@toshicloud/sdk 0.4.0 → 0.5.1

package/dist/gen/toshi/workspace/v1/artifacts_pb.d.ts

@@ -89,7 +89,9 @@ export type Artifact = Message<"toshi.workspace.v1.Artifact"> & {
     completedAt?: Timestamp | undefined;
     /**
      * The kind of workload that uploaded it, as its token named: job or
-     * sandbox. workload_id and execution_id are that workload's.
+     * sandbox. workload_id and execution_id are that workload's. A CI
+     * job runs no workload, and its token names the kind job with the
+     * host job's own id: its artifacts' workload_id is that id.
      *
      * @generated from field: string workload_kind = 16;
      */
@@ -178,7 +180,9 @@ export type ArtifactJson = {
     completedAt?: TimestampJson;
     /**
      * The kind of workload that uploaded it, as its token named: job or
-     * sandbox. workload_id and execution_id are that workload's.
+     * sandbox. workload_id and execution_id are that workload's. A CI
+     * job runs no workload, and its token names the kind job with the
+     * host job's own id: its artifacts' workload_id is that id.
      *
      * @generated from field: string workload_kind = 16;
      */
@@ -755,12 +759,14 @@ export declare const GetArtifactDownloadURLResponseSchema: GenMessage<GetArtifac
 /**
  * ArtifactUploadService is how a job uploads what it recorded:
  * it reserves an artifact, uploads each part to a presigned URL, and
- * completes the upload. The caller is the workload itself: every call
- * carries a workload identity token for the audience
- * "toshi:artifacts", and the tenant, project, environment, workload and
- * execution of the artifact are the token's claims, never the request's.
- * A token of another audience, a display token, an expired token, or one
- * that names no workload is refused with UNAUTHENTICATED. A workspace that
+ * completes the upload. The caller is the workload itself, with a
+ * workload identity token for the audience "toshi:artifacts", or a host
+ * storing a recording's strip, with that strip's upload token for the
+ * audience "toshi:recordings". The workspace, project, environment,
+ * workload and execution of the artifact are the token's claims, or the
+ * recording's, never the request's. Another token, a display token, an
+ * expired token, or one that names no workload is refused with
+ * UNAUTHENTICATED. A workspace that
  * is suspended or being deleted is refused with FAILED_PRECONDITION.
  *
  * The data key and the presigned URLs are the only values either call

