-operations.d.ts

@@ -29,6 +29,7 @@ export declare const DashboardWriteOperation: z.ZodEnum<{
     "variables.delete": "variables.delete";
     "environments.create": "environments.create";
     "environments.update": "environments.update";
+    "environments.test_access.set": "environments.test_access.set";
     "environments.delete": "environments.delete";
     "environments.bindings.set": "environments.bindings.set";
     "environments.source_overrides.set": "environments.source_overrides.set";
@@ -114,6 +115,7 @@ export declare const dashboardWritePolicyMap: z.ZodRecord<z.ZodEnum<{
     "variables.delete": "variables.delete";
     "environments.create": "environments.create";
     "environments.update": "environments.update";
+    "environments.test_access.set": "environments.test_access.set";
     "environments.delete": "environments.delete";
     "environments.bindings.set": "environments.bindings.set";
     "environments.source_overrides.set": "environments.source_overrides.set";
@@ -139,6 +141,7 @@ export declare const dashboardWritePolicyMapSchema: z.ZodDefault<z.ZodRecord<z.Z
     "variables.delete": "variables.delete";
     "environments.create": "environments.create";
     "environments.update": "environments.update";
+    "environments.test_access.set": "environments.test_access.set";
     "environments.delete": "environments.delete";
     "environments.bindings.set": "environments.bindings.set";
     "environments.source_overrides.set": "environments.source_overrides.set";
@@ -161,7 +164,7 @@ export declare const dashboardWritePolicyMapSchema: z.ZodDefault<z.ZodRecord<z.Z
 export declare function isDashboardWriteOperationEnabled(policy: DashboardWritePolicyMap | null | undefined, op: DashboardWriteOperation): boolean;
 /**
  * Expand a (possibly sparse) policy map into the full effective state
- * for all 23 operations. Operations the policy doesn't mention come
+ * for all 24 operations. Operations the policy doesn't mention come
  * back as `true` (permissive). Used by the orch HTTP admin response,
  * the WS `orch.capabilities` broadcast, and the dashboard's policy
  * page so consumers see the full picture, not the sparse storage shape.

package/dist/protocol/dashboard-write-operations.js

@@ -31,6 +31,7 @@ const DashboardWriteOperation = z.enum([
 	"variables.delete",
 	"environments.create",
 	"environments.update",
+	"environments.test_access.set",
 	"environments.delete",
 	"environments.bindings.set",
 	"environments.source_overrides.set",
@@ -57,6 +58,7 @@ const DASHBOARD_WRITE_OPERATION_VALUES = Object.freeze([
 	"variables.delete",
 	"environments.create",
 	"environments.update",
+	"environments.test_access.set",
 	"environments.delete",
 	"environments.bindings.set",
 	"environments.source_overrides.set",
@@ -160,6 +162,14 @@ const DASHBOARD_WRITE_OPERATIONS = Object.freeze([
 		sensitivity: "authority",
 		cliEquivalent: "kici-admin environment set-policy"
 	},
+	{
+		name: "environments.test_access.set",
+		wireMessageType: "dashboard.environments.test_access.set",
+		category: "Environments",
+		label: "Set environment test access",
+		sensitivity: "authority",
+		cliEquivalent: "kici-admin environment set-policy --allow-local-execution"
+	},
 	{
 		name: "environments.delete",
 		wireMessageType: "dashboard.environments.delete",
@@ -308,7 +318,7 @@ function isDashboardWriteOperationEnabled(policy, op) {
 }
 /**
 * Expand a (possibly sparse) policy map into the full effective state
-* for all 23 operations. Operations the policy doesn't mention come
+* for all 24 operations. Operations the policy doesn't mention come
 * back as `true` (permissive). Used by the orch HTTP admin response,
 * the WS `orch.capabilities` broadcast, and the dashboard's policy
 * page so consumers see the full picture, not the sparse storage shape.

