@wirebench/engine 2.2.1 → 3.1.0-rc.1

package/dist/server-api/audit.d.ts

@@ -0,0 +1,455 @@
+/**
+ * The audit-log wire shapes (audit-log spec §2, §3.4, §5.2). The server writes events and serves
+ * them; the desktop reads pages and streams the export. Plain zod only (ADR-0009).
+ *
+ * `details` is flat on purpose: a fire site names fields, never spreads a body, and nothing nested
+ * can smuggle a payload in (§6).
+ */
+import { z } from 'zod';
+/** §3.2, a closed list: a fire site references the enum, never a literal. */
+export declare const AUDIT_ACTIONS: readonly ["auth.signed_in", "auth.sign_in_failed", "auth.signed_out", "auth.password_changed", "user.invited", "user.invitation_revoked", "user.created", "user.disabled", "user.enabled", "user.admin_granted", "user.admin_revoked", "user.password_reset_issued", "team.created", "team.renamed", "team.deleted", "team.member_added", "team.member_removed", "team.member_role_changed", "workspace.created", "workspace.deleted", "workspace.renamed", "workspace.default_role_changed", "workspace.grant_set", "workspace.grant_removed", "workspace.pushed", "secret.shared", "secret.rotated", "secret.access_changed", "hook.created", "hook.changed", "hook.rotated", "hook.deleted", "hook.cleared", "hook.signature_set", "hook.signature_cleared", "ci_token.created", "ci_token.revoked", "license.installed", "license.removed", "audit.exported", "audit.verified", "workspace.desktop_recording_changed", "desktop.request_sent", "desktop.run_finished", "desktop.events_dropped"];
+export declare const auditActionSchema: z.ZodEnum<{
+    "auth.signed_in": "auth.signed_in";
+    "auth.sign_in_failed": "auth.sign_in_failed";
+    "auth.signed_out": "auth.signed_out";
+    "auth.password_changed": "auth.password_changed";
+    "user.invited": "user.invited";
+    "user.invitation_revoked": "user.invitation_revoked";
+    "user.created": "user.created";
+    "user.disabled": "user.disabled";
+    "user.enabled": "user.enabled";
+    "user.admin_granted": "user.admin_granted";
+    "user.admin_revoked": "user.admin_revoked";
+    "user.password_reset_issued": "user.password_reset_issued";
+    "team.created": "team.created";
+    "team.renamed": "team.renamed";
+    "team.deleted": "team.deleted";
+    "team.member_added": "team.member_added";
+    "team.member_removed": "team.member_removed";
+    "team.member_role_changed": "team.member_role_changed";
+    "workspace.created": "workspace.created";
+    "workspace.deleted": "workspace.deleted";
+    "workspace.renamed": "workspace.renamed";
+    "workspace.default_role_changed": "workspace.default_role_changed";
+    "workspace.grant_set": "workspace.grant_set";
+    "workspace.grant_removed": "workspace.grant_removed";
+    "workspace.pushed": "workspace.pushed";
+    "secret.shared": "secret.shared";
+    "secret.rotated": "secret.rotated";
+    "secret.access_changed": "secret.access_changed";
+    "hook.created": "hook.created";
+    "hook.changed": "hook.changed";
+    "hook.rotated": "hook.rotated";
+    "hook.deleted": "hook.deleted";
+    "hook.cleared": "hook.cleared";
+    "hook.signature_set": "hook.signature_set";
+    "hook.signature_cleared": "hook.signature_cleared";
+    "ci_token.created": "ci_token.created";
+    "ci_token.revoked": "ci_token.revoked";
+    "license.installed": "license.installed";
+    "license.removed": "license.removed";
+    "audit.exported": "audit.exported";
+    "audit.verified": "audit.verified";
+    "workspace.desktop_recording_changed": "workspace.desktop_recording_changed";
+    "desktop.request_sent": "desktop.request_sent";
+    "desktop.run_finished": "desktop.run_finished";
+    "desktop.events_dropped": "desktop.events_dropped";
+}>;
+export type AuditAction = z.infer<typeof auditActionSchema>;
+/** The part before the dot, for the desktop's action-group filter. */
+export declare const AUDIT_ACTION_GROUPS: readonly ["auth", "user", "team", "workspace", "secret", "hook", "ci_token", "license", "audit", "desktop"];
+export type AuditActionGroup = (typeof AUDIT_ACTION_GROUPS)[number];
