@kici-dev/engine 0.1.26 → 0.2.0

package/dist/metrics/metric-kind-compat.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The metric-kind vocabulary shared by the orchestrator's push reporter, the
+ * Platform's admission filter, and the runtime-metrics drift guard.
+ *
+ * The catalog records the OTel instrument kind (`observableGauge`, …) while the
+ * wire carries a narrower set, so admission needs a compatibility relation
+ * rather than equality. Keeping one implementation is what stops the guard and
+ * the runtime path from disagreeing about which series are admissible.
+ */
+/** Metric kinds that appear on the orchestrator → Platform wire. */
+export type WireMetricKind = 'counter' | 'histogram' | 'gauge' | 'upDownCounter';
+/**
+ * OTel `DataPointType` enum values, mirrored as plain numbers so this module
+ * stays dependency-free. `@opentelemetry/sdk-metrics` is not an engine
+ * dependency and must not become one.
+ */
+export declare const OTEL_DATA_POINT_TYPE: {
+    readonly HISTOGRAM: 0;
+    readonly GAUGE: 2;
+    readonly SUM: 3;
+};
+/** Derive the wire kind from an OTel descriptor's data-point type. */
+export declare function mapDataPointTypeToWireKind(dataPointType: number, isMonotonic?: boolean): WireMetricKind;
+/** True when a wire kind may be admitted against a catalogued instrument kind. */
+export declare function isCompatibleMetricKind(wire: WireMetricKind, catalog: string): boolean;
+//# sourceMappingURL=metric-kind-compat.d.ts.map

package/dist/metrics/metric-kind-compat.js

@@ -0,0 +1,33 @@
+import "../rolldown-runtime-ClRpJifh.js";
+//#region src/metrics/metric-kind-compat.ts
+/**
+* OTel `DataPointType` enum values, mirrored as plain numbers so this module
+* stays dependency-free. `@opentelemetry/sdk-metrics` is not an engine
+* dependency and must not become one.
+*/
+const OTEL_DATA_POINT_TYPE = {
+	HISTOGRAM: 0,
+	GAUGE: 2,
+	SUM: 3
+};
+/** Derive the wire kind from an OTel descriptor's data-point type. */
+function mapDataPointTypeToWireKind(dataPointType, isMonotonic) {
+	switch (dataPointType) {
+		case OTEL_DATA_POINT_TYPE.HISTOGRAM: return "histogram";
+		case OTEL_DATA_POINT_TYPE.GAUGE: return "gauge";
+		case OTEL_DATA_POINT_TYPE.SUM: return isMonotonic === false ? "upDownCounter" : "counter";
+		default: return "gauge";
+	}
+}
+/** True when a wire kind may be admitted against a catalogued instrument kind. */
+function isCompatibleMetricKind(wire, catalog) {
+	if (wire === catalog) return true;
+	if (wire === "gauge" && catalog === "observableGauge") return true;
+	if (wire === "counter" && catalog === "observableCounter") return true;
+	if (wire === "upDownCounter" && catalog === "observableUpDownCounter") return true;
+	return false;
+}
+//#endregion
+export { OTEL_DATA_POINT_TYPE, isCompatibleMetricKind, mapDataPointTypeToWireKind };
+
+//# sourceMappingURL=metric-kind-compat.js.map

package/dist/protocol/analytics-events.d.ts

@@ -1,16 +1,16 @@
 import { z } from 'zod';
 export declare const AnalyticsEvent: z.ZodEnum<{
+    billing_plan_selected: "billing_plan_selected";
+    code_copy: "code_copy";
+    cta_dashboard: "cta_dashboard";
+    docs_search: "docs_search";
     login: "login";
     org_created: "org_created";
+    run_viewed: "run_viewed";
     secret_created: "secret_created";
     workflow_run_triggered: "workflow_run_triggered";
-    run_viewed: "run_viewed";
-    billing_plan_selected: "billing_plan_selected";
-    code_copy: "code_copy";
-    docs_search: "docs_search";
-    cta_dashboard: "cta_dashboard";
 }>;
 export type AnalyticsEvent = z.infer<typeof AnalyticsEvent>;
 /** The catalogue as a plain array (for build-time mirroring + tests). */
-export declare const ANALYTICS_EVENTS: ("login" | "org_created" | "secret_created" | "workflow_run_triggered" | "run_viewed" | "billing_plan_selected" | "code_copy" | "docs_search" | "cta_dashboard")[];
+export declare const ANALYTICS_EVENTS: ("billing_plan_selected" | "code_copy" | "cta_dashboard" | "docs_search" | "login" | "org_created" | "run_viewed" | "secret_created" | "workflow_run_triggered")[];
 //# sourceMappingURL=analytics-events.d.ts.map