package/dist/protocol/messages/access-log.d.ts

@@ -57,6 +57,9 @@ export declare const AccessLogAction: z.ZodEnum<{
     "registration.delete": "registration.delete";
     "global_workflows.update": "global_workflows.update";
     "run.detail.read": "run.detail.read";
+    "runs.list.read": "runs.list.read";
+    "runs.filters.read": "runs.filters.read";
+    "sources.list.read": "sources.list.read";
     "run.payload.read": "run.payload.read";
     "run.orch_logs.read": "run.orch_logs.read";
     "step.logs.read": "step.logs.read";
@@ -91,6 +94,8 @@ export declare const AccessLogAction: z.ZodEnum<{
     "held_run.list.read": "held_run.list.read";
     "held_run.approve": "held_run.approve";
     "held_run.reject": "held_run.reject";
+    "held_run.request": "held_run.request";
+    "held_run.expire": "held_run.expire";
     "registration.list.read": "registration.list.read";
     "diagnostics.read": "diagnostics.read";
     "scaler.capacity.read": "scaler.capacity.read";
@@ -138,6 +143,9 @@ export declare const accessLogItemSchema: z.ZodObject<{
         "registration.delete": "registration.delete";
         "global_workflows.update": "global_workflows.update";
         "run.detail.read": "run.detail.read";
+        "runs.list.read": "runs.list.read";
+        "runs.filters.read": "runs.filters.read";
+        "sources.list.read": "sources.list.read";
         "run.payload.read": "run.payload.read";
         "run.orch_logs.read": "run.orch_logs.read";
         "step.logs.read": "step.logs.read";
@@ -172,6 +180,8 @@ export declare const accessLogItemSchema: z.ZodObject<{
         "held_run.list.read": "held_run.list.read";
         "held_run.approve": "held_run.approve";
         "held_run.reject": "held_run.reject";
+        "held_run.request": "held_run.request";
+        "held_run.expire": "held_run.expire";
         "registration.list.read": "registration.list.read";
         "diagnostics.read": "diagnostics.read";
         "scaler.capacity.read": "scaler.capacity.read";
@@ -241,6 +251,9 @@ export declare const accessLogFilterSchema: z.ZodObject<{
         "registration.delete": "registration.delete";
         "global_workflows.update": "global_workflows.update";
         "run.detail.read": "run.detail.read";
+        "runs.list.read": "runs.list.read";
+        "runs.filters.read": "runs.filters.read";
+        "sources.list.read": "sources.list.read";
         "run.payload.read": "run.payload.read";
         "run.orch_logs.read": "run.orch_logs.read";
         "step.logs.read": "step.logs.read";
@@ -275,6 +288,8 @@ export declare const accessLogFilterSchema: z.ZodObject<{
         "held_run.list.read": "held_run.list.read";
         "held_run.approve": "held_run.approve";
         "held_run.reject": "held_run.reject";
+        "held_run.request": "held_run.request";
+        "held_run.expire": "held_run.expire";
         "registration.list.read": "registration.list.read";
         "diagnostics.read": "diagnostics.read";
         "scaler.capacity.read": "scaler.capacity.read";
@@ -345,6 +360,7 @@ export declare const dashboardAccessLogListRequestSchema: z.ZodObject<{
         type: z.ZodLiteral<"platform_operator">;
         sub: z.ZodString;
         reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>, z.ZodObject<{
         type: z.ZodLiteral<"system">;
         component: z.ZodString;
@@ -365,6 +381,9 @@ export declare const dashboardAccessLogListRequestSchema: z.ZodObject<{
         "registration.delete": "registration.delete";
         "global_workflows.update": "global_workflows.update";
         "run.detail.read": "run.detail.read";
+        "runs.list.read": "runs.list.read";
+        "runs.filters.read": "runs.filters.read";
+        "sources.list.read": "sources.list.read";
         "run.payload.read": "run.payload.read";
         "run.orch_logs.read": "run.orch_logs.read";
         "step.logs.read": "step.logs.read";
@@ -399,6 +418,8 @@ export declare const dashboardAccessLogListRequestSchema: z.ZodObject<{
         "held_run.list.read": "held_run.list.read";
         "held_run.approve": "held_run.approve";
         "held_run.reject": "held_run.reject";
+        "held_run.request": "held_run.request";
+        "held_run.expire": "held_run.expire";
         "registration.list.read": "registration.list.read";
         "diagnostics.read": "diagnostics.read";
         "scaler.capacity.read": "scaler.capacity.read";
@@ -478,6 +499,9 @@ export declare const dashboardAccessLogListResponseSchema: z.ZodObject<{
             "registration.delete": "registration.delete";
             "global_workflows.update": "global_workflows.update";
             "run.detail.read": "run.detail.read";
+            "runs.list.read": "runs.list.read";
+            "runs.filters.read": "runs.filters.read";
+            "sources.list.read": "sources.list.read";
             "run.payload.read": "run.payload.read";
             "run.orch_logs.read": "run.orch_logs.read";
             "step.logs.read": "step.logs.read";
@@ -512,6 +536,8 @@ export declare const dashboardAccessLogListResponseSchema: z.ZodObject<{
             "held_run.list.read": "held_run.list.read";
             "held_run.approve": "held_run.approve";
             "held_run.reject": "held_run.reject";
+            "held_run.request": "held_run.request";
+            "held_run.expire": "held_run.expire";
             "registration.list.read": "registration.list.read";
             "diagnostics.read": "diagnostics.read";
             "scaler.capacity.read": "scaler.capacity.read";