package/dist/gen/toshi/workspace/v1/artifacts_pb.js

@@ -3,11 +3,12 @@
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
 import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import { file_toshi_permission } from "../../permission_pb.js";
 import { file_toshi_workspace_v1_recordings } from "./recordings_pb.js";
 /**
  * Describes the file toshi/workspace/v1/artifacts.proto.
  */
-export const file_toshi_workspace_v1_artifacts = /*@__PURE__*/ fileDesc("CiJ0b3NoaS93b3Jrc3BhY2UvdjEvYXJ0aWZhY3RzLnByb3RvEhJ0b3NoaS53b3Jrc3BhY2UudjEi9wIKCEFydGlmYWN0EgoKAmlkGAEgASgJEhIKCnByb2plY3RfaWQYAiABKAkSFgoOZW52aXJvbm1lbnRfaWQYAyABKAkSEwoLd29ya2xvYWRfaWQYBCABKAkSFAoMZXhlY3V0aW9uX2lkGAUgASgJEgwKBGtpbmQYBiABKAkSDAoEbmFtZRgHIAEoCRIUCgxjb250ZW50X3R5cGUYCCABKAkSEgoKcGFydF9jb3VudBgJIAEoAxISCgpwYXJ0X3NpemVzGAogAygDEhIKCmluZGV4X3NpemUYCyABKAMSDQoFc3RhdGUYDCABKAkSEgoKZW5jcnlwdGlvbhgNIAEoCRIuCgpjcmVhdGVkX2F0GA4gASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIwCgxjb21wbGV0ZWRfYXQYDyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhUKDXdvcmtsb2FkX2tpbmQYECABKAkizQEKBlVwbG9hZBIMCgRwYXJ0GAEgASgJEg4KBm1ldGhvZBgCIAEoCRILCgN1cmwYAyABKAkSOAoHaGVhZGVycxgEIAMoCzInLnRvc2hpLndvcmtzcGFjZS52MS5VcGxvYWQuSGVhZGVyc0VudHJ5Ei4KCmV4cGlyZXNfYXQYBSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wGi4KDEhlYWRlcnNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIqYBChRSZXNlcnZlVXBsb2FkUmVxdWVzdBIMCgRraW5kGAEgASgJEgwKBG5hbWUYAiABKAkSFAoMY29udGVudF90eXBlGAMgASgJEhIKCnBhcnRfc2l6ZXMYBCADKAMSEgoKaW5kZXhfc2l6ZRgFIAEoAxI0CglyZWNvcmRpbmcYBiABKA4yIS50b3NoaS53b3Jrc3BhY2UudjEuUmVjb3JkaW5nS2luZCLKAQoVUmVzZXJ2ZVVwbG9hZFJlc3BvbnNlEhMKC2FydGlmYWN0X2lkGAEgASgJEisKB3VwbG9hZHMYAiADKAsyGi50b3NoaS53b3Jrc3BhY2UudjEuVXBsb2FkEjMKD3VwbG9hZF9kZWFkbGluZRgDIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASEgoKZW5jcnlwdGlvbhgEIAEoCRIQCghkYXRhX2tleRgFIAEoDBIUCgxndWVzdF91cGxvYWQYBiABKAgiLAoVQ29tcGxldGVVcGxvYWRSZXF1ZXN0EhMKC2FydGlmYWN0X2lkGAEgASgJIkgKFkNvbXBsZXRlVXBsb2FkUmVzcG9uc2USLgoIYXJ0aWZhY3QYASABKAsyHC50b3NoaS53b3Jrc3BhY2UudjEuQXJ0aWZhY3QiogEKFExpc3RBcnRpZmFjdHNSZXF1ZXN0EhIKCnByb2plY3RfaWQYASABKAkSFgoOZW52aXJvbm1lbnRfaWQYAiABKAkSEwoLd29ya2xvYWRfaWQYAyABKAkSFAoMZXhlY3V0aW9uX2lkGAQgASgJEgwKBGtpbmQYBSABKAkSEQoJcGFnZV9zaXplGAYgASgFEhIKCnBhZ2VfdG9rZW4YByABKAkiYQoVTGlzdEFydGlmYWN0c1Jlc3BvbnNlEi8KCWFydGlmYWN0cxgBIAMoCzIcLnRvc2hpLndvcmtzcGFjZS52MS5BcnRpZmFjdBIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkiKQoSR2V0QXJ0aWZhY3RSZXF1ZXN0EhMKC2FydGlmYWN0X2lkGAEgASgJIkUKE0dldEFydGlmYWN0UmVzcG9uc2USLgoIYXJ0aWZhY3QYASABKAsyHC50b3NoaS53b3Jrc3BhY2UudjEuQXJ0aWZhY3QiVwodR2V0QXJ0aWZhY3REb3dubG9hZFVSTFJlcXVlc3QSEwoLYXJ0aWZhY3RfaWQYASABKAkSDAoEcGFydBgCIAEoCRITCgt0dGxfc2Vjb25kcxgDIAEoAyKDAQoeR2V0QXJ0aWZhY3REb3dubG9hZFVSTFJlc3BvbnNlEgsKA3VybBgBIAEoCRIuCgpleHBpcmVzX2F0GAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBISCgplbmNyeXB0aW9uGAMgASgJEhAKCGRhdGFfa2V5GAQgASgMMuYBChVBcnRpZmFjdFVwbG9hZFNlcnZpY2USZAoNUmVzZXJ2ZVVwbG9hZBIoLnRvc2hpLndvcmtzcGFjZS52MS5SZXNlcnZlVXBsb2FkUmVxdWVzdBopLnRvc2hpLndvcmtzcGFjZS52MS5SZXNlcnZlVXBsb2FkUmVzcG9uc2USZwoOQ29tcGxldGVVcGxvYWQSKS50b3NoaS53b3Jrc3BhY2UudjEuQ29tcGxldGVVcGxvYWRSZXF1ZXN0GioudG9zaGkud29ya3NwYWNlLnYxLkNvbXBsZXRlVXBsb2FkUmVzcG9uc2Uy2AIKD0FydGlmYWN0U2VydmljZRJkCg1MaXN0QXJ0aWZhY3RzEigudG9zaGkud29ya3NwYWNlLnYxLkxpc3RBcnRpZmFjdHNSZXF1ZXN0GikudG9zaGkud29ya3NwYWNlLnYxLkxpc3RBcnRpZmFjdHNSZXNwb25zZRJeCgtHZXRBcnRpZmFjdBImLnRvc2hpLndvcmtzcGFjZS52MS5HZXRBcnRpZmFjdFJlcXVlc3QaJy50b3NoaS53b3Jrc3BhY2UudjEuR2V0QXJ0aWZhY3RSZXNwb25zZRJ/ChZHZXRBcnRpZmFjdERvd25sb2FkVVJMEjEudG9zaGkud29ya3NwYWNlLnYxLkdldEFydGlmYWN0RG93bmxvYWRVUkxSZXF1ZXN0GjIudG9zaGkud29ya3NwYWNlLnYxLkdldEFydGlmYWN0RG93bmxvYWRVUkxSZXNwb25zZUItWitnaXRodWIuY29tL3Rvc2hpY2xvdWQvdG9zaGktYXBpL3dvcmtzcGFjZXYxYgZwcm90bzM", [file_google_protobuf_timestamp, file_toshi_workspace_v1_recordings]);
+export const file_toshi_workspace_v1_artifacts = /*@__PURE__*/ fileDesc("CiJ0b3NoaS93b3Jrc3BhY2UvdjEvYXJ0aWZhY3RzLnByb3RvEhJ0b3NoaS53b3Jrc3BhY2UudjEi9wIKCEFydGlmYWN0EgoKAmlkGAEgASgJEhIKCnByb2plY3RfaWQYAiABKAkSFgoOZW52aXJvbm1lbnRfaWQYAyABKAkSEwoLd29ya2xvYWRfaWQYBCABKAkSFAoMZXhlY3V0aW9uX2lkGAUgASgJEgwKBGtpbmQYBiABKAkSDAoEbmFtZRgHIAEoCRIUCgxjb250ZW50X3R5cGUYCCABKAkSEgoKcGFydF9jb3VudBgJIAEoAxISCgpwYXJ0X3NpemVzGAogAygDEhIKCmluZGV4X3NpemUYCyABKAMSDQoFc3RhdGUYDCABKAkSEgoKZW5jcnlwdGlvbhgNIAEoCRIuCgpjcmVhdGVkX2F0GA4gASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIwCgxjb21wbGV0ZWRfYXQYDyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhUKDXdvcmtsb2FkX2tpbmQYECABKAkizQEKBlVwbG9hZBIMCgRwYXJ0GAEgASgJEg4KBm1ldGhvZBgCIAEoCRILCgN1cmwYAyABKAkSOAoHaGVhZGVycxgEIAMoCzInLnRvc2hpLndvcmtzcGFjZS52MS5VcGxvYWQuSGVhZGVyc0VudHJ5Ei4KCmV4cGlyZXNfYXQYBSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wGi4KDEhlYWRlcnNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIqYBChRSZXNlcnZlVXBsb2FkUmVxdWVzdBIMCgRraW5kGAEgASgJEgwKBG5hbWUYAiABKAkSFAoMY29udGVudF90eXBlGAMgASgJEhIKCnBhcnRfc2l6ZXMYBCADKAMSEgoKaW5kZXhfc2l6ZRgFIAEoAxI0CglyZWNvcmRpbmcYBiABKA4yIS50b3NoaS53b3Jrc3BhY2UudjEuUmVjb3JkaW5nS2luZCLKAQoVUmVzZXJ2ZVVwbG9hZFJlc3BvbnNlEhMKC2FydGlmYWN0X2lkGAEgASgJEisKB3VwbG9hZHMYAiADKAsyGi50b3NoaS53b3Jrc3BhY2UudjEuVXBsb2FkEjMKD3VwbG9hZF9kZWFkbGluZRgDIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASEgoKZW5jcnlwdGlvbhgEIAEoCRIQCghkYXRhX2tleRgFIAEoDBIUCgxndWVzdF91cGxvYWQYBiABKAgiLAoVQ29tcGxldGVVcGxvYWRSZXF1ZXN0EhMKC2FydGlmYWN0X2lkGAEgASgJIkgKFkNvbXBsZXRlVXBsb2FkUmVzcG9uc2USLgoIYXJ0aWZhY3QYASABKAsyHC50b3NoaS53b3Jrc3BhY2UudjEuQXJ0aWZhY3QiogEKFExpc3RBcnRpZmFjdHNSZXF1ZXN0EhIKCnByb2plY3RfaWQYASABKAkSFgoOZW52aXJvbm1lbnRfaWQYAiABKAkSEwoLd29ya2xvYWRfaWQYAyABKAkSFAoMZXhlY3V0aW9uX2lkGAQgASgJEgwKBGtpbmQYBSABKAkSEQoJcGFnZV9zaXplGAYgASgFEhIKCnBhZ2VfdG9rZW4YByABKAkiYQoVTGlzdEFydGlmYWN0c1Jlc3BvbnNlEi8KCWFydGlmYWN0cxgBIAMoCzIcLnRvc2hpLndvcmtzcGFjZS52MS5BcnRpZmFjdBIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkiKQoSR2V0QXJ0aWZhY3RSZXF1ZXN0EhMKC2FydGlmYWN0X2lkGAEgASgJIkUKE0dldEFydGlmYWN0UmVzcG9uc2USLgoIYXJ0aWZhY3QYASABKAsyHC50b3NoaS53b3Jrc3BhY2UudjEuQXJ0aWZhY3QiVwodR2V0QXJ0aWZhY3REb3dubG9hZFVSTFJlcXVlc3QSEwoLYXJ0aWZhY3RfaWQYASABKAkSDAoEcGFydBgCIAEoCRITCgt0dGxfc2Vjb25kcxgDIAEoAyKDAQoeR2V0QXJ0aWZhY3REb3dubG9hZFVSTFJlc3BvbnNlEgsKA3VybBgBIAEoCRIuCgpleHBpcmVzX2F0GAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBISCgplbmNyeXB0aW9uGAMgASgJEhAKCGRhdGFfa2V5GAQgASgMMvICChVBcnRpZmFjdFVwbG9hZFNlcnZpY2USvAEKDVJlc2VydmVVcGxvYWQSKC50b3NoaS53b3Jrc3BhY2UudjEuUmVzZXJ2ZVVwbG9hZFJlcXVlc3QaKS50b3NoaS53b3Jrc3BhY2UudjEuUmVzZXJ2ZVVwbG9hZFJlc3BvbnNlIlbC8xgPYXJ0aWZhY3RzLndyaXRl0vMYOQoYYXJ0aWZhY3RfdXBsb2FkLnJlc2VydmVkEh1hcnRpZmFjdDpyZXNwb25zZS5hcnRpZmFjdF9pZOrzGAIoARKZAQoOQ29tcGxldGVVcGxvYWQSKS50b3NoaS53b3Jrc3BhY2UudjEuQ29tcGxldGVVcGxvYWRSZXF1ZXN0GioudG9zaGkud29ya3NwYWNlLnYxLkNvbXBsZXRlVXBsb2FkUmVzcG9uc2UiMMLzGA9hcnRpZmFjdHMud3JpdGXS8xgTChFhcnRpZmFjdC51cGxvYWRlZOrzGAIoATLZAwoPQXJ0aWZhY3RTZXJ2aWNlEocBCg1MaXN0QXJ0aWZhY3RzEigudG9zaGkud29ya3NwYWNlLnYxLkxpc3RBcnRpZmFjdHNSZXF1ZXN0GikudG9zaGkud29ya3NwYWNlLnYxLkxpc3RBcnRpZmFjdHNSZXNwb25zZSIhwvMYDmFydGlmYWN0cy5yZWFkyvMYC2Vudmlyb25tZW50EoEBCgtHZXRBcnRpZmFjdBImLnRvc2hpLndvcmtzcGFjZS52MS5HZXRBcnRpZmFjdFJlcXVlc3QaJy50b3NoaS53b3Jrc3BhY2UudjEuR2V0QXJ0aWZhY3RSZXNwb25zZSIhwvMYDmFydGlmYWN0cy5yZWFkyvMYC2Vudmlyb25tZW50ErcBChZHZXRBcnRpZmFjdERvd25sb2FkVVJMEjEudG9zaGkud29ya3NwYWNlLnYxLkdldEFydGlmYWN0RG93bmxvYWRVUkxSZXF1ZXN0GjIudG9zaGkud29ya3NwYWNlLnYxLkdldEFydGlmYWN0RG93bmxvYWRVUkxSZXNwb25zZSI2wvMYDmFydGlmYWN0cy5yZWFkyvMYC2Vudmlyb25tZW500vMYEQoPYXJ0aWZhY3Qudmlld2VkQiJaIGdvLnRvc2hpY2xvdWQuaW8vYXBpL3dvcmtzcGFjZXYxYgZwcm90bzM", [file_google_protobuf_timestamp, file_toshi_permission, file_toshi_workspace_v1_recordings]);
 /**
  * Describes the message toshi.workspace.v1.Artifact.
