@kici-dev/engine 0.1.2 → 0.1.5

package/dist/protocol/dashboard-write-operations.js

@@ -0,0 +1,324 @@
+import "../chunk-gOLHoazu.js";
+import { z } from "zod";
+//#region src/protocol/dashboard-write-operations.ts
+/**
+* Registry of dashboard write operations governed by the per-orch
+* dashboard-write policy.
+*
+* Subpath export: consumers import from
+* `@kici-dev/engine/protocol/dashboard-write-operations`. The file is pure
+* Zod + plain TypeScript with no node built-ins, so it remains
+* browser-safe and is also imported directly by the dashboard SPA for
+* capability rendering.
+*
+* Three audiences read this registry:
+*   - Orchestrator: enforces the policy per operation in dashboard.* handlers.
+*   - Platform: gates HTTP routes that proxy to the orch.
+*   - Dashboard: renders per-control state (enabled / disabled / loading).
+*
+* Adding a new operation: append an entry to `DashboardWriteOperation`
+* (the Zod enum) and `DASHBOARD_WRITE_OPERATIONS` (the descriptor array).
+* The runtime build-time tests on the orchestrator and Platform sides
+* fail until at least one gate handler references the new operation.
+*/
+const DashboardWriteOperation = z.enum([
+	"secrets.set",
+	"secrets.delete",
+	"secrets.scope.create",
+	"secrets.scope.rename",
+	"secrets.scope.delete",
+	"variables.set",
+	"variables.delete",
+	"environments.create",
+	"environments.update",
+	"environments.delete",
+	"environments.bindings.set",
+	"environments.source_overrides.set",
+	"environments.source_overrides.delete",
+	"held_runs.approve",
+	"held_runs.reject",
+	"event_dlq.retry",
+	"event_dlq.discard",
+	"registration.disable",
+	"registration.delete",
+	"global_workflows.update",
+	"backends.sync",
+	"backends.sync_one",
+	"backends.test"
+]);
+/** Stable list of every operation in enum-declaration order. */
+const DASHBOARD_WRITE_OPERATION_VALUES = Object.freeze([
+	"secrets.set",
+	"secrets.delete",
+	"secrets.scope.create",
+	"secrets.scope.rename",
+	"secrets.scope.delete",
+	"variables.set",
+	"variables.delete",
+	"environments.create",
+	"environments.update",
+	"environments.delete",
+	"environments.bindings.set",
+	"environments.source_overrides.set",
+	"environments.source_overrides.delete",
+	"held_runs.approve",
+	"held_runs.reject",
+	"event_dlq.retry",
+	"event_dlq.discard",
+	"registration.disable",
+	"registration.delete",
+	"global_workflows.update",
+	"backends.sync",
+	"backends.sync_one",
+	"backends.test"
+]);
+const DashboardWriteCategory = z.enum([
+	"Secrets",
+	"Variables",
+	"Environments",
+	"Bindings",
+	"Held runs",
+	"DLQ",
+	"Registrations",
+	"Topology"
+]);
+const DashboardWriteSensitivity = z.enum([
+	"plaintext",
+	"authority",
+	"dispatch"
+]);
+const DASHBOARD_WRITE_OPERATIONS = Object.freeze([
+	{
+		name: "secrets.set",
+		wireMessageType: "dashboard.environments.secrets.set",
+		category: "Secrets",
+		label: "Set secret value",
+		sensitivity: "plaintext",
+		cliEquivalent: "kici-admin secret set"
+	},
+	{
+		name: "secrets.delete",
+		wireMessageType: "dashboard.environments.secrets.delete",
+		category: "Secrets",
+		label: "Delete secret",
+		sensitivity: "authority",
+		cliEquivalent: "kici-admin secret delete"
+	},
+	{
+		name: "secrets.scope.create",
+		wireMessageType: "dashboard.environments.secrets.scope.create",
+		category: "Secrets",
+		label: "Create secret scope",
+		sensitivity: "authority",
+		cliEquivalent: "kici-admin secret scope create"
+	},
+	{
+		name: "secrets.scope.rename",
+		wireMessageType: "dashboard.environments.secrets.scope.rename",
+		category: "Secrets",
+		label: "Rename secret scope",
+		sensitivity: "authority",
+		cliEquivalent: "kici-admin secret scope rename"
+	},
+	{
+		name: "secrets.scope.delete",
+		wireMessageType: "dashboard.environments.secrets.scope.delete",
+		category: "Secrets",
