Function: buildRecord()

buildRecord(input): { action: "subject.create"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { kind: "organization" | "person"; path: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "authentication-identity.link"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { subjectId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "bootstrap.apply"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { anchorCreated: boolean; identitiesCreated: number; organizationsCreated: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "access.deny"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "denied"; payload: { messageId: string; reason: "tenant_mismatch" | "schema_mismatch" | "unlisted_edge" | "actor_unverified" | "platform_grant_missing" | "scope_denied" | "principal_unknown" | "issuer_not_accepted"; schema: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "grant.create"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { bundle: string; granteeId: string; organizationId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "grant.revoke"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { cause?: "grantee-erased" | "bundle-replaced" | "grantor-revoked" | "holder-replaced"; causeGrantId?: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "person.invite"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { providerUserLinked: boolean; realm: "staff" | "holders"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "person.reinvite"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { previous: "failed" | "none" | "sent"; realm: "staff" | "holders"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "subject-key.destroy"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: object; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "identity-provider.converge"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { changed: ("smtp" | "realm" | "access-token-lifespan" | "id-token-lifespan" | "authorization-code-lifespan" | "refresh-token-lifespan" | "sso-session-lifespan" | "password-policy" | "brute-force" | "internationalisation" | "required-actions" | "client" | "client-scope" | "audience-mapper" | "direct-access-grants" | "root-account" | "client-disabled" | "invitation-mail")[]; realm: "staff" | "holders"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "audit.record-refused"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "denied"; payload: { reason: "tenant_mismatch" | "schema_mismatch" | "subject_unreadable" | "envelope_invalid" | "body_not_json" | "record_invalid" | "payload_hash_mismatch" | "producer_mismatch" | "not_a_producer" | "database_refused" | "not_canonical"; refusedProducer?: string; refusedRecordId?: string; streamSequence: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "accreditation.apply"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { accreditationId: string; frameworkVersion: number; organizationId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "accreditation.admit"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { accreditationId: string; fourEyes?: boolean; frameworkVersion: number; nameConfusable?: string[]; organizationId: string; reason?: "four-eyes" | "name-collision" | "name-script"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "accreditation.publish"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { accreditationId: string; frameworkVersion: number; organizationId: string; statementIds: string[]; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "framework.publish"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { digest: string; version: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "anchor.converge"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { changed: ("statement" | "key" | "framework" | "accreditation" | "four-eyes")[]; fourEyes?: boolean; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "entity-statement.prepare"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { accreditationId: string; exp: string; keyId: string; kind: "entity-configuration" | "subordinate-statement"; statementId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "entity-statement.publish"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { accreditationId: string; exp: string; keyId: string; kind: "entity-configuration" | "subordinate-statement"; recordedBy?: "approval" | "interrupted-settle" | "renewal-sweep"; statementId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "entity-statement.renew"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { accreditationId: string; exp: string; keyId: string; kind: "entity-configuration" | "subordinate-statement"; statementId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "signing-key.generate"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { keyId: string; purpose: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "configuration.apply"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { contentHash: string; driftCount: number; previousId?: string; supersedes?: string; versionId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "access.deny"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "denied"; payload: { messageId: string; reason: "tenant_mismatch" | "schema_mismatch" | "unlisted_edge" | "actor_unverified" | "platform_grant_missing" | "scope_denied" | "principal_unknown" | "issuer_not_accepted" | "actor_token_invalid"; schema: string; version: 2; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "identifier.create"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { host: string; identifierId: string; instanceId?: string; organizationId: string; version: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "identifier.prepare"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { host: string; identifierId: string; instanceId?: string; organizationId: string; reason?: "agent-refused"; version: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "identifier.update"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { host: string; identifierId: string; instanceId?: string; organizationId: string; reason?: "document-mismatch" | "agent-refused" | "host-unverified"; version: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "identifier.publish"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { did: string; identifierId: string; keyIds: string[]; version: number; versionId?: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "identifier.converge"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { changed: ("identifier" | "probe" | "methods")[]; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "registry.probe"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { changed: ("identifier" | "probe" | "methods")[]; registry: "centralized"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "placement.create"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { instanceId: string; state: "active" | "draining" | "retired"; subjectId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "agent.converge"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { changed: ("registries" | "instance" | "scheme-refused" | "tenancy-refused" | "custody-refused")[]; instanceId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "audit.checkpoint"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { fromSeq: number; keyId: string; toSeq: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "subject-key.rewrap"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { count: number; fromKekId: string; toKekId: string; unwrapFailed?: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "bootstrap.plan"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { driftCount: number; runId: string; wouldChange: boolean; wouldRefuse?: boolean; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "bootstrap.setup-code-issued"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { installerRunId: string; principal: "setup:installer"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "bootstrap.setup-code-reissued"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { installerRunId: string; principal: "setup:installer"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "bootstrap.setup-redeemed"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { forwardedAddress?: string; installerRunId: string; principal: "setup:root"; socketAddress?: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "bootstrap.setup-code-burned"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "denied"; payload: { attempts: number; forwardedAddress?: string; installerRunId: string; principal: "setup:root"; socketAddress?: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "bootstrap.setup-reopened"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { fromEngineVersion: number; installerRunId: string; principal: "setup:installer"; reopenedAtStep: "anchor" | "identifiers" | "organizations" | "identity-provider" | "accounts" | "key-store" | "configuration"; toEngineVersion: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "bootstrap.setup-step-applied"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { changed: boolean; environment?: string; governingAccount?: "created" | "present" | "skipped"; identifierMethod?: "webvh" | "web"; invitationSent?: boolean; principal: "setup:root"; runId: string; step: "anchor" | "identifiers" | "organizations" | "identity-provider" | "accounts" | "key-store" | "configuration"; versionId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "bootstrap.setup-completed"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { engineVersion: number; principal: "setup:root"; versionId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "signing-key.register"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { keyId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "placement.quota-held"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "denied"; payload: { perWindow: number; placed: number; windowSeconds: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "identifier.publish"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { assertionKeyIds: string[]; commitsTo?: string; did?: string; identifierId: string; method: "webvh" | "web"; reason?: "document-mismatch" | "agent-refused" | "host-unverified" | "host-taken"; signedBy?: string; version: number; versionId?: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "identifier.key-discard"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { identifierId: string; keyIds: string[]; reason: "spent" | "unpublished"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "bootstrap.root-invite"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { principal: "setup:installer"; runId: string; versionId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