  * Use `create(ArtifactSchema)` to create a new message.
@@ -71,12 +72,14 @@ export const GetArtifactDownloadURLResponseSchema = /*@__PURE__*/ messageDesc(fi
 /**
  * ArtifactUploadService is how a job uploads what it recorded:
  * it reserves an artifact, uploads each part to a presigned URL, and
- * completes the upload. The caller is the workload itself: every call
- * carries a workload identity token for the audience
- * "toshi:artifacts", and the tenant, project, environment, workload and
- * execution of the artifact are the token's claims, never the request's.
- * A token of another audience, a display token, an expired token, or one
- * that names no workload is refused with UNAUTHENTICATED. A workspace that
+ * completes the upload. The caller is the workload itself, with a
+ * workload identity token for the audience "toshi:artifacts", or a host
+ * storing a recording's strip, with that strip's upload token for the
+ * audience "toshi:recordings". The workspace, project, environment,
+ * workload and execution of the artifact are the token's claims, or the
+ * recording's, never the request's. Another token, a display token, an
+ * expired token, or one that names no workload is refused with
+ * UNAUTHENTICATED. A workspace that
  * is suspended or being deleted is refused with FAILED_PRECONDITION.
  *
  * The data key and the presigned URLs are the only values either call

package/dist/gen/toshi/workspace/v1/audit_events_pb.d.ts

@@ -26,9 +26,9 @@ export type AuditEvent = Message<"toshi.workspace.v1.AuditEvent"> & {
      */
     actorKind: string;
     /**
-     * The session's GitHub login; the API or product token's id (never its
-     * value); the workload as "<kind>:<id>"; or a system or webhook source
-     * name.
+     * The session's user id, which stays the same across renames and identity
+     * providers; the API or product token's id (never its value); the workload
+     * as "<kind>:<id>"; or a system or webhook source name.
      *
      * @generated from field: string actor_id = 4;
      */
@@ -54,6 +54,43 @@ export type AuditEvent = Message<"toshi.workspace.v1.AuditEvent"> & {
      * @generated from field: string request_id = 8;
      */
     requestId: string;
+    /**
+     * The permission the call needed, for an event a Workspace API call
+     * records; empty otherwise.
+     *
+     * @generated from field: string permission = 9;
+     */
+    permission: string;
+    /**
+     * Where the call acted, as "project:<id>" or
+     * "project:<id>/environment:<id>"; empty for the whole workspace and for
+     * an event no call records.
+     *
+     * @generated from field: string scope = 10;
+     */
+    scope: string;
+    /**
+     * "ok", or the reason the call was refused: PERMISSION_MISSING,
+     * OUTSIDE_LIMIT or PRODUCT_UNAVAILABLE.
+     * Empty for an event no call records.
+     *
+     * @generated from field: string outcome = 11;
+     */
+    outcome: string;
+    /**
+     * The id of the token the call was made with (never its value); empty for
+     * a session and for an event no call records.
+     *
+     * @generated from field: string token_id = 12;
+     */
+    tokenId: string;
+    /**
+     * A session actor's login or name as it was when the event was recorded;
+     * empty for the other actors, and once the workspace is purged.
+     *
+     * @generated from field: string actor_name = 13;
+     */
+    actorName: string;
 };
 /**
  * AuditEvent is one append-only audit log entry.
@@ -76,9 +113,9 @@ export type AuditEventJson = {
      */
     actorKind?: string;
     /**
-     * The session's GitHub login; the API or product token's id (never its
-     * value); the workload as "<kind>:<id>"; or a system or webhook source
-     * name.
+     * The session's user id, which stays the same across renames and identity
+     * providers; the API or product token's id (never its value); the workload
+     * as "<kind>:<id>"; or a system or webhook source name.
      *
      * @generated from field: string actor_id = 4;
      */
@@ -104,6 +141,43 @@ export type AuditEventJson = {
      * @generated from field: string request_id = 8;
      */
     requestId?: string;
+    /**
+     * The permission the call needed, for an event a Workspace API call
+     * records; empty otherwise.
+     *
+     * @generated from field: string permission = 9;
+     */
+    permission?: string;
+    /**
+     * Where the call acted, as "project:<id>" or
+     * "project:<id>/environment:<id>"; empty for the whole workspace and for
+     * an event no call records.