+		label: "Delete secret scope",
+		sensitivity: "authority",
+		cliEquivalent: "kici-admin secret scope delete"
+	},
+	{
+		name: "variables.set",
+		wireMessageType: "dashboard.environments.variables.set",
+		category: "Variables",
+		label: "Set variable value",
+		sensitivity: "plaintext",
+		cliEquivalent: "kici-admin variable set"
+	},
+	{
+		name: "variables.delete",
+		wireMessageType: "dashboard.environments.variables.delete",
+		category: "Variables",
+		label: "Delete variable",
+		sensitivity: "authority",
+		cliEquivalent: "kici-admin variable delete"
+	},
+	{
+		name: "environments.create",
+		wireMessageType: "dashboard.environments.create",
+		category: "Environments",
+		label: "Create environment",
+		sensitivity: "authority",
+		cliEquivalent: "kici-admin environment create"
+	},
+	{
+		name: "environments.update",
+		wireMessageType: "dashboard.environments.update",
+		category: "Environments",
+		label: "Update environment",
+		sensitivity: "authority",
+		cliEquivalent: "kici-admin environment set-policy"
+	},
+	{
+		name: "environments.delete",
+		wireMessageType: "dashboard.environments.delete",
+		category: "Environments",
+		label: "Delete environment",
+		sensitivity: "authority",
+		cliEquivalent: "kici-admin environment delete"
+	},
+	{
+		name: "environments.bindings.set",
+		wireMessageType: "dashboard.environments.bindings.set",
+		category: "Bindings",
+		label: "Set environment binding",
+		sensitivity: "authority",
+		cliEquivalent: "kici-admin environment bind"
+	},
+	{
+		name: "environments.source_overrides.set",
+		wireMessageType: "dashboard.environments.source-overrides.set",
+		category: "Bindings",
+		label: "Set source override",
+		sensitivity: "authority",
+		cliEquivalent: "kici-admin environment source-override set"
+	},
+	{
+		name: "environments.source_overrides.delete",
+		wireMessageType: "dashboard.environments.source-overrides.delete",
+		category: "Bindings",
+		label: "Delete source override",
+		sensitivity: "authority",
+		cliEquivalent: "kici-admin environment source-override delete"
+	},
+	{
+		name: "held_runs.approve",
+		wireMessageType: "dashboard.held-runs.approve",
+		category: "Held runs",
+		label: "Approve held run",
+		sensitivity: "dispatch",
+		cliEquivalent: "kici-admin runs approve"
+	},
+	{
+		name: "held_runs.reject",
+		wireMessageType: "dashboard.held-runs.reject",
+		category: "Held runs",
+		label: "Reject held run",
+		sensitivity: "dispatch",
+		cliEquivalent: "kici-admin runs reject"
+	},
+	{
+		name: "event_dlq.retry",
+		wireMessageType: "dashboard.event-dlq.retry",
+		category: "DLQ",
+		label: "Retry dead-lettered webhook",
+		sensitivity: "dispatch",
+		cliEquivalent: "kici-admin event-dlq retry"
+	},
+	{
+		name: "event_dlq.discard",
+		wireMessageType: "dashboard.event-dlq.discard",
+		category: "DLQ",
+		label: "Discard dead-lettered webhook",
+		sensitivity: "dispatch",
+		cliEquivalent: "kici-admin event-dlq discard"
+	},
+	{
+		name: "registration.disable",
+		wireMessageType: "dashboard.registration.disable",
+		category: "Registrations",
+		label: "Disable workflow registration",
+		sensitivity: "dispatch",
+		cliEquivalent: "kici-admin registration disable"
+	},
+	{
+		name: "registration.delete",
+		wireMessageType: "dashboard.registration.delete",
+		category: "Registrations",
+		label: "Delete workflow registration",
+		sensitivity: "dispatch",
+		cliEquivalent: "kici-admin registration delete"
+	},
+	{
+		name: "global_workflows.update",
+		wireMessageType: "dashboard.global-workflows.update",
+		category: "Topology",
+		label: "Update global workflow policy",
+		sensitivity: "dispatch",
+		cliEquivalent: "kici-admin org-settings global-workflows set"
+	},
+	{
+		name: "backends.sync",
+		wireMessageType: "dashboard.backends.sync",
+		category: "Topology",
+		label: "Sync all scaler backends",