Defined in: packages/audit-client/src/record.ts:63

Builds one audit record and validates it strictly (a field the action's registry entry does not list, a bad outcome or a pattern failure is refused here, at the producer, never filtered later).

Parameters

input

RecordInputs

Returns

A record that satisfies AuditRecorded, with payloadHash computed over the RFC 8785 canonical payload.

Type Literal

{ action: "subject.create"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { kind: "organization" | "person"; path: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "subject.create"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.kind

kind: "organization" | "person"

payload.path

path: string = TenantScopePath

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "authentication-identity.link"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { subjectId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "authentication-identity.link"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.subjectId

subjectId: string = Uuid

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "bootstrap.apply"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { anchorCreated: boolean; identitiesCreated: number; organizationsCreated: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "bootstrap.apply"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.anchorCreated

anchorCreated: boolean

payload.identitiesCreated

identitiesCreated: number

payload.organizationsCreated

organizationsCreated: number

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "access.deny"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "denied"; payload: { messageId: string; reason: "tenant_mismatch" | "schema_mismatch" | "unlisted_edge" | "actor_unverified" | "platform_grant_missing" | "scope_denied" | "principal_unknown" | "issuer_not_accepted"; schema: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "access.deny"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "denied"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.messageId

messageId: string = Uuid

The refused message's id, for joining to the caller's logs.

payload.reason

reason: "tenant_mismatch" | "schema_mismatch" | "unlisted_edge" | "actor_unverified" | "platform_grant_missing" | "scope_denied" | "principal_unknown" | "issuer_not_accepted"

payload.schema

schema: string = DeniedSchemaKey

The registry key of the refused request.

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "grant.create"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { bundle: string; granteeId: string; organizationId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "grant.create"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.bundle

bundle: string = BundleCode

payload.granteeId

granteeId: string = Uuid

payload.organizationId

organizationId: string = Uuid

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "grant.revoke"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { cause?: "grantee-erased" | "bundle-replaced" | "grantor-revoked" | "holder-replaced"; causeGrantId?: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "grant.revoke"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.cause?

optional cause?: "grantee-erased" | "bundle-replaced" | "grantor-revoked" | "holder-replaced"

payload.causeGrantId?

