import { z } from "zod/v4";
import { Uuid } from "./domain.js";
/**
 * Audit-log read contracts (M8 Agent X).
 *
 * Every mutating handler in dp-center-worker writes one audit_log row via
 * `writeAudit(...)` wrapped in `c.executionCtx.waitUntil`. The UI reads
 * back through `GET /api/audit-log` which paginates newest-first by
 * `(created_at, id) DESC` with an opaque base64url cursor.
 *
 * `actor_email` is JOIN-resolved from `public.users` so the list view can
 * render "alice@example.com did X" without a second lookup. `payload_json`
 * is a small, human-readable hint object — never row data, never secrets.
 */
export const AuditLogItemSchema = z.object({
    id: Uuid,
    actor_user_id: Uuid.optional(),
    actor_email: z.string().optional(),
    actor_machine_id: Uuid.optional(),
    action: z.string(),
    target_type: z.string(),
    target_id: z.string(),
    payload_json: z.unknown().nullable(),
    created_at: z.string().datetime(),
});
export const AuditLogListResponseSchema = z.object({
    items: z.array(AuditLogItemSchema),
    next_cursor: z.string().optional(),
});
//# sourceMappingURL=audit-contracts.js.map