+		sensitivity: "dispatch",
+		cliEquivalent: "kici-admin backend sync"
+	},
+	{
+		name: "backends.sync_one",
+		wireMessageType: "dashboard.backends.sync.one",
+		category: "Topology",
+		label: "Sync one scaler backend",
+		sensitivity: "dispatch",
+		cliEquivalent: "kici-admin backend sync --one"
+	},
+	{
+		name: "backends.test",
+		wireMessageType: "dashboard.backends.test",
+		category: "Topology",
+		label: "Test scaler backend",
+		sensitivity: "dispatch",
+		cliEquivalent: "kici-admin backend test"
+	}
+]);
+/** O(1) lookup of a descriptor by operation name. */
+const DASHBOARD_WRITE_OPERATIONS_BY_NAME = new Map(DASHBOARD_WRITE_OPERATIONS.map((d) => [d.name, d]));
+/** O(1) lookup of a descriptor by wire-message type. */
+const DASHBOARD_WRITE_OPERATIONS_BY_WIRE_TYPE = new Map(DASHBOARD_WRITE_OPERATIONS.map((d) => [d.wireMessageType, d]));
+function getDashboardWriteOperationDescriptor(op) {
+	const descriptor = DASHBOARD_WRITE_OPERATIONS_BY_NAME.get(op);
+	if (!descriptor) throw new Error(`No descriptor registered for dashboard write operation: ${op}`);
+	return descriptor;
+}
+function getDashboardWriteOperationsByCategory(category) {
+	return DASHBOARD_WRITE_OPERATIONS.filter((d) => d.category === category);
+}
+function getDashboardWriteOperationsBySensitivity(sensitivity) {
+	return DASHBOARD_WRITE_OPERATIONS.filter((d) => d.sensitivity === sensitivity);
+}
+/**
+* Validates a sparse policy map. Use this where the value is required
+* but may be empty (e.g. the JSONB column on the orch). For optional
+* fields on outer schemas, embed `dashboardWritePolicyMap` directly
+* with `.optional()` so omission stays as `undefined` rather than being
+* coerced to `{}`.
+*/
+const dashboardWritePolicyMap = z.partialRecord(DashboardWriteOperation, z.boolean());
+const dashboardWritePolicyMapSchema = dashboardWritePolicyMap.default({});
+/**
+* Resolve the effective state of an operation given a (possibly sparse)
+* policy map. Treats `undefined` as enabled by the permissive default.
+*/
+function isDashboardWriteOperationEnabled(policy, op) {
+	if (!policy) return true;
+	const explicit = policy[op];
+	return explicit === void 0 ? true : explicit;
+}
+/**
+* Expand a (possibly sparse) policy map into the full effective state
+* for all 23 operations. Operations the policy doesn't mention come
+* back as `true` (permissive). Used by the orch HTTP admin response,
+* the WS `orch.capabilities` broadcast, and the dashboard's policy
+* page so consumers see the full picture, not the sparse storage shape.
+*/
+function resolveFullPolicyView(policy) {
+	const out = {};
+	for (const descriptor of DASHBOARD_WRITE_OPERATIONS) out[descriptor.name] = isDashboardWriteOperationEnabled(policy, descriptor.name);
+	return out;
+}
+//#endregion
+export { DASHBOARD_WRITE_OPERATIONS, DASHBOARD_WRITE_OPERATIONS_BY_NAME, DASHBOARD_WRITE_OPERATIONS_BY_WIRE_TYPE, DASHBOARD_WRITE_OPERATION_VALUES, DashboardWriteCategory, DashboardWriteOperation, DashboardWriteSensitivity, dashboardWritePolicyMap, dashboardWritePolicyMapSchema, getDashboardWriteOperationDescriptor, getDashboardWriteOperationsByCategory, getDashboardWriteOperationsBySensitivity, isDashboardWriteOperationEnabled, resolveFullPolicyView };
+
+//# sourceMappingURL=dashboard-write-operations.js.map

package/dist/protocol/messages/access-log.d.ts

@@ -42,6 +42,8 @@ export declare const AccessLogTargetType: z.ZodEnum<{
     held_run: "held_run";
     access_log: "access_log";
     event_dlq: "event_dlq";
+    org_settings: "org_settings";
+    cluster_meta: "cluster_meta";
 }>;
 export type AccessLogTargetType = z.infer<typeof AccessLogTargetType>;
 /**
@@ -49,6 +51,11 @@ export type AccessLogTargetType = z.infer<typeof AccessLogTargetType>;
  * row uses one of these values; a new handler means adding a new entry here.