optional causeGrantId?: string

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "person.invite"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { providerUserLinked: boolean; realm: "staff" | "holders"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "person.invite"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.providerUserLinked

providerUserLinked: boolean

payload.realm

realm: "staff" | "holders" = IdentityProviderRealmSchema

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "person.reinvite"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { previous: "failed" | "none" | "sent"; realm: "staff" | "holders"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "person.reinvite"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.previous

previous: "failed" | "none" | "sent"

payload.realm

realm: "staff" | "holders" = IdentityProviderRealmSchema

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "subject-key.destroy"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: object; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "subject-key.destroy"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "identity-provider.converge"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { changed: ("smtp" | "realm" | "access-token-lifespan" | "id-token-lifespan" | "authorization-code-lifespan" | "refresh-token-lifespan" | "sso-session-lifespan" | "password-policy" | "brute-force" | "internationalisation" | "required-actions" | "client" | "client-scope" | "audience-mapper" | "direct-access-grants" | "root-account" | "client-disabled" | "invitation-mail")[]; realm: "staff" | "holders"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "identity-provider.converge"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.changed

changed: ("smtp" | "realm" | "access-token-lifespan" | "id-token-lifespan" | "authorization-code-lifespan" | "refresh-token-lifespan" | "sso-session-lifespan" | "password-policy" | "brute-force" | "internationalisation" | "required-actions" | "client" | "client-scope" | "audience-mapper" | "direct-access-grants" | "root-account" | "client-disabled" | "invitation-mail")[]

payload.realm

realm: "staff" | "holders" = IdentityProviderRealmSchema

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "audit.record-refused"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "denied"; payload: { reason: "tenant_mismatch" | "schema_mismatch" | "subject_unreadable" | "envelope_invalid" | "body_not_json" | "record_invalid" | "payload_hash_mismatch" | "producer_mismatch" | "not_a_producer" | "database_refused" | "not_canonical"; refusedProducer?: string; refusedRecordId?: string; streamSequence: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "audit.record-refused"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "denied"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.reason

reason: "tenant_mismatch" | "schema_mismatch" | "subject_unreadable" | "envelope_invalid" | "body_not_json" | "record_invalid" | "payload_hash_mismatch" | "producer_mismatch" | "not_a_producer" | "database_refused" | "not_canonical"

payload.refusedProducer?

optional refusedProducer?: string

The module token of the subject the message arrived on, when well-formed.

payload.refusedRecordId?

optional refusedRecordId?: string

The refused record's id, when the body held a well-formed one.

payload.streamSequence

streamSequence: number

The stream sequence of the refused message.

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "accreditation.apply"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { accreditationId: string; frameworkVersion: number; organizationId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "accreditation.apply"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.accreditationId

readonly accreditationId: string = Uuid

payload.frameworkVersion

readonly frameworkVersion: number

payload.organizationId

readonly organizationId: string = Uuid

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "accreditation.admit"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { accreditationId: string; fourEyes?: boolean; frameworkVersion: number; nameConfusable?: string[]; organizationId: string; reason?: "four-eyes" | "name-collision" | "name-script"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "accreditation.admit"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success" | "denied"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.accreditationId

accreditationId: string = Uuid

payload.fourEyes?

optional fourEyes?: boolean

Whether the four-eyes rule was in force for this decision, as read in the admission's own transaction. true on a record four eyes refused. Absent on records written before the field existed.

payload.frameworkVersion

frameworkVersion: number

payload.nameConfusable?

optional nameConfusable?: string[]

The entities whose display name folds to the same string as this organisation's. On a denied record with reason name-collision they are the ones that refused it. On success they are a warning: entities the refusal does not cover, which today means siblings that have applied and are not yet admitted, so two admissions racing each other each name the other. Absent when there are none, and on records written before the field existed.

payload.organizationId

organizationId: string = Uuid

payload.reason?

optional reason?: "four-eyes" | "name-collision" | "name-script"

Which rule refused, on a denied record. Absent on success, and on a denied record written before the field existed, when four eyes was the only rule that produced one.

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "accreditation.publish"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { accreditationId: string; frameworkVersion: number; organizationId: string; statementIds: string[]; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "accreditation.publish"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.accreditationId

accreditationId: string = Uuid

payload.frameworkVersion

frameworkVersion: number

payload.organizationId

organizationId: string = Uuid

payload.statementIds

statementIds: string[]

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "framework.publish"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { digest: string; version: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "framework.publish"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.digest

digest: string = Sha256Hex

payload.version

version: number

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "anchor.converge"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { changed: ("statement" | "key" | "framework" | "accreditation" | "four-eyes")[]; fourEyes?: boolean; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "anchor.converge"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.changed

changed: ("statement" | "key" | "framework" | "accreditation" | "four-eyes")[] = AnchorConvergeChanges

payload.fourEyes?

optional fourEyes?: boolean

The four-eyes rule as it stands after this run, whether or not the run changed it (changed holds four-eyes when it did). Absent on records written before the field existed.