package/dist/protocol/messages/access-log.js

@@ -52,6 +52,9 @@ const AccessLogTargetType = z.enum([
 */
 const AccessLogAction = z.enum([
 	"run.detail.read",
+	"runs.list.read",
+	"runs.filters.read",
+	"sources.list.read",
 	"run.payload.read",
 	"run.orch_logs.read",
 	"step.logs.read",
@@ -86,6 +89,8 @@ const AccessLogAction = z.enum([
 	"held_run.list.read",
 	"held_run.approve",
 	"held_run.reject",
+	"held_run.request",
+	"held_run.expire",
 	"registration.list.read",
 	"registration.disable",
 	"registration.delete",

package/dist/protocol/messages/actor.d.ts

@@ -37,6 +37,7 @@ export declare const platformOperatorActorSchema: z.ZodObject<{
     type: z.ZodLiteral<"platform_operator">;
     sub: z.ZodString;
     reason: z.ZodString;
+    sessionId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type PlatformOperatorActor = z.infer<typeof platformOperatorActorSchema>;
 export declare const systemActorSchema: z.ZodObject<{
@@ -58,6 +59,7 @@ export declare const actorPrincipalSchema: z.ZodDiscriminatedUnion<[z.ZodObject<
     type: z.ZodLiteral<"platform_operator">;
     sub: z.ZodString;
     reason: z.ZodString;
+    sessionId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"system">;
     component: z.ZodString;

package/dist/protocol/messages/actor.js

@@ -44,7 +44,14 @@ const platformOperatorActorSchema = z.object({
 	* Length bounds reject empty / obviously-bad-faith values; not a ticket
 	* pattern (we support multiple incident systems).
 	*/
-	reason: z.string().min(10).max(200)
+	reason: z.string().min(4).max(200),
+	/**
+	* Support-session id, when the operator is reading through a dashboard
+	* support session (not the kici-platform-admin CLI break-glass path).
+	* Recorded in `access_log.actor_meta.sessionId` so the customer's activity
+	* page can tie each operator read back to the session that authorised it.
+	*/
+	sessionId: z.string().min(1).optional()
 });
 const systemActorSchema = z.object({
 	type: z.literal(ActorType.enum.system),
@@ -124,7 +131,10 @@ function flattenActor(actor) {
 		case "platform_operator": return {
 			actorType: "platform_operator",
 			actorId: actor.sub,
-			actorMeta: { reason: actor.reason }
+			actorMeta: {
+				reason: actor.reason,
+				...actor.sessionId ? { sessionId: actor.sessionId } : {}
+			}
 		};
 		case "system": return {
 			actorType: "system",

package/dist/protocol/messages/auth.d.ts

@@ -19,6 +19,7 @@ export declare const authRequestSchema: z.ZodObject<{
             "variables.delete": "variables.delete";
             "environments.create": "environments.create";
             "environments.update": "environments.update";
+            "environments.test_access.set": "environments.test_access.set";
             "environments.delete": "environments.delete";
             "environments.bindings.set": "environments.bindings.set";
             "environments.source_overrides.set": "environments.source_overrides.set";

package/dist/protocol/messages/capabilities.d.ts

@@ -38,6 +38,7 @@ export declare const orchCapabilitiesSchema: z.ZodObject<{
         "variables.delete": "variables.delete";
         "environments.create": "environments.create";
         "environments.update": "environments.update";
+        "environments.test_access.set": "environments.test_access.set";
         "environments.delete": "environments.delete";
         "environments.bindings.set": "environments.bindings.set";
         "environments.source_overrides.set": "environments.source_overrides.set";

package/dist/protocol/messages/dashboard-global-workflows.d.ts

@@ -67,6 +67,7 @@ export declare const globalWorkflowsGetRequestSchema: z.ZodObject<{
         type: z.ZodLiteral<"platform_operator">;
         sub: z.ZodString;
         reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>, z.ZodObject<{
         type: z.ZodLiteral<"system">;
         component: z.ZodString;
@@ -95,6 +96,7 @@ export declare const globalWorkflowsUpdateRequestSchema: z.ZodObject<{
         type: z.ZodLiteral<"platform_operator">;
         sub: z.ZodString;
         reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>, z.ZodObject<{
         type: z.ZodLiteral<"system">;
         component: z.ZodString;