+export declare const AUDIT_ACTOR_KINDS: readonly ["user", "ci-token", "system", "anonymous"];
+export type AuditActorKind = (typeof AUDIT_ACTOR_KINDS)[number];
+export declare const AUDIT_TARGET_KINDS: readonly ["server", "user", "invitation", "team", "workspace", "hook", "ci-token", "license"];
+export type AuditTargetKind = (typeof AUDIT_TARGET_KINDS)[number];
+export declare const AUDIT_LIMITS: {
+    readonly defaultPageSize: 50;
+    readonly maxPageSize: 200;
+    /** Rows per keyset query behind the export stream (§3.4). */
+    readonly exportBatch: 1000;
+    /** `details`, serialised; a larger object is cut down with `_truncated: true` (§4.2). */
+    readonly maxDetailsBytes: 4096;
+    readonly maxUserAgentLength: 512;
+    /** `WIREBENCH_SERVER_AUDIT_MAX_AGE_DAYS` (§4.1). */
+    readonly maxAgeDays: {
+        readonly min: 30;
+        readonly max: 3650;
+        readonly default: 365;
+    };
+};
+export declare const auditDetailsSchema: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>, z.ZodNull, z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>]>>;
+export type AuditDetails = z.infer<typeof auditDetailsSchema>;
+/** `email` is the user's email at the time of the event, copied into the row (§3.4). */
+export declare const auditActorSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        system: "system";
+        user: "user";
+        anonymous: "anonymous";
+        "ci-token": "ci-token";
+    }>;
+    userId: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    tokenId: z.ZodOptional<z.ZodString>;
+    workspaceId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AuditActor = z.infer<typeof auditActorSchema>;
+export declare const auditEventSchema: z.ZodObject<{
+    id: z.ZodString;
+    at: z.ZodString;
+    actor: z.ZodObject<{
+        kind: z.ZodEnum<{
+            system: "system";
+            user: "user";
+            anonymous: "anonymous";
+            "ci-token": "ci-token";
+        }>;
+        userId: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodString>;
+        tokenId: z.ZodOptional<z.ZodString>;
+        workspaceId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    action: z.ZodEnum<{
+        "auth.signed_in": "auth.signed_in";
+        "auth.sign_in_failed": "auth.sign_in_failed";
+        "auth.signed_out": "auth.signed_out";
+        "auth.password_changed": "auth.password_changed";
+        "user.invited": "user.invited";
+        "user.invitation_revoked": "user.invitation_revoked";
+        "user.created": "user.created";
+        "user.disabled": "user.disabled";
+        "user.enabled": "user.enabled";
+        "user.admin_granted": "user.admin_granted";
+        "user.admin_revoked": "user.admin_revoked";
+        "user.password_reset_issued": "user.password_reset_issued";
+        "team.created": "team.created";
+        "team.renamed": "team.renamed";
+        "team.deleted": "team.deleted";
+        "team.member_added": "team.member_added";
+        "team.member_removed": "team.member_removed";
+        "team.member_role_changed": "team.member_role_changed";
+        "workspace.created": "workspace.created";
+        "workspace.deleted": "workspace.deleted";
+        "workspace.renamed": "workspace.renamed";
+        "workspace.default_role_changed": "workspace.default_role_changed";
+        "workspace.grant_set": "workspace.grant_set";
+        "workspace.grant_removed": "workspace.grant_removed";
+        "workspace.pushed": "workspace.pushed";
+        "secret.shared": "secret.shared";
+        "secret.rotated": "secret.rotated";
+        "secret.access_changed": "secret.access_changed";
+        "hook.created": "hook.created";
+        "hook.changed": "hook.changed";
+        "hook.rotated": "hook.rotated";
+        "hook.deleted": "hook.deleted";
+        "hook.cleared": "hook.cleared";
+        "hook.signature_set": "hook.signature_set";
+        "hook.signature_cleared": "hook.signature_cleared";
+        "ci_token.created": "ci_token.created";
+        "ci_token.revoked": "ci_token.revoked";
+        "license.installed": "license.installed";
+        "license.removed": "license.removed";