+     *
+     * @generated from field: string scope = 10;
+     */
+    scope?: string;
+    /**
+     * "ok", or the reason the call was refused: PERMISSION_MISSING,
+     * OUTSIDE_LIMIT or PRODUCT_UNAVAILABLE.
+     * Empty for an event no call records.
+     *
+     * @generated from field: string outcome = 11;
+     */
+    outcome?: string;
+    /**
+     * The id of the token the call was made with (never its value); empty for
+     * a session and for an event no call records.
+     *
+     * @generated from field: string token_id = 12;
+     */
+    tokenId?: string;
+    /**
+     * A session actor's login or name as it was when the event was recorded;
+     * empty for the other actors, and once the workspace is purged.
+     *
+     * @generated from field: string actor_name = 13;
+     */
+    actorName?: string;
 };
 /**
  * Describes the message toshi.workspace.v1.AuditEvent.
@@ -165,6 +239,14 @@ export type ListAuditEventsRequest = Message<"toshi.workspace.v1.ListAuditEvents
      * @generated from field: string page_token = 7;
      */
     pageToken: string;
+    /**
+     * Only the events of calls with this outcome: "ok", or the reason a call
+     * was refused, such as PERMISSION_MISSING. Empty matches every event, a
+     * call's or not.
+     *
+     * @generated from field: string outcome = 8;
+     */
+    outcome: string;
 };
 /**
  * ListAuditEventsRequest selects the audit events to return.
@@ -219,6 +301,14 @@ export type ListAuditEventsRequestJson = {
      * @generated from field: string page_token = 7;
      */
     pageToken?: string;
+    /**
+     * Only the events of calls with this outcome: "ok", or the reason a call
+     * was refused, such as PERMISSION_MISSING. Empty matches every event, a
+     * call's or not.
+     *
+     * @generated from field: string outcome = 8;
+     */
+    outcome?: string;
 };
 /**
  * Describes the message toshi.workspace.v1.ListAuditEventsRequest.
@@ -268,6 +358,80 @@ export type ListAuditEventsResponseJson = {
 export declare const ListAuditEventsResponseSchema: GenMessage<ListAuditEventsResponse, {
     jsonType: ListAuditEventsResponseJson;
 }>;
+/**
+ * @generated from message toshi.workspace.v1.ExportAuditEventsRequest
+ */
+export type ExportAuditEventsRequest = Message<"toshi.workspace.v1.ExportAuditEventsRequest"> & {
+    /**
+     * @generated from field: google.protobuf.Timestamp since = 1;
+     */
+    since?: Timestamp | undefined;
+    /**
+     * @generated from field: google.protobuf.Timestamp until = 2;
+     */
+    until?: Timestamp | undefined;
+    /**
+     * @generated from field: string cursor = 3;
+     */
+    cursor: string;
+};
+/**
+ * @generated from message toshi.workspace.v1.ExportAuditEventsRequest
+ */
+export type ExportAuditEventsRequestJson = {
+    /**
+     * @generated from field: google.protobuf.Timestamp since = 1;
+     */
+    since?: TimestampJson;
+    /**
+     * @generated from field: google.protobuf.Timestamp until = 2;
+     */
+    until?: TimestampJson;
+    /**
+     * @generated from field: string cursor = 3;
+     */
+    cursor?: string;
+};
+/**
+ * Describes the message toshi.workspace.v1.ExportAuditEventsRequest.
+ * Use `create(ExportAuditEventsRequestSchema)` to create a new message.
+ */
+export declare const ExportAuditEventsRequestSchema: GenMessage<ExportAuditEventsRequest, {
+    jsonType: ExportAuditEventsRequestJson;
+}>;
+/**
+ * @generated from message toshi.workspace.v1.ExportAuditEventsResponse
+ */
+export type ExportAuditEventsResponse = Message<"toshi.workspace.v1.ExportAuditEventsResponse"> & {
+    /**
+     * @generated from field: bytes data = 1;
+     */
+    data: Uint8Array;
+    /**
+     * @generated from field: string cursor = 2;
+     */
+    cursor: string;
+};
+/**
+ * @generated from message toshi.workspace.v1.ExportAuditEventsResponse
+ */
+export type ExportAuditEventsResponseJson = {
+    /**
+     * @generated from field: bytes data = 1;
+     */
+    data?: string;
+    /**
+     * @generated from field: string cursor = 2;
+     */
+    cursor?: string;
+};
+/**
+ * Describes the message toshi.workspace.v1.ExportAuditEventsResponse.
+ * Use `create(ExportAuditEventsResponseSchema)` to create a new message.
