@kici-dev/engine 0.1.26 → 0.2.0

package/dist/protocol/dashboard-write-operations.js

@@ -29,13 +29,13 @@ const DashboardWriteOperation = z.enum([
 	"secrets.scope.delete",
 	"variables.set",
 	"variables.delete",
-	"environments.create",
-	"environments.update",
-	"environments.test_access.set",
-	"environments.delete",
-	"environments.bindings.set",
-	"environments.source_overrides.set",
-	"environments.source_overrides.delete",
+	"contexts.create",
+	"contexts.update",
+	"contexts.test_access.set",
+	"contexts.delete",
+	"contexts.bindings.set",
+	"contexts.source_overrides.set",
+	"contexts.source_overrides.delete",
 	"held_runs.approve",
 	"held_runs.reject",
 	"event_dlq.retry",
@@ -59,13 +59,13 @@ const DASHBOARD_WRITE_OPERATION_VALUES = Object.freeze([
 	"secrets.scope.delete",
 	"variables.set",
 	"variables.delete",
-	"environments.create",
-	"environments.update",
-	"environments.test_access.set",
-	"environments.delete",
-	"environments.bindings.set",
-	"environments.source_overrides.set",
-	"environments.source_overrides.delete",
+	"contexts.create",
+	"contexts.update",
+	"contexts.test_access.set",
+	"contexts.delete",
+	"contexts.bindings.set",
+	"contexts.source_overrides.set",
+	"contexts.source_overrides.delete",
 	"held_runs.approve",
 	"held_runs.reject",
 	"event_dlq.retry",
@@ -83,7 +83,7 @@ const DASHBOARD_WRITE_OPERATION_VALUES = Object.freeze([
 const DashboardWriteCategory = z.enum([
 	"Secrets",
 	"Variables",
-	"Environments",
+	"Contexts",
 	"Bindings",
 	"Held runs",
 	"DLQ",
@@ -100,7 +100,7 @@ const DashboardWriteSensitivity = z.enum([
 const DASHBOARD_WRITE_OPERATIONS = Object.freeze([
 	{
 		name: "secrets.set",
-		wireMessageType: "dashboard.environments.secrets.set",
+		wireMessageType: "dashboard.contexts.secrets.set",
 		category: "Secrets",
 		label: "Set secret value",
 		sensitivity: "plaintext",
@@ -108,7 +108,7 @@ const DASHBOARD_WRITE_OPERATIONS = Object.freeze([
 	},
 	{
 		name: "secrets.delete",
-		wireMessageType: "dashboard.environments.secrets.delete",
+		wireMessageType: "dashboard.contexts.secrets.delete",
 		category: "Secrets",
 		label: "Delete secret",
 		sensitivity: "authority",
@@ -116,7 +116,7 @@ const DASHBOARD_WRITE_OPERATIONS = Object.freeze([
 	},
 	{
 		name: "secrets.scope.create",
-		wireMessageType: "dashboard.environments.secrets.scope.create",
+		wireMessageType: "dashboard.contexts.secrets.scope.create",
 		category: "Secrets",
 		label: "Create secret scope",
 		sensitivity: "authority",
@@ -124,7 +124,7 @@ const DASHBOARD_WRITE_OPERATIONS = Object.freeze([
 	},
 	{
 		name: "secrets.scope.rename",
-		wireMessageType: "dashboard.environments.secrets.scope.rename",
+		wireMessageType: "dashboard.contexts.secrets.scope.rename",
 		category: "Secrets",
 		label: "Rename secret scope",
 		sensitivity: "authority",
@@ -132,7 +132,7 @@ const DASHBOARD_WRITE_OPERATIONS = Object.freeze([
 	},
 	{
 		name: "secrets.scope.delete",
-		wireMessageType: "dashboard.environments.secrets.scope.delete",
+		wireMessageType: "dashboard.contexts.secrets.scope.delete",
 		category: "Secrets",
 		label: "Delete secret scope",
 		sensitivity: "authority",
@@ -140,7 +140,7 @@ const DASHBOARD_WRITE_OPERATIONS = Object.freeze([
 	},
 	{
 		name: "variables.set",
-		wireMessageType: "dashboard.environments.variables.set",
+		wireMessageType: "dashboard.contexts.variables.set",
 		category: "Variables",
 		label: "Set variable value",
 		sensitivity: "plaintext",
@@ -148,67 +148,67 @@ const DASHBOARD_WRITE_OPERATIONS = Object.freeze([
 	},
 	{
 		name: "variables.delete",
-		wireMessageType: "dashboard.environments.variables.delete",
+		wireMessageType: "dashboard.contexts.variables.delete",