+        "audit.exported": "audit.exported";
+        "audit.verified": "audit.verified";
+        "workspace.desktop_recording_changed": "workspace.desktop_recording_changed";
+        "desktop.request_sent": "desktop.request_sent";
+        "desktop.run_finished": "desktop.run_finished";
+        "desktop.events_dropped": "desktop.events_dropped";
+    }>;
+    target: z.ZodObject<{
+        kind: z.ZodEnum<{
+            server: "server";
+            workspace: "workspace";
+            user: "user";
+            hook: "hook";
+            team: "team";
+            license: "license";
+            "ci-token": "ci-token";
+            invitation: "invitation";
+        }>;
+        id: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+    workspaceId: z.ZodNullable<z.ZodString>;
+    teamId: z.ZodNullable<z.ZodString>;
+    ip: z.ZodNullable<z.ZodString>;
+    userAgent: z.ZodNullable<z.ZodString>;
+    details: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>, z.ZodNull, z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>]>>;
+}, z.core.$strip>;
+export type AuditEvent = z.infer<typeof auditEventSchema>;
+/** `GET /audit` (§3.4). `action` is exact, or a group prefix ending in a dot. `to` is exclusive. */
+export declare const auditQuerySchema: z.ZodObject<{
+    from: z.ZodOptional<z.ZodString>;
+    to: z.ZodOptional<z.ZodString>;
+    action: z.ZodOptional<z.ZodString>;
+    actorUserId: z.ZodOptional<z.ZodString>;
+    workspaceId: z.ZodOptional<z.ZodString>;
+    teamId: z.ZodOptional<z.ZodString>;
+    targetKind: z.ZodOptional<z.ZodEnum<{
+        server: "server";
+        workspace: "workspace";
+        user: "user";
+        hook: "hook";
+        team: "team";
+        license: "license";
+        "ci-token": "ci-token";
+        invitation: "invitation";
+    }>>;
+    targetId: z.ZodOptional<z.ZodString>;
+    after: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type AuditQuery = z.infer<typeof auditQuerySchema>;
+/** `GET /audit/export` and `admin audit export`: the same filters, no paging. */
+export declare const auditExportQuerySchema: z.ZodObject<{
+    action: z.ZodOptional<z.ZodString>;
+    to: z.ZodOptional<z.ZodString>;
+    from: z.ZodOptional<z.ZodString>;
+    teamId: z.ZodOptional<z.ZodString>;
+    workspaceId: z.ZodOptional<z.ZodString>;
+    actorUserId: z.ZodOptional<z.ZodString>;
+    targetKind: z.ZodOptional<z.ZodEnum<{
+        server: "server";
+        workspace: "workspace";
+        user: "user";
+        hook: "hook";
+        team: "team";
+        license: "license";
+        "ci-token": "ci-token";
+        invitation: "invitation";
+    }>>;
+    targetId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AuditExportQuery = z.infer<typeof auditExportQuerySchema>;
+export declare const auditPageSchema: z.ZodObject<{
+    events: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        at: z.ZodString;
+        actor: z.ZodObject<{
+            kind: z.ZodEnum<{
+                system: "system";
+                user: "user";
+                anonymous: "anonymous";
+                "ci-token": "ci-token";
+            }>;
+            userId: z.ZodOptional<z.ZodString>;
+            email: z.ZodOptional<z.ZodString>;
+            tokenId: z.ZodOptional<z.ZodString>;
+            workspaceId: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+        action: z.ZodEnum<{
+            "auth.signed_in": "auth.signed_in";
+            "auth.sign_in_failed": "auth.sign_in_failed";
+            "auth.signed_out": "auth.signed_out";
+            "auth.password_changed": "auth.password_changed";
+            "user.invited": "user.invited";
+            "user.invitation_revoked": "user.invitation_revoked";
+            "user.created": "user.created";
+            "user.disabled": "user.disabled";
+            "user.enabled": "user.enabled";
+            "user.admin_granted": "user.admin_granted";
+            "user.admin_revoked": "user.admin_revoked";
+            "user.password_reset_issued": "user.password_reset_issued";
+            "team.created": "team.created";