  */
 export declare const AccessLogAction: z.ZodEnum<{
+    "event_dlq.retry": "event_dlq.retry";
+    "event_dlq.discard": "event_dlq.discard";
+    "registration.disable": "registration.disable";
+    "registration.delete": "registration.delete";
+    "global_workflows.update": "global_workflows.update";
     "run.detail.read": "run.detail.read";
     "run.payload.read": "run.payload.read";
     "run.orch_logs.read": "run.orch_logs.read";
@@ -85,8 +92,6 @@ export declare const AccessLogAction: z.ZodEnum<{
     "held_run.approve": "held_run.approve";
     "held_run.reject": "held_run.reject";
     "registration.list.read": "registration.list.read";
-    "registration.disable": "registration.disable";
-    "registration.delete": "registration.delete";
     "diagnostics.read": "diagnostics.read";
     "scaler.capacity.read": "scaler.capacity.read";
     "scaler.agents.read": "scaler.agents.read";
@@ -96,18 +101,18 @@ export declare const AccessLogAction: z.ZodEnum<{
     "backend.sync.one": "backend.sync.one";
     "backend.test": "backend.test";
     "global_workflows.get.read": "global_workflows.get.read";
-    "global_workflows.update": "global_workflows.update";
+    "org_settings.dashboard_write_policy.update": "org_settings.dashboard_write_policy.update";
+    "cluster_name.update": "cluster_name.update";
     "access_log.list.read": "access_log.list.read";
     "event_dlq.list.read": "event_dlq.list.read";
-    "event_dlq.retry": "event_dlq.retry";
-    "event_dlq.discard": "event_dlq.discard";
     archive_chunk: "archive_chunk";
+    purge_chunk: "purge_chunk";
 }>;
 export type AccessLogAction = z.infer<typeof AccessLogAction>;
 /**
  * Single row as surfaced to the dashboard / CLI. Includes optional
  * displayName/email for `user` and `platform_operator` actors — those are
- * resolved Platform-side by joining `actor_id` against the ZITADEL-backed
+ * resolved Platform-side by joining `actor_id` against the Keycloak-backed
  * `users` table. The orchestrator never returns them; it emits a minimal
  * row and Platform enriches before forwarding to the browser.