package/dist/protocol/dashboard-api-errors.d.ts

@@ -0,0 +1,13 @@
+import { z } from 'zod';
+/**
+ * Structured `error` codes the Platform dashboard API returns in a JSON body,
+ * which the dashboard SPA special-cases when rendering. Shared so the emit
+ * sites (Platform) and the match site (dashboard) never drift on the literal.
+ */
+export declare const DashboardApiErrorCode: z.ZodEnum<{
+    orchestrator_not_found: "orchestrator_not_found";
+    run_outside_retention: "run_outside_retention";
+    session_max_age_exceeded: "session_max_age_exceeded";
+}>;
+export type DashboardApiErrorCode = z.infer<typeof DashboardApiErrorCode>;
+//# sourceMappingURL=dashboard-api-errors.d.ts.map

package/dist/protocol/dashboard-api-errors.js

@@ -0,0 +1,17 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { z } from "zod";
+//#region src/protocol/dashboard-api-errors.ts
+/**
+* Structured `error` codes the Platform dashboard API returns in a JSON body,
+* which the dashboard SPA special-cases when rendering. Shared so the emit
+* sites (Platform) and the match site (dashboard) never drift on the literal.
+*/
+const DashboardApiErrorCode = z.enum([
+	"orchestrator_not_found",
+	"session_max_age_exceeded",
+	"run_outside_retention"
+]);
+//#endregion
+export { DashboardApiErrorCode };
+
+//# sourceMappingURL=dashboard-api-errors.js.map