+            "team.renamed": "team.renamed";
+            "team.deleted": "team.deleted";
+            "team.member_added": "team.member_added";
+            "team.member_removed": "team.member_removed";
+            "team.member_role_changed": "team.member_role_changed";
+            "workspace.created": "workspace.created";
+            "workspace.deleted": "workspace.deleted";
+            "workspace.renamed": "workspace.renamed";
+            "workspace.default_role_changed": "workspace.default_role_changed";
+            "workspace.grant_set": "workspace.grant_set";
+            "workspace.grant_removed": "workspace.grant_removed";
+            "workspace.pushed": "workspace.pushed";
+            "secret.shared": "secret.shared";
+            "secret.rotated": "secret.rotated";
+            "secret.access_changed": "secret.access_changed";
+            "hook.created": "hook.created";
+            "hook.changed": "hook.changed";
+            "hook.rotated": "hook.rotated";
+            "hook.deleted": "hook.deleted";
+            "hook.cleared": "hook.cleared";
+            "hook.signature_set": "hook.signature_set";
+            "hook.signature_cleared": "hook.signature_cleared";
+            "ci_token.created": "ci_token.created";
+            "ci_token.revoked": "ci_token.revoked";
+            "license.installed": "license.installed";
+            "license.removed": "license.removed";
+            "audit.exported": "audit.exported";
+            "audit.verified": "audit.verified";
+            "workspace.desktop_recording_changed": "workspace.desktop_recording_changed";
+            "desktop.request_sent": "desktop.request_sent";
+            "desktop.run_finished": "desktop.run_finished";
+            "desktop.events_dropped": "desktop.events_dropped";
+        }>;
+        target: z.ZodObject<{
+            kind: z.ZodEnum<{
+                server: "server";
+                workspace: "workspace";
+                user: "user";
+                hook: "hook";
+                team: "team";
+                license: "license";
+                "ci-token": "ci-token";
+                invitation: "invitation";
+            }>;
+            id: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
+        workspaceId: z.ZodNullable<z.ZodString>;
+        teamId: z.ZodNullable<z.ZodString>;
+        ip: z.ZodNullable<z.ZodString>;
+        userAgent: z.ZodNullable<z.ZodString>;
+        details: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>, z.ZodNull, z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>]>>;
+    }, z.core.$strip>>;
+    next: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AuditPage = z.infer<typeof auditPageSchema>;
+/** Bounds on what the desktop records and uploads (desktop audit events spec §2.2). */
+export declare const DESKTOP_AUDIT_LIMITS: {
+    readonly maxBatch: 100;
+    readonly maxOutbox: 5000;
+    readonly maxUrlLength: 2048;
+    readonly maxHosts: 64;
+    readonly maxDropped: 1000000;
+};
+/** One request the desktop sent. Metadata only: no headers, no body, no response. */
+export declare const desktopRequestSentDetailsSchema: z.ZodObject<{
+    protocol: z.ZodEnum<{
+        rest: "rest";
+        grpc: "grpc";
+        soap: "soap";
+        websocket: "websocket";
+    }>;
+    method: z.ZodNullable<z.ZodString>;
+    url: z.ZodString;
+    status: z.ZodNullable<z.ZodNumber>;
+    outcome: z.ZodEnum<{
+        failed: "failed";
+        ok: "ok";
+    }>;
+    durationMs: z.ZodNumber;
+    environment: z.ZodNullable<z.ZodString>;
+    requestId: z.ZodString;
+    requestName: z.ZodString;
+    sentAt: z.ZodString;
+}, z.core.$strict>;
+export type DesktopRequestSentDetails = z.infer<typeof desktopRequestSentDetailsSchema>;
+/** One finished sequence run: the engine's `SequenceOutcome` values, plus `cancelled`. */
+export declare const desktopRunFinishedDetailsSchema: z.ZodObject<{
+    sequenceId: z.ZodString;
+    sequenceName: z.ZodString;
+    outcome: z.ZodEnum<{
+        passed: "passed";
+        failed: "failed";
+        errored: "errored";
+        skipped: "skipped";
+        cancelled: "cancelled";