  */
@@ -127,6 +132,11 @@ export declare const accessLogItemSchema: z.ZodObject<{
     actorEmail: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     actorDisplayName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     action: z.ZodEnum<{
+        "event_dlq.retry": "event_dlq.retry";
+        "event_dlq.discard": "event_dlq.discard";
+        "registration.disable": "registration.disable";
+        "registration.delete": "registration.delete";
+        "global_workflows.update": "global_workflows.update";
         "run.detail.read": "run.detail.read";
         "run.payload.read": "run.payload.read";
         "run.orch_logs.read": "run.orch_logs.read";
@@ -163,8 +173,6 @@ export declare const accessLogItemSchema: z.ZodObject<{
         "held_run.approve": "held_run.approve";
         "held_run.reject": "held_run.reject";
         "registration.list.read": "registration.list.read";
-        "registration.disable": "registration.disable";
-        "registration.delete": "registration.delete";
         "diagnostics.read": "diagnostics.read";
         "scaler.capacity.read": "scaler.capacity.read";
         "scaler.agents.read": "scaler.agents.read";
@@ -174,12 +182,12 @@ export declare const accessLogItemSchema: z.ZodObject<{
         "backend.sync.one": "backend.sync.one";
         "backend.test": "backend.test";
         "global_workflows.get.read": "global_workflows.get.read";
-        "global_workflows.update": "global_workflows.update";
+        "org_settings.dashboard_write_policy.update": "org_settings.dashboard_write_policy.update";
+        "cluster_name.update": "cluster_name.update";
         "access_log.list.read": "access_log.list.read";
         "event_dlq.list.read": "event_dlq.list.read";
-        "event_dlq.retry": "event_dlq.retry";
-        "event_dlq.discard": "event_dlq.discard";
         archive_chunk: "archive_chunk";
+        purge_chunk: "purge_chunk";
     }>;
     targetType: z.ZodNullable<z.ZodEnum<{
         run: "run";
@@ -197,6 +205,8 @@ export declare const accessLogItemSchema: z.ZodObject<{
         held_run: "held_run";
         access_log: "access_log";
         event_dlq: "event_dlq";
+        org_settings: "org_settings";
+        cluster_meta: "cluster_meta";
     }>>;
     targetId: z.ZodNullable<z.ZodString>;
     requestId: z.ZodNullable<z.ZodString>;
@@ -225,6 +235,11 @@ export declare const accessLogFilterSchema: z.ZodObject<{
     }>>;
     actorId: z.ZodOptional<z.ZodString>;
     action: z.ZodOptional<z.ZodEnum<{
+        "event_dlq.retry": "event_dlq.retry";
+        "event_dlq.discard": "event_dlq.discard";
+        "registration.disable": "registration.disable";
+        "registration.delete": "registration.delete";
+        "global_workflows.update": "global_workflows.update";
         "run.detail.read": "run.detail.read";
         "run.payload.read": "run.payload.read";
         "run.orch_logs.read": "run.orch_logs.read";
@@ -261,8 +276,6 @@ export declare const accessLogFilterSchema: z.ZodObject<{
         "held_run.approve": "held_run.approve";
         "held_run.reject": "held_run.reject";
         "registration.list.read": "registration.list.read";
-        "registration.disable": "registration.disable";
-        "registration.delete": "registration.delete";
         "diagnostics.read": "diagnostics.read";
         "scaler.capacity.read": "scaler.capacity.read";
         "scaler.agents.read": "scaler.agents.read";
@@ -272,12 +285,12 @@ export declare const accessLogFilterSchema: z.ZodObject<{
         "backend.sync.one": "backend.sync.one";
         "backend.test": "backend.test";
         "global_workflows.get.read": "global_workflows.get.read";
-        "global_workflows.update": "global_workflows.update";
+        "org_settings.dashboard_write_policy.update": "org_settings.dashboard_write_policy.update";
+        "cluster_name.update": "cluster_name.update";
         "access_log.list.read": "access_log.list.read";
         "event_dlq.list.read": "event_dlq.list.read";
-        "event_dlq.retry": "event_dlq.retry";
-        "event_dlq.discard": "event_dlq.discard";
         archive_chunk: "archive_chunk";
+        purge_chunk: "purge_chunk";
     }>>;
     source: z.ZodOptional<z.ZodEnum<{
         platform_proxy: "platform_proxy";
@@ -305,6 +318,8 @@ export declare const accessLogFilterSchema: z.ZodObject<{
         held_run: "held_run";
         access_log: "access_log";
         event_dlq: "event_dlq";
+        org_settings: "org_settings";