package/dist/protocol/dashboard-write-operations.d.ts

@@ -20,54 +20,54 @@
  */
 import { z } from 'zod';
 export declare const DashboardWriteOperation: z.ZodEnum<{
-    "secrets.set": "secrets.set";
-    "secrets.delete": "secrets.delete";
-    "secrets.scope.create": "secrets.scope.create";
-    "secrets.scope.rename": "secrets.scope.rename";
-    "secrets.scope.delete": "secrets.scope.delete";
-    "variables.set": "variables.set";
-    "variables.delete": "variables.delete";
-    "environments.create": "environments.create";
-    "environments.update": "environments.update";
-    "environments.test_access.set": "environments.test_access.set";
-    "environments.delete": "environments.delete";
-    "environments.bindings.set": "environments.bindings.set";
-    "environments.source_overrides.set": "environments.source_overrides.set";
-    "environments.source_overrides.delete": "environments.source_overrides.delete";
-    "held_runs.approve": "held_runs.approve";
-    "held_runs.reject": "held_runs.reject";
-    "event_dlq.retry": "event_dlq.retry";
-    "event_dlq.discard": "event_dlq.discard";
     "attestations.retry": "attestations.retry";
-    "registration.disable": "registration.disable";
-    "registration.delete": "registration.delete";
-    "global_workflows.update": "global_workflows.update";
     "backends.sync": "backends.sync";
     "backends.sync_one": "backends.sync_one";
     "backends.test": "backends.test";
+    "contexts.bindings.set": "contexts.bindings.set";
+    "contexts.create": "contexts.create";
+    "contexts.delete": "contexts.delete";
+    "contexts.source_overrides.delete": "contexts.source_overrides.delete";
+    "contexts.source_overrides.set": "contexts.source_overrides.set";
+    "contexts.test_access.set": "contexts.test_access.set";
+    "contexts.update": "contexts.update";
+    "event_dlq.discard": "event_dlq.discard";
+    "event_dlq.retry": "event_dlq.retry";
     "fleet.host.declare": "fleet.host.declare";
     "fleet.host.remove": "fleet.host.remove";
+    "global_workflows.update": "global_workflows.update";
+    "held_runs.approve": "held_runs.approve";
+    "held_runs.reject": "held_runs.reject";
+    "registration.delete": "registration.delete";
+    "registration.disable": "registration.disable";
+    "secrets.delete": "secrets.delete";
+    "secrets.scope.create": "secrets.scope.create";
+    "secrets.scope.delete": "secrets.scope.delete";
+    "secrets.scope.rename": "secrets.scope.rename";
+    "secrets.set": "secrets.set";
+    "variables.delete": "variables.delete";
+    "variables.set": "variables.set";
 }>;
 export type DashboardWriteOperation = z.infer<typeof DashboardWriteOperation>;
 /** Stable list of every operation in enum-declaration order. */
 export declare const DASHBOARD_WRITE_OPERATION_VALUES: readonly DashboardWriteOperation[];
 export declare const DashboardWriteCategory: z.ZodEnum<{
-    Secrets: "Secrets";
-    Variables: "Variables";
-    Environments: "Environments";
+    Attestations: "Attestations";
     Bindings: "Bindings";
-    "Held runs": "Held runs";
+    Contexts: "Contexts";
     DLQ: "DLQ";
-    Attestations: "Attestations";
+    Fleet: "Fleet";
+    "Held runs": "Held runs";
     Registrations: "Registrations";
+    Secrets: "Secrets";
     Topology: "Topology";
-    Fleet: "Fleet";
+    Variables: "Variables";
 }>;
 export type DashboardWriteCategory = z.infer<typeof DashboardWriteCategory>;
 export declare const DashboardWriteSensitivity: z.ZodEnum<{
-    plaintext: "plaintext";
     authority: "authority";
     dispatch: "dispatch";
+    plaintext: "plaintext";
 }>;
 export type DashboardWriteSensitivity = z.infer<typeof DashboardWriteSensitivity>;
 /**
@@ -98,87 +98,144 @@ export declare function getDashboardWriteOperationDescriptor(op: DashboardWriteO
 export declare function getDashboardWriteOperationsByCategory(category: DashboardWriteCategory): readonly DashboardWriteOperationDescriptor[];
 export declare function getDashboardWriteOperationsBySensitivity(sensitivity: DashboardWriteSensitivity): readonly DashboardWriteOperationDescriptor[];
 /**
- * Map of operation → enabled flag. Omitted operations default to true
- * (permissive). The orch persists this shape verbatim as JSONB; the
- * Platform mirrors it in its per-org cache.
+ * Per-operation dashboard-write posture.
+ *
+ *   - `permissive` — the write is accepted and its plaintext value transits
+ *     the hosted Platform process (today's default; the absent-key default).
+ *   - `encrypted` — the write is accepted but the value is sealed in the
+ *     browser to the orchestrator's published X25519 key, so the Platform
+ *     relays only opaque ciphertext. Valid ONLY for `plaintext`-sensitivity
+ *     operations (`secrets.set`, `variables.set`) — an operation with no
+ *     plaintext payload has nothing to seal.
+ *   - `disabled` — the write is refused; the operator must use the CLI.
+ *
+ * Absent from the sparse map ⇒ `permissive`.
  */
-export type DashboardWritePolicyMap = Partial<Record<DashboardWriteOperation, boolean>>;