+    }>;
+    passed: z.ZodNumber;
+    failed: z.ZodNumber;
+    errored: z.ZodNumber;
+    skipped: z.ZodNumber;
+    durationMs: z.ZodNumber;
+    hosts: z.ZodArray<z.ZodString>;
+    environment: z.ZodNullable<z.ZodString>;
+    startedAt: z.ZodString;
+    sentAt: z.ZodString;
+}, z.core.$strict>;
+export type DesktopRunFinishedDetails = z.infer<typeof desktopRunFinishedDetailsSchema>;
+export declare const desktopAuditEventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    action: z.ZodLiteral<"desktop.request_sent">;
+    details: z.ZodObject<{
+        protocol: z.ZodEnum<{
+            rest: "rest";
+            grpc: "grpc";
+            soap: "soap";
+            websocket: "websocket";
+        }>;
+        method: z.ZodNullable<z.ZodString>;
+        url: z.ZodString;
+        status: z.ZodNullable<z.ZodNumber>;
+        outcome: z.ZodEnum<{
+            failed: "failed";
+            ok: "ok";
+        }>;
+        durationMs: z.ZodNumber;
+        environment: z.ZodNullable<z.ZodString>;
+        requestId: z.ZodString;
+        requestName: z.ZodString;
+        sentAt: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    action: z.ZodLiteral<"desktop.run_finished">;
+    details: z.ZodObject<{
+        sequenceId: z.ZodString;
+        sequenceName: z.ZodString;
+        outcome: z.ZodEnum<{
+            passed: "passed";
+            failed: "failed";
+            errored: "errored";
+            skipped: "skipped";
+            cancelled: "cancelled";
+        }>;
+        passed: z.ZodNumber;
+        failed: z.ZodNumber;
+        errored: z.ZodNumber;
+        skipped: z.ZodNumber;
+        durationMs: z.ZodNumber;
+        hosts: z.ZodArray<z.ZodString>;
+        environment: z.ZodNullable<z.ZodString>;
+        startedAt: z.ZodString;
+        sentAt: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>], "action">;
+export type DesktopAuditEvent = z.infer<typeof desktopAuditEventSchema>;
+/** `dropped` counts events the outbox discarded before this batch, so the server can record the gap. */
+export declare const desktopAuditBatchSchema: z.ZodObject<{
+    events: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        action: z.ZodLiteral<"desktop.request_sent">;
+        details: z.ZodObject<{
+            protocol: z.ZodEnum<{
+                rest: "rest";
+                grpc: "grpc";
+                soap: "soap";
+                websocket: "websocket";
+            }>;
+            method: z.ZodNullable<z.ZodString>;
+            url: z.ZodString;
+            status: z.ZodNullable<z.ZodNumber>;
+            outcome: z.ZodEnum<{
+                failed: "failed";
+                ok: "ok";
+            }>;
+            durationMs: z.ZodNumber;
+            environment: z.ZodNullable<z.ZodString>;
+            requestId: z.ZodString;
+            requestName: z.ZodString;
+            sentAt: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        action: z.ZodLiteral<"desktop.run_finished">;
+        details: z.ZodObject<{
+            sequenceId: z.ZodString;
+            sequenceName: z.ZodString;
+            outcome: z.ZodEnum<{
+                passed: "passed";
+                failed: "failed";
+                errored: "errored";
+                skipped: "skipped";
+                cancelled: "cancelled";
+            }>;
+            passed: z.ZodNumber;
+            failed: z.ZodNumber;
+            errored: z.ZodNumber;
+            skipped: z.ZodNumber;
+            durationMs: z.ZodNumber;
+            hosts: z.ZodArray<z.ZodString>;
+            environment: z.ZodNullable<z.ZodString>;
+            startedAt: z.ZodString;
+            sentAt: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>], "action">>;
+    dropped: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export type DesktopAuditBatch = z.infer<typeof desktopAuditBatchSchema>;

package/dist/server-api/audit.js

@@ -0,0 +1,186 @@
+/**
+ * The audit-log wire shapes (audit-log spec §2, §3.4, §5.2). The server writes events and serves
+ * them; the desktop reads pages and streams the export. Plain zod only (ADR-0009).