 		category: "Variables",
 		label: "Delete variable",
 		sensitivity: "authority",
 		cliEquivalent: "kici-admin variable delete"
 	},
 	{
-		name: "environments.create",
-		wireMessageType: "dashboard.environments.create",
-		category: "Environments",
-		label: "Create environment",
+		name: "contexts.create",
+		wireMessageType: "dashboard.contexts.create",
+		category: "Contexts",
+		label: "Create context",
 		sensitivity: "authority",
-		cliEquivalent: "kici-admin environment create"
+		cliEquivalent: "kici-admin context create"
 	},
 	{
-		name: "environments.update",
-		wireMessageType: "dashboard.environments.update",
-		category: "Environments",
-		label: "Update environment",
+		name: "contexts.update",
+		wireMessageType: "dashboard.contexts.update",
+		category: "Contexts",
+		label: "Update context",
 		sensitivity: "authority",
-		cliEquivalent: "kici-admin environment set-policy"
+		cliEquivalent: "kici-admin context set-policy"
 	},
 	{
-		name: "environments.test_access.set",
-		wireMessageType: "dashboard.environments.test_access.set",
-		category: "Environments",
-		label: "Set environment test access",
+		name: "contexts.test_access.set",
+		wireMessageType: "dashboard.contexts.test_access.set",
+		category: "Contexts",
+		label: "Set context test access",
 		sensitivity: "authority",
-		cliEquivalent: "kici-admin environment set-policy --allow-local-execution"
+		cliEquivalent: "kici-admin context set-policy --allow-local-execution"
 	},
 	{
-		name: "environments.delete",
-		wireMessageType: "dashboard.environments.delete",
-		category: "Environments",
-		label: "Delete environment",
+		name: "contexts.delete",
+		wireMessageType: "dashboard.contexts.delete",
+		category: "Contexts",
+		label: "Delete context",
 		sensitivity: "authority",
-		cliEquivalent: "kici-admin environment delete"
+		cliEquivalent: "kici-admin context delete"
 	},
 	{
-		name: "environments.bindings.set",
-		wireMessageType: "dashboard.environments.bindings.set",
+		name: "contexts.bindings.set",
+		wireMessageType: "dashboard.contexts.bindings.set",
 		category: "Bindings",
-		label: "Set environment binding",
+		label: "Set context binding",
 		sensitivity: "authority",
-		cliEquivalent: "kici-admin environment bind"
+		cliEquivalent: "kici-admin context bind"
 	},
 	{
-		name: "environments.source_overrides.set",
-		wireMessageType: "dashboard.environments.source-overrides.set",
+		name: "contexts.source_overrides.set",
+		wireMessageType: "dashboard.contexts.source-overrides.set",
 		category: "Bindings",
 		label: "Set source override",
 		sensitivity: "authority",
-		cliEquivalent: "kici-admin environment source-override set"
+		cliEquivalent: "kici-admin context source-override set"
 	},
 	{
-		name: "environments.source_overrides.delete",
-		wireMessageType: "dashboard.environments.source-overrides.delete",
+		name: "contexts.source_overrides.delete",
+		wireMessageType: "dashboard.contexts.source-overrides.delete",
 		category: "Bindings",
 		label: "Delete source override",
 		sensitivity: "authority",
-		cliEquivalent: "kici-admin environment source-override delete"
+		cliEquivalent: "kici-admin context source-override delete"
 	},
 	{
 		name: "held_runs.approve",
@@ -331,36 +331,110 @@ function getDashboardWriteOperationsBySensitivity(sensitivity) {
 	return DASHBOARD_WRITE_OPERATIONS.filter((d) => d.sensitivity === sensitivity);
 }
 /**
-* Validates a sparse policy map. Use this where the value is required
-* but may be empty (e.g. the JSONB column on the orch). For optional
-* fields on outer schemas, embed `dashboardWritePolicyMap` directly
-* with `.optional()` so omission stays as `undefined` rather than being
-* coerced to `{}`.