+export declare const DashboardWritePolicyState: z.ZodEnum<{
+    disabled: "disabled";
+    encrypted: "encrypted";
+    permissive: "permissive";
+}>;
+export type DashboardWritePolicyState = z.infer<typeof DashboardWritePolicyState>;
 /**
- * Validates a sparse policy map. Use this where the value is required
- * but may be empty (e.g. the JSONB column on the orch). For optional
- * fields on outer schemas, embed `dashboardWritePolicyMap` directly
- * with `.optional()` so omission stays as `undefined` rather than being
- * coerced to `{}`.
+ * Coerce a single stored / on-the-wire policy value to a
+ * {@link DashboardWritePolicyState}. Older orchestrators (and pre-migration
+ * JSONB rows) carry the legacy boolean shape: `true` (enabled/permissive) and
+ * `false` (disabled). New peers carry the enum string directly. This keeps the
+ * protected wire + storage surfaces backward-compatible during the deprecation
+ * window — a boolean is never rejected, it is translated.
  */
-export declare const dashboardWritePolicyMap: z.ZodRecord<z.ZodEnum<{
-    "secrets.set": "secrets.set";
-    "secrets.delete": "secrets.delete";
-    "secrets.scope.create": "secrets.scope.create";
-    "secrets.scope.rename": "secrets.scope.rename";
-    "secrets.scope.delete": "secrets.scope.delete";
-    "variables.set": "variables.set";
-    "variables.delete": "variables.delete";
-    "environments.create": "environments.create";
-    "environments.update": "environments.update";
-    "environments.test_access.set": "environments.test_access.set";
-    "environments.delete": "environments.delete";
-    "environments.bindings.set": "environments.bindings.set";
-    "environments.source_overrides.set": "environments.source_overrides.set";
-    "environments.source_overrides.delete": "environments.source_overrides.delete";
-    "held_runs.approve": "held_runs.approve";
-    "held_runs.reject": "held_runs.reject";
-    "event_dlq.retry": "event_dlq.retry";
-    "event_dlq.discard": "event_dlq.discard";
+export declare function coerceDashboardWritePolicyValue(value: unknown): DashboardWritePolicyState;
+/**
+ * Map of operation → posture. Omitted operations default to `permissive`.
+ * The orch persists this shape verbatim as JSONB; the Platform mirrors it in
+ * its per-org cache.
+ */
+export type DashboardWritePolicyMap = Partial<Record<DashboardWriteOperation, DashboardWritePolicyState>>;
+/**
+ * Validates a sparse policy map. Accepts BOTH the enum-string shape and the
+ * legacy boolean shape (coerced), so an older orchestrator's boolean map and a
+ * pre-migration JSONB row both parse. `encrypted` is rejected for any operation
+ * whose sensitivity is not `plaintext` (nothing to seal without a plaintext
+ * payload; the signing half that would cover authority/dispatch ops is a
+ * separate feature). Use this where the value is required but may be empty
+ * (e.g. the JSONB column on the orch). For optional fields on outer schemas,
+ * embed `dashboardWritePolicyMap` directly with `.optional()` so omission stays
+ * as `undefined` rather than being coerced to `{}`.
+ */
+export declare const dashboardWritePolicyMap: z.ZodPipe<z.ZodRecord<z.ZodEnum<{
     "attestations.retry": "attestations.retry";
-    "registration.disable": "registration.disable";
-    "registration.delete": "registration.delete";
-    "global_workflows.update": "global_workflows.update";
     "backends.sync": "backends.sync";
     "backends.sync_one": "backends.sync_one";
     "backends.test": "backends.test";
+    "contexts.bindings.set": "contexts.bindings.set";
+    "contexts.create": "contexts.create";
+    "contexts.delete": "contexts.delete";
+    "contexts.source_overrides.delete": "contexts.source_overrides.delete";
+    "contexts.source_overrides.set": "contexts.source_overrides.set";
+    "contexts.test_access.set": "contexts.test_access.set";
+    "contexts.update": "contexts.update";
+    "event_dlq.discard": "event_dlq.discard";
+    "event_dlq.retry": "event_dlq.retry";
     "fleet.host.declare": "fleet.host.declare";
     "fleet.host.remove": "fleet.host.remove";
-}> & z.core.$partial, z.ZodBoolean>;
-export declare const dashboardWritePolicyMapSchema: z.ZodDefault<z.ZodRecord<z.ZodEnum<{
-    "secrets.set": "secrets.set";
+    "global_workflows.update": "global_workflows.update";
+    "held_runs.approve": "held_runs.approve";
+    "held_runs.reject": "held_runs.reject";
+    "registration.delete": "registration.delete";
+    "registration.disable": "registration.disable";
     "secrets.delete": "secrets.delete";
     "secrets.scope.create": "secrets.scope.create";
-    "secrets.scope.rename": "secrets.scope.rename";
     "secrets.scope.delete": "secrets.scope.delete";
-    "variables.set": "variables.set";
+    "secrets.scope.rename": "secrets.scope.rename";
+    "secrets.set": "secrets.set";
     "variables.delete": "variables.delete";
-    "environments.create": "environments.create";
-    "environments.update": "environments.update";
-    "environments.test_access.set": "environments.test_access.set";
-    "environments.delete": "environments.delete";