+ *
+ * `details` is flat on purpose: a fire site names fields, never spreads a body, and nothing nested
+ * can smuggle a payload in (§6).
+ */
+import { z } from 'zod';
+/** §3.2, a closed list: a fire site references the enum, never a literal. */
+export const AUDIT_ACTIONS = [
+    'auth.signed_in',
+    'auth.sign_in_failed',
+    'auth.signed_out',
+    'auth.password_changed',
+    'user.invited',
+    'user.invitation_revoked',
+    'user.created',
+    'user.disabled',
+    'user.enabled',
+    'user.admin_granted',
+    'user.admin_revoked',
+    'user.password_reset_issued',
+    'team.created',
+    'team.renamed',
+    'team.deleted',
+    'team.member_added',
+    'team.member_removed',
+    'team.member_role_changed',
+    'workspace.created',
+    'workspace.deleted',
+    'workspace.renamed',
+    'workspace.default_role_changed',
+    'workspace.grant_set',
+    'workspace.grant_removed',
+    'workspace.pushed',
+    'secret.shared',
+    'secret.rotated',
+    'secret.access_changed',
+    'hook.created',
+    'hook.changed',
+    'hook.rotated',
+    'hook.deleted',
+    'hook.cleared',
+    'hook.signature_set',
+    'hook.signature_cleared',
+    'ci_token.created',
+    'ci_token.revoked',
+    'license.installed',
+    'license.removed',
+    'audit.exported',
+    'audit.verified',
+    'workspace.desktop_recording_changed',
+    'desktop.request_sent',
+    'desktop.run_finished',
+    'desktop.events_dropped',
+];
+export const auditActionSchema = z.enum(AUDIT_ACTIONS);
+/** The part before the dot, for the desktop's action-group filter. */
+export const AUDIT_ACTION_GROUPS = [
+    'auth',
+    'user',
+    'team',
+    'workspace',
+    'secret',
+    'hook',
+    'ci_token',
+    'license',
+    'audit',
+    'desktop',
+];
+export const AUDIT_ACTOR_KINDS = ['user', 'ci-token', 'system', 'anonymous'];
+export const AUDIT_TARGET_KINDS = [
+    'server',
+    'user',
+    'invitation',
+    'team',
+    'workspace',
+    'hook',
+    'ci-token',
+    'license',
+];
+export const AUDIT_LIMITS = {
+    defaultPageSize: 50,
+    maxPageSize: 200,
+    /** Rows per keyset query behind the export stream (§3.4). */
+    exportBatch: 1000,
+    /** `details`, serialised; a larger object is cut down with `_truncated: true` (§4.2). */
+    maxDetailsBytes: 4096,
+    maxUserAgentLength: 512,
+    /** `WIREBENCH_SERVER_AUDIT_MAX_AGE_DAYS` (§4.1). */
+    maxAgeDays: { min: 30, max: 3650, default: 365 },
+};
+const scalar = z.union([z.string(), z.number(), z.boolean()]);
+export const auditDetailsSchema = z.record(z.string().min(1).max(64), z.union([scalar, z.null(), z.array(scalar).max(64)]));
+/** `email` is the user's email at the time of the event, copied into the row (§3.4). */
+export const auditActorSchema = z.object({
+    kind: z.enum(AUDIT_ACTOR_KINDS),
+    userId: z.string().optional(),
+    email: z.string().optional(),
+    tokenId: z.string().optional(),
+    /** A CI token's workspace (plan ruling 1). */
+    workspaceId: z.string().optional(),
+});
+export const auditEventSchema = z.object({
+    id: z.string(),
+    at: z.string().datetime(),
+    actor: auditActorSchema,
+    action: auditActionSchema,
+    target: z.object({ kind: z.enum(AUDIT_TARGET_KINDS), id: z.string().nullable() }),
+    workspaceId: z.string().nullable(),
+    teamId: z.string().nullable(),
+    ip: z.string().nullable(),
+    userAgent: z.string().nullable(),
+    details: auditDetailsSchema,
+});
+/** `GET /audit` (§3.4). `action` is exact, or a group prefix ending in a dot. `to` is exclusive. */