+* Per-operation dashboard-write posture.
+*
+*   - `permissive` — the write is accepted and its plaintext value transits
+*     the hosted Platform process (today's default; the absent-key default).
+*   - `encrypted` — the write is accepted but the value is sealed in the
+*     browser to the orchestrator's published X25519 key, so the Platform
+*     relays only opaque ciphertext. Valid ONLY for `plaintext`-sensitivity
+*     operations (`secrets.set`, `variables.set`) — an operation with no
+*     plaintext payload has nothing to seal.
+*   - `disabled` — the write is refused; the operator must use the CLI.
+*
+* Absent from the sparse map ⇒ `permissive`.
+*/
+const DashboardWritePolicyState = z.enum([
+	"permissive",
+	"encrypted",
+	"disabled"
+]);
+/**
+* Coerce a single stored / on-the-wire policy value to a
+* {@link DashboardWritePolicyState}. Older orchestrators (and pre-migration
+* JSONB rows) carry the legacy boolean shape: `true` (enabled/permissive) and
+* `false` (disabled). New peers carry the enum string directly. This keeps the
+* protected wire + storage surfaces backward-compatible during the deprecation
+* window — a boolean is never rejected, it is translated.
 */
-const dashboardWritePolicyMap = z.partialRecord(DashboardWriteOperation, z.boolean());
+function coerceDashboardWritePolicyValue(value) {
+	if (value === true) return "permissive";
+	if (value === false) return "disabled";
+	const parsed = DashboardWritePolicyState.safeParse(value);
+	return parsed.success ? parsed.data : "permissive";
+}
+/**
+* Validates a sparse policy map. Accepts BOTH the enum-string shape and the
+* legacy boolean shape (coerced), so an older orchestrator's boolean map and a
+* pre-migration JSONB row both parse. `encrypted` is rejected for any operation
+* whose sensitivity is not `plaintext` (nothing to seal without a plaintext
+* payload; the signing half that would cover authority/dispatch ops is a
+* separate feature). Use this where the value is required but may be empty
+* (e.g. the JSONB column on the orch). For optional fields on outer schemas,
+* embed `dashboardWritePolicyMap` directly with `.optional()` so omission stays
+* as `undefined` rather than being coerced to `{}`.
+*/
+const dashboardWritePolicyMap = z.partialRecord(DashboardWriteOperation, z.union([z.boolean(), DashboardWritePolicyState])).transform((map) => {
+	const out = {};
+	for (const [op, value] of Object.entries(map)) out[op] = coerceDashboardWritePolicyValue(value);
+	return out;
+}).superRefine((map, ctx) => {
+	for (const [op, state] of Object.entries(map)) {
+		if (state !== "encrypted") continue;
+		if (DASHBOARD_WRITE_OPERATIONS_BY_NAME.get(op)?.sensitivity !== "plaintext") ctx.addIssue({
+			code: "custom",
+			message: `"encrypted" is only valid for plaintext operations, not "${op}"`,
+			path: [op]
+		});
+	}
+});
 const dashboardWritePolicyMapSchema = dashboardWritePolicyMap.default({});
 /**
-* Resolve the effective state of an operation given a (possibly sparse)
-* policy map. Treats `undefined` as enabled by the permissive default.