-    "environments.bindings.set": "environments.bindings.set";
-    "environments.source_overrides.set": "environments.source_overrides.set";
-    "environments.source_overrides.delete": "environments.source_overrides.delete";
-    "held_runs.approve": "held_runs.approve";
-    "held_runs.reject": "held_runs.reject";
-    "event_dlq.retry": "event_dlq.retry";
-    "event_dlq.discard": "event_dlq.discard";
+    "variables.set": "variables.set";
+}> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodEnum<{
+    disabled: "disabled";
+    encrypted: "encrypted";
+    permissive: "permissive";
+}>]>>, z.ZodTransform<Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive">>, Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive" | boolean>>>>;
+export declare const dashboardWritePolicyMapSchema: z.ZodDefault<z.ZodPipe<z.ZodRecord<z.ZodEnum<{
     "attestations.retry": "attestations.retry";
-    "registration.disable": "registration.disable";
-    "registration.delete": "registration.delete";
-    "global_workflows.update": "global_workflows.update";
     "backends.sync": "backends.sync";
     "backends.sync_one": "backends.sync_one";
     "backends.test": "backends.test";
+    "contexts.bindings.set": "contexts.bindings.set";
+    "contexts.create": "contexts.create";
+    "contexts.delete": "contexts.delete";
+    "contexts.source_overrides.delete": "contexts.source_overrides.delete";
+    "contexts.source_overrides.set": "contexts.source_overrides.set";
+    "contexts.test_access.set": "contexts.test_access.set";
+    "contexts.update": "contexts.update";
+    "event_dlq.discard": "event_dlq.discard";
+    "event_dlq.retry": "event_dlq.retry";
     "fleet.host.declare": "fleet.host.declare";
     "fleet.host.remove": "fleet.host.remove";
-}> & z.core.$partial, z.ZodBoolean>>;
+    "global_workflows.update": "global_workflows.update";
+    "held_runs.approve": "held_runs.approve";
+    "held_runs.reject": "held_runs.reject";
+    "registration.delete": "registration.delete";
+    "registration.disable": "registration.disable";
+    "secrets.delete": "secrets.delete";
+    "secrets.scope.create": "secrets.scope.create";
+    "secrets.scope.delete": "secrets.scope.delete";
+    "secrets.scope.rename": "secrets.scope.rename";
+    "secrets.set": "secrets.set";
+    "variables.delete": "variables.delete";
+    "variables.set": "variables.set";
+}> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodEnum<{
+    disabled: "disabled";
+    encrypted: "encrypted";
+    permissive: "permissive";
+}>]>>, z.ZodTransform<Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive">>, Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive" | boolean>>>>>;
+/**
+ * Resolve the effective posture of an operation given a (possibly sparse)
+ * policy map. Treats `undefined` as the permissive default.
+ */
+export declare function resolvePolicyState(policy: DashboardWritePolicyMap | null | undefined, op: DashboardWriteOperation): DashboardWritePolicyState;
 /**
- * Resolve the effective state of an operation given a (possibly sparse)
- * policy map. Treats `undefined` as enabled by the permissive default.
+ * Resolve the effective enabled state of an operation. `true` unless the
+ * posture is `disabled`. Convenience for the many read-only "may this write
+ * proceed at all?" call sites.
  */
 export declare function isDashboardWriteOperationEnabled(policy: DashboardWritePolicyMap | null | undefined, op: DashboardWriteOperation): boolean;
+/** True only when the operation's posture is `encrypted`. */
+export declare function isEncryptedState(policy: DashboardWritePolicyMap | null | undefined, op: DashboardWriteOperation): boolean;
 /**
- * Expand a (possibly sparse) policy map into the full effective state
- * for all 27 operations. Operations the policy doesn't mention come
- * back as `true` (permissive). Used by the orch HTTP admin response,
- * the WS `orch.capabilities` broadcast, and the dashboard's policy
- * page so consumers see the full picture, not the sparse storage shape.
+ * Expand a (possibly sparse) policy map into the full effective enabled
+ * boolean for all 27 operations. Operations the policy doesn't mention come
+ * back as `true` (permissive). Retained for existing consumers that only need
+ * the enabled/disabled bit; {@link resolveFullPolicyStateView} exposes the
+ * richer tri-state.
  */
 export declare function resolveFullPolicyView(policy: DashboardWritePolicyMap | null | undefined): Record<DashboardWriteOperation, boolean>;
+/**
+ * Expand a (possibly sparse) policy map into the full tri-state posture for
+ * all 27 operations. Used by the orch HTTP admin response, the WS
+ * `orch.capabilities` broadcast, and the dashboard's policy page so consumers
+ * see the full picture (including which plaintext ops are `encrypted`), not the
+ * sparse storage shape.
+ */
+export declare function resolveFullPolicyStateView(policy: DashboardWritePolicyMap | null | undefined): Record<DashboardWriteOperation, DashboardWritePolicyState>;
 //# sourceMappingURL=dashboard-write-operations.d.ts.map