+ */
+export declare const ExportAuditEventsResponseSchema: GenMessage<ExportAuditEventsResponse, {
+    jsonType: ExportAuditEventsResponseJson;
+}>;
 /**
  * AuditEventService reads the workspace's audit log: what its members, its
  * tokens, the operator and the control plane did in it.
@@ -294,4 +458,25 @@ export declare const AuditEventService: GenService<{
         input: typeof ListAuditEventsRequestSchema;
         output: typeof ListAuditEventsResponseSchema;
     };
+    /**
+     * ExportAuditEvents streams the audit log as JSON lines, oldest first,
+     * without a row cap. The first line is {"header":{"since":...,"until":...,
+     * "retention_boundary":...|null,"crossed":true|false}}, followed by one
+     * AuditEvent per line. The plan must include audit export or the call fails
+     * with PERMISSION_DENIED.
+     *
+     * Since is required; until defaults to now. Since must be before until,
+     * else INVALID_ARGUMENT. A cursor from a previous response resumes after
+     * its last row, sending the header again. A malformed cursor or one from
+     * another range fails with INVALID_ARGUMENT; a resume cursor at or behind
+     * the retention boundary fails with OUT_OF_RANGE. When resuming without an
+     * until, the cursor keeps the original range's until.
+     *
+     * @generated from rpc toshi.workspace.v1.AuditEventService.ExportAuditEvents
+     */
+    exportAuditEvents: {
+        methodKind: "server_streaming";
+        input: typeof ExportAuditEventsRequestSchema;
+        output: typeof ExportAuditEventsResponseSchema;
+    };
 }>;

package/dist/gen/toshi/workspace/v1/audit_events_pb.js

@@ -3,10 +3,11 @@
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
 import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import { file_toshi_permission } from "../../permission_pb.js";
 /**
  * Describes the file toshi/workspace/v1/audit_events.proto.
  */
-export const file_toshi_workspace_v1_audit_events = /*@__PURE__*/ fileDesc("CiV0b3NoaS93b3Jrc3BhY2UvdjEvYXVkaXRfZXZlbnRzLnByb3RvEhJ0b3NoaS53b3Jrc3BhY2UudjEisAEKCkF1ZGl0RXZlbnQSCgoCaWQYASABKAMSJgoCYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhIKCmFjdG9yX2tpbmQYAyABKAkSEAoIYWN0b3JfaWQYBCABKAkSDgoGYWN0aW9uGAUgASgJEg4KBnRhcmdldBgGIAEoCRIUCgxkZXRhaWxzX2pzb24YByABKAkSEgoKcmVxdWVzdF9pZBgIIAEoCSKqAQoWTGlzdEF1ZGl0RXZlbnRzUmVxdWVzdBIOCgZhY3Rpb24YASABKAkSKQoFc2luY2UYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhEKCXBhZ2Vfc2l6ZRgDIAEoBRINCgVhY3RvchgEIAEoCRIPCgdhY3Rpb25zGAUgAygJEg4KBnRhcmdldBgGIAEoCRISCgpwYWdlX3Rva2VuGAcgASgJImIKF0xpc3RBdWRpdEV2ZW50c1Jlc3BvbnNlEi4KBmV2ZW50cxgBIAMoCzIeLnRvc2hpLndvcmtzcGFjZS52MS5BdWRpdEV2ZW50EhcKD25leHRfcGFnZV90b2tlbhgCIAEoCTJ/ChFBdWRpdEV2ZW50U2VydmljZRJqCg9MaXN0QXVkaXRFdmVudHMSKi50b3NoaS53b3Jrc3BhY2UudjEuTGlzdEF1ZGl0RXZlbnRzUmVxdWVzdBorLnRvc2hpLndvcmtzcGFjZS52MS5MaXN0QXVkaXRFdmVudHNSZXNwb25zZUItWitnaXRodWIuY29tL3Rvc2hpY2xvdWQvdG9zaGktYXBpL3dvcmtzcGFjZXYxYgZwcm90bzM", [file_google_protobuf_timestamp]);