+* Resolve the effective posture of an operation given a (possibly sparse)
+* policy map. Treats `undefined` as the permissive default.
+*/
+function resolvePolicyState(policy, op) {
+	const raw = policy?.[op];
+	if (raw === void 0) return "permissive";
+	return coerceDashboardWritePolicyValue(raw);
+}
+/**
+* Resolve the effective enabled state of an operation. `true` unless the
+* posture is `disabled`. Convenience for the many read-only "may this write
+* proceed at all?" call sites.
 */
 function isDashboardWriteOperationEnabled(policy, op) {
-	if (!policy) return true;
-	const explicit = policy[op];
-	return explicit === void 0 ? true : explicit;
+	return resolvePolicyState(policy, op) !== "disabled";
+}
+/** True only when the operation's posture is `encrypted`. */
+function isEncryptedState(policy, op) {
+	return resolvePolicyState(policy, op) === "encrypted";
 }
 /**
-* Expand a (possibly sparse) policy map into the full effective state
-* for all 27 operations. Operations the policy doesn't mention come
-* back as `true` (permissive). Used by the orch HTTP admin response,
-* the WS `orch.capabilities` broadcast, and the dashboard's policy
-* page so consumers see the full picture, not the sparse storage shape.
+* Expand a (possibly sparse) policy map into the full effective enabled
+* boolean for all 27 operations. Operations the policy doesn't mention come
+* back as `true` (permissive). Retained for existing consumers that only need
+* the enabled/disabled bit; {@link resolveFullPolicyStateView} exposes the
+* richer tri-state.
 */
 function resolveFullPolicyView(policy) {
 	const out = {};
 	for (const descriptor of DASHBOARD_WRITE_OPERATIONS) out[descriptor.name] = isDashboardWriteOperationEnabled(policy, descriptor.name);
 	return out;
 }
+/**
+* Expand a (possibly sparse) policy map into the full tri-state posture for
+* all 27 operations. Used by the orch HTTP admin response, the WS
+* `orch.capabilities` broadcast, and the dashboard's policy page so consumers
+* see the full picture (including which plaintext ops are `encrypted`), not the
+* sparse storage shape.
+*/
+function resolveFullPolicyStateView(policy) {
+	const out = {};
+	for (const descriptor of DASHBOARD_WRITE_OPERATIONS) out[descriptor.name] = resolvePolicyState(policy, descriptor.name);
+	return out;
+}
 //#endregion
-export { DASHBOARD_WRITE_OPERATIONS, DASHBOARD_WRITE_OPERATIONS_BY_NAME, DASHBOARD_WRITE_OPERATIONS_BY_WIRE_TYPE, DASHBOARD_WRITE_OPERATION_VALUES, DashboardWriteCategory, DashboardWriteOperation, DashboardWriteSensitivity, dashboardWritePolicyMap, dashboardWritePolicyMapSchema, getDashboardWriteOperationDescriptor, getDashboardWriteOperationsByCategory, getDashboardWriteOperationsBySensitivity, isDashboardWriteOperationEnabled, resolveFullPolicyView };
+export { DASHBOARD_WRITE_OPERATIONS, DASHBOARD_WRITE_OPERATIONS_BY_NAME, DASHBOARD_WRITE_OPERATIONS_BY_WIRE_TYPE, DASHBOARD_WRITE_OPERATION_VALUES, DashboardWriteCategory, DashboardWriteOperation, DashboardWritePolicyState, DashboardWriteSensitivity, coerceDashboardWritePolicyValue, dashboardWritePolicyMap, dashboardWritePolicyMapSchema, getDashboardWriteOperationDescriptor, getDashboardWriteOperationsByCategory, getDashboardWriteOperationsBySensitivity, isDashboardWriteOperationEnabled, isEncryptedState, resolveFullPolicyStateView, resolveFullPolicyView, resolvePolicyState };
 
 //# sourceMappingURL=dashboard-write-operations.js.map