+export const auditQuerySchema = z.object({
+    from: z.string().datetime().optional(),
+    to: z.string().datetime().optional(),
+    action: z
+        .string()
+        .regex(/^[a-z_]+\.([a-z_]+)?$/, 'an action, or a group followed by a dot')
+        .optional(),
+    actorUserId: z.string().optional(),
+    workspaceId: z.string().optional(),
+    teamId: z.string().optional(),
+    targetKind: z.enum(AUDIT_TARGET_KINDS).optional(),
+    targetId: z.string().optional(),
+    /** Opaque; from the previous page's `next`. */
+    after: z.string().max(200).optional(),
+    limit: z.number().int().min(1).max(AUDIT_LIMITS.maxPageSize).optional(),
+});
+/** `GET /audit/export` and `admin audit export`: the same filters, no paging. */
+export const auditExportQuerySchema = auditQuerySchema.omit({ after: true, limit: true });
+export const auditPageSchema = z.object({ events: z.array(auditEventSchema), next: z.string().optional() });
+// ---- desktop events ----------------------------------------------------------------------
+/** Bounds on what the desktop records and uploads (desktop audit events spec §2.2). */
+export const DESKTOP_AUDIT_LIMITS = {
+    maxBatch: 100,
+    maxOutbox: 5000,
+    maxUrlLength: 2048,
+    maxHosts: 64,
+    maxDropped: 1_000_000,
+};
+/** One request the desktop sent. Metadata only: no headers, no body, no response. */
+export const desktopRequestSentDetailsSchema = z.strictObject({
+    protocol: z.enum(['rest', 'soap', 'grpc', 'websocket']),
+    method: z.string().min(1).max(256).nullable(),
+    url: z.string().min(1).max(DESKTOP_AUDIT_LIMITS.maxUrlLength),
+    status: z.number().int().nullable(),
+    outcome: z.enum(['ok', 'failed']),
+    durationMs: z.number().int().min(0),
+    environment: z.string().min(1).max(256).nullable(),
+    requestId: z.string().min(1).max(128),
+    requestName: z.string().max(256),
+    sentAt: z.string().datetime(),
+});
+/** One finished sequence run: the engine's `SequenceOutcome` values, plus `cancelled`. */
+export const desktopRunFinishedDetailsSchema = z.strictObject({
+    sequenceId: z.string().min(1).max(128),
+    /** The test suite's name; `sequenceName`, so it is never read as the workspace's `name`. */
+    sequenceName: z.string().max(256),
+    outcome: z.enum(['passed', 'failed', 'errored', 'skipped', 'cancelled']),
+    passed: z.number().int().min(0),
+    failed: z.number().int().min(0),
+    errored: z.number().int().min(0),
+    skipped: z.number().int().min(0),
+    durationMs: z.number().int().min(0),
+    hosts: z.array(z.string().min(1).max(DESKTOP_AUDIT_LIMITS.maxUrlLength)).max(DESKTOP_AUDIT_LIMITS.maxHosts),
+    environment: z.string().max(256).nullable(),
+    startedAt: z.string().datetime(),
+    sentAt: z.string().datetime(),
+});
+export const desktopAuditEventSchema = z.discriminatedUnion('action', [
+    z.strictObject({ action: z.literal('desktop.request_sent'), details: desktopRequestSentDetailsSchema }),
+    z.strictObject({ action: z.literal('desktop.run_finished'), details: desktopRunFinishedDetailsSchema }),
+]);
+/** `dropped` counts events the outbox discarded before this batch, so the server can record the gap. */
+export const desktopAuditBatchSchema = z
+    .strictObject({
+    events: z.array(desktopAuditEventSchema).max(DESKTOP_AUDIT_LIMITS.maxBatch),
+    dropped: z.number().int().min(1).max(DESKTOP_AUDIT_LIMITS.maxDropped).optional(),
+})
+    .refine((batch) => batch.events.length > 0 || batch.dropped !== undefined, {
+    message: 'a batch carries events or a dropped count',
+});