+        cluster_meta: "cluster_meta";
     }>>;
     targetId: z.ZodOptional<z.ZodString>;
     fromTimestamp: z.ZodOptional<z.ZodString>;
@@ -344,6 +359,11 @@ export declare const dashboardAccessLogListRequestSchema: z.ZodObject<{
     }>>;
     actorId: z.ZodOptional<z.ZodString>;
     action: z.ZodOptional<z.ZodEnum<{
+        "event_dlq.retry": "event_dlq.retry";
+        "event_dlq.discard": "event_dlq.discard";
+        "registration.disable": "registration.disable";
+        "registration.delete": "registration.delete";
+        "global_workflows.update": "global_workflows.update";
         "run.detail.read": "run.detail.read";
         "run.payload.read": "run.payload.read";
         "run.orch_logs.read": "run.orch_logs.read";
@@ -380,8 +400,6 @@ export declare const dashboardAccessLogListRequestSchema: z.ZodObject<{
         "held_run.approve": "held_run.approve";
         "held_run.reject": "held_run.reject";
         "registration.list.read": "registration.list.read";
-        "registration.disable": "registration.disable";
-        "registration.delete": "registration.delete";
         "diagnostics.read": "diagnostics.read";
         "scaler.capacity.read": "scaler.capacity.read";
         "scaler.agents.read": "scaler.agents.read";
@@ -391,12 +409,12 @@ export declare const dashboardAccessLogListRequestSchema: z.ZodObject<{
         "backend.sync.one": "backend.sync.one";
         "backend.test": "backend.test";
         "global_workflows.get.read": "global_workflows.get.read";
-        "global_workflows.update": "global_workflows.update";
+        "org_settings.dashboard_write_policy.update": "org_settings.dashboard_write_policy.update";
+        "cluster_name.update": "cluster_name.update";
         "access_log.list.read": "access_log.list.read";
         "event_dlq.list.read": "event_dlq.list.read";
-        "event_dlq.retry": "event_dlq.retry";
-        "event_dlq.discard": "event_dlq.discard";
         archive_chunk: "archive_chunk";
+        purge_chunk: "purge_chunk";
     }>>;
     source: z.ZodOptional<z.ZodEnum<{
         platform_proxy: "platform_proxy";
@@ -424,6 +442,8 @@ export declare const dashboardAccessLogListRequestSchema: z.ZodObject<{
         held_run: "held_run";
         access_log: "access_log";
         event_dlq: "event_dlq";
+        org_settings: "org_settings";
+        cluster_meta: "cluster_meta";
     }>>;
     targetId: z.ZodOptional<z.ZodString>;
     fromTimestamp: z.ZodOptional<z.ZodString>;
@@ -452,6 +472,11 @@ export declare const dashboardAccessLogListResponseSchema: z.ZodObject<{
         actorEmail: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         actorDisplayName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         action: z.ZodEnum<{
+            "event_dlq.retry": "event_dlq.retry";
+            "event_dlq.discard": "event_dlq.discard";
+            "registration.disable": "registration.disable";
+            "registration.delete": "registration.delete";
+            "global_workflows.update": "global_workflows.update";
             "run.detail.read": "run.detail.read";
             "run.payload.read": "run.payload.read";
             "run.orch_logs.read": "run.orch_logs.read";
@@ -488,8 +513,6 @@ export declare const dashboardAccessLogListResponseSchema: z.ZodObject<{
             "held_run.approve": "held_run.approve";
             "held_run.reject": "held_run.reject";
             "registration.list.read": "registration.list.read";
-            "registration.disable": "registration.disable";
-            "registration.delete": "registration.delete";
             "diagnostics.read": "diagnostics.read";
             "scaler.capacity.read": "scaler.capacity.read";
             "scaler.agents.read": "scaler.agents.read";
@@ -499,12 +522,12 @@ export declare const dashboardAccessLogListResponseSchema: z.ZodObject<{
             "backend.sync.one": "backend.sync.one";
             "backend.test": "backend.test";
             "global_workflows.get.read": "global_workflows.get.read";
-            "global_workflows.update": "global_workflows.update";
+            "org_settings.dashboard_write_policy.update": "org_settings.dashboard_write_policy.update";
+            "cluster_name.update": "cluster_name.update";
             "access_log.list.read": "access_log.list.read";
             "event_dlq.list.read": "event_dlq.list.read";
-            "event_dlq.retry": "event_dlq.retry";
-            "event_dlq.discard": "event_dlq.discard";