+export const file_toshi_workspace_v1_audit_events = /*@__PURE__*/ fileDesc("CiV0b3NoaS93b3Jrc3BhY2UvdjEvYXVkaXRfZXZlbnRzLnByb3RvEhJ0b3NoaS53b3Jrc3BhY2UudjEiigIKCkF1ZGl0RXZlbnQSCgoCaWQYASABKAMSJgoCYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhIKCmFjdG9yX2tpbmQYAyABKAkSEAoIYWN0b3JfaWQYBCABKAkSDgoGYWN0aW9uGAUgASgJEg4KBnRhcmdldBgGIAEoCRIUCgxkZXRhaWxzX2pzb24YByABKAkSEgoKcmVxdWVzdF9pZBgIIAEoCRISCgpwZXJtaXNzaW9uGAkgASgJEg0KBXNjb3BlGAogASgJEg8KB291dGNvbWUYCyABKAkSEAoIdG9rZW5faWQYDCABKAkSEgoKYWN0b3JfbmFtZRgNIAEoCSK7AQoWTGlzdEF1ZGl0RXZlbnRzUmVxdWVzdBIOCgZhY3Rpb24YASABKAkSKQoFc2luY2UYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhEKCXBhZ2Vfc2l6ZRgDIAEoBRINCgVhY3RvchgEIAEoCRIPCgdhY3Rpb25zGAUgAygJEg4KBnRhcmdldBgGIAEoCRISCgpwYWdlX3Rva2VuGAcgASgJEg8KB291dGNvbWUYCCABKAkiYgoXTGlzdEF1ZGl0RXZlbnRzUmVzcG9uc2USLgoGZXZlbnRzGAEgAygLMh4udG9zaGkud29ya3NwYWNlLnYxLkF1ZGl0RXZlbnQSFwoPbmV4dF9wYWdlX3Rva2VuGAIgASgJIoABChhFeHBvcnRBdWRpdEV2ZW50c1JlcXVlc3QSKQoFc2luY2UYASABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEikKBXVudGlsGAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIOCgZjdXJzb3IYAyABKAkiOQoZRXhwb3J0QXVkaXRFdmVudHNSZXNwb25zZRIMCgRkYXRhGAEgASgMEg4KBmN1cnNvchgCIAEoCTLEAgoRQXVkaXRFdmVudFNlcnZpY2USegoPTGlzdEF1ZGl0RXZlbnRzEioudG9zaGkud29ya3NwYWNlLnYxLkxpc3RBdWRpdEV2ZW50c1JlcXVlc3QaKy50b3NoaS53b3Jrc3BhY2UudjEuTGlzdEF1ZGl0RXZlbnRzUmVzcG9uc2UiDsLzGAphdWRpdC5yZWFkErIBChFFeHBvcnRBdWRpdEV2ZW50cxIsLnRvc2hpLndvcmtzcGFjZS52MS5FeHBvcnRBdWRpdEV2ZW50c1JlcXVlc3QaLS50b3NoaS53b3Jrc3BhY2UudjEuRXhwb3J0QXVkaXRFdmVudHNSZXNwb25zZSI+wvMYCmF1ZGl0LnJlYWTS8xgsChVhdWRpdF9ldmVudHMuZXhwb3J0ZWQSE3dvcmtzcGFjZTp3b3Jrc3BhY2UwAUIiWiBnby50b3NoaWNsb3VkLmlvL2FwaS93b3Jrc3BhY2V2MWIGcHJvdG8z", [file_google_protobuf_timestamp, file_toshi_permission]);
 /**
  * Describes the message toshi.workspace.v1.AuditEvent.
  * Use `create(AuditEventSchema)` to create a new message.
@@ -22,6 +23,16 @@ export const ListAuditEventsRequestSchema = /*@__PURE__*/ messageDesc(file_toshi
  * Use `create(ListAuditEventsResponseSchema)` to create a new message.
  */
 export const ListAuditEventsResponseSchema = /*@__PURE__*/ messageDesc(file_toshi_workspace_v1_audit_events, 2);
+/**
+ * Describes the message toshi.workspace.v1.ExportAuditEventsRequest.
+ * Use `create(ExportAuditEventsRequestSchema)` to create a new message.
+ */
+export const ExportAuditEventsRequestSchema = /*@__PURE__*/ messageDesc(file_toshi_workspace_v1_audit_events, 3);
+/**
+ * Describes the message toshi.workspace.v1.ExportAuditEventsResponse.
+ * Use `create(ExportAuditEventsResponseSchema)` to create a new message.
+ */
+export const ExportAuditEventsResponseSchema = /*@__PURE__*/ messageDesc(file_toshi_workspace_v1_audit_events, 4);
 /**
  * AuditEventService reads the workspace's audit log: what its members, its
  * tokens, the operator and the control plane did in it.