             archive_chunk: "archive_chunk";
+            purge_chunk: "purge_chunk";
         }>;
         targetType: z.ZodNullable<z.ZodEnum<{
             run: "run";
@@ -522,6 +545,8 @@ export declare const dashboardAccessLogListResponseSchema: z.ZodObject<{
             held_run: "held_run";
             access_log: "access_log";
             event_dlq: "event_dlq";
+            org_settings: "org_settings";
+            cluster_meta: "cluster_meta";
         }>>;
         targetId: z.ZodNullable<z.ZodString>;
         requestId: z.ZodNullable<z.ZodString>;

package/dist/protocol/messages/access-log.js

@@ -42,7 +42,9 @@ const AccessLogTargetType = z.enum([
 	"scaler",
 	"held_run",
 	"access_log",
-	"event_dlq"
+	"event_dlq",
+	"org_settings",
+	"cluster_meta"
 ]);
 /**
 * Dotted-namespace action names. Every handler that writes an access_log
@@ -97,16 +99,19 @@ const AccessLogAction = z.enum([
 	"backend.test",
 	"global_workflows.get.read",
 	"global_workflows.update",
+	"org_settings.dashboard_write_policy.update",
+	"cluster_name.update",
 	"access_log.list.read",
 	"event_dlq.list.read",
 	"event_dlq.retry",
 	"event_dlq.discard",
-	"archive_chunk"
+	"archive_chunk",
+	"purge_chunk"
 ]);
 /**
 * Single row as surfaced to the dashboard / CLI. Includes optional
 * displayName/email for `user` and `platform_operator` actors — those are
-* resolved Platform-side by joining `actor_id` against the ZITADEL-backed
+* resolved Platform-side by joining `actor_id` against the Keycloak-backed
 * `users` table. The orchestrator never returns them; it emits a minimal
 * row and Platform enriches before forwarding to the browser.
 */

package/dist/protocol/messages/actor.js

@@ -20,14 +20,14 @@ const ActorType = z.enum([
 ]);
 const userActorSchema = z.object({
 	type: z.literal(ActorType.enum.user),
-	/** ZITADEL subject. */
+	/** Keycloak subject (idp_sub). */
 	sub: z.string().min(1)
 });
 const apiKeyActorSchema = z.object({
 	type: z.literal(ActorType.enum.api_key),
 	/** Opaque key identifier (not the secret). */
 	keyId: z.string().min(1),
-	/** ZITADEL sub of the human who owns this key. */
+	/** Keycloak sub of the human who owns this key. */
 	ownerSub: z.string().min(1)
 });
 const serviceAccountActorSchema = z.object({
@@ -37,7 +37,7 @@ const serviceAccountActorSchema = z.object({
 });
 const platformOperatorActorSchema = z.object({
 	type: z.literal(ActorType.enum.platform_operator),
-	/** ZITADEL sub of the SaaS operator performing break-glass access. */
+	/** Keycloak sub of the SaaS operator performing break-glass access. */
 	sub: z.string().min(1),
 	/**
 	* Free-text justification recorded in `access_log.actor_meta.reason`.

package/dist/protocol/messages/auth.d.ts

@@ -9,6 +9,31 @@ export declare const authRequestSchema: z.ZodObject<{
             coordinator: "coordinator";
             worker: "worker";
         }>>;
+        dashboardWrites: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
+            "secrets.set": "secrets.set";
+            "secrets.delete": "secrets.delete";
+            "secrets.scope.create": "secrets.scope.create";
+            "secrets.scope.rename": "secrets.scope.rename";
+            "secrets.scope.delete": "secrets.scope.delete";
+            "variables.set": "variables.set";
+            "variables.delete": "variables.delete";
+            "environments.create": "environments.create";
+            "environments.update": "environments.update";
+            "environments.delete": "environments.delete";
+            "environments.bindings.set": "environments.bindings.set";
+            "environments.source_overrides.set": "environments.source_overrides.set";
+            "environments.source_overrides.delete": "environments.source_overrides.delete";
+            "held_runs.approve": "held_runs.approve";
+            "held_runs.reject": "held_runs.reject";
+            "event_dlq.retry": "event_dlq.retry";
+            "event_dlq.discard": "event_dlq.discard";
+            "registration.disable": "registration.disable";
+            "registration.delete": "registration.delete";
+            "global_workflows.update": "global_workflows.update";
+            "backends.sync": "backends.sync";
+            "backends.sync_one": "backends.sync_one";
+            "backends.test": "backends.test";
+        }> & z.core.$partial, z.ZodBoolean>>;
     }, z.core.$loose>>;
 }, z.core.$strip>;
 /** Auth success response sent by Platform to orchestrator after successful authentication. */