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "entity-statement.prepare"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { accreditationId: string; exp: string; keyId: string; kind: "entity-configuration" | "subordinate-statement"; statementId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "entity-statement.prepare"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.accreditationId

readonly accreditationId: string = Uuid

payload.exp

readonly exp: string = Timestamp

The statement's exp.

payload.keyId

readonly keyId: string = KeyId

The published thumbprint of the signing key; never the custodian's handle.

payload.kind

readonly kind: "entity-configuration" | "subordinate-statement" = EntityStatementKindSchema

payload.statementId

readonly statementId: string = Uuid

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "entity-statement.publish"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { accreditationId: string; exp: string; keyId: string; kind: "entity-configuration" | "subordinate-statement"; recordedBy?: "approval" | "interrupted-settle" | "renewal-sweep"; statementId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "entity-statement.publish"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success" | "denied"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.accreditationId

accreditationId: string = Uuid

payload.exp

exp: string = Timestamp

The statement's exp.

payload.keyId

keyId: string = KeyId

The published thumbprint of the signing key; never the custodian's handle.

payload.kind

kind: "entity-configuration" | "subordinate-statement" = EntityStatementKindSchema

payload.recordedBy?

optional recordedBy?: "approval" | "interrupted-settle" | "renewal-sweep"

payload.statementId

statementId: string = Uuid

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "entity-statement.renew"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { accreditationId: string; exp: string; keyId: string; kind: "entity-configuration" | "subordinate-statement"; statementId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "entity-statement.renew"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.accreditationId

readonly accreditationId: string = Uuid

payload.exp

readonly exp: string = Timestamp

The statement's exp.

payload.keyId

readonly keyId: string = KeyId

The published thumbprint of the signing key; never the custodian's handle.

payload.kind

readonly kind: "entity-configuration" | "subordinate-statement" = EntityStatementKindSchema

payload.statementId

readonly statementId: string = Uuid

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "signing-key.generate"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { keyId: string; purpose: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "signing-key.generate"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.keyId

keyId: string = KeyId

payload.purpose

purpose: string

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "configuration.apply"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { contentHash: string; driftCount: number; previousId?: string; supersedes?: string; versionId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "configuration.apply"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.contentHash

contentHash: string = Sha256Hex

payload.driftCount

driftCount: number

payload.previousId?

optional previousId?: string

payload.supersedes?

optional supersedes?: string

The wizard's version this file was explicitly imported over, with --supersede (setup-wizard.md, DW19). Absent on every ordinary apply.

payload.versionId

versionId: string = Uuid

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "access.deny"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "denied"; payload: { messageId: string; reason: "tenant_mismatch" | "schema_mismatch" | "unlisted_edge" | "actor_unverified" | "platform_grant_missing" | "scope_denied" | "principal_unknown" | "issuer_not_accepted" | "actor_token_invalid"; schema: string; version: 2; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "access.deny"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "denied"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.messageId

messageId: string = Uuid

The refused message's id, for joining to the caller's logs.

payload.reason

reason: "tenant_mismatch" | "schema_mismatch" | "unlisted_edge" | "actor_unverified" | "platform_grant_missing" | "scope_denied" | "principal_unknown" | "issuer_not_accepted" | "actor_token_invalid"

payload.schema

schema: string = DeniedSchemaKey

The registry key of the refused request.

payload.version

version: 2

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "identifier.create"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { host: string; identifierId: string; instanceId?: string; organizationId: string; version: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "identifier.create"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.host

host: string = Hostname

payload.identifierId

identifierId: string = Uuid

payload.instanceId?

optional instanceId?: string

payload.organizationId

organizationId: string = Uuid

payload.version

version: number

The version published when the record was written: 0 before the first.

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "identifier.prepare"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { host: string; identifierId: string; instanceId?: string; organizationId: string; reason?: "agent-refused"; version: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "identifier.prepare"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success" | "denied"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.host

host: string = Hostname

payload.identifierId

identifierId: string = Uuid

payload.instanceId?

optional instanceId?: string

payload.organizationId

organizationId: string = Uuid

payload.reason?

optional reason?: "agent-refused"

payload.version

version: number

The version published when the record was written: 0 before the first.

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "identifier.update"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { host: string; identifierId: string; instanceId?: string; organizationId: string; reason?: "document-mismatch" | "agent-refused" | "host-unverified"; version: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "identifier.update"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success" | "denied"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.host

host: string = Hostname

payload.identifierId

identifierId: string = Uuid

payload.instanceId?

optional instanceId?: string

payload.organizationId

organizationId: string = Uuid

payload.reason?

optional reason?: "document-mismatch" | "agent-refused" | "host-unverified"

payload.version

version: number

The version published when the record was written: 0 before the first.

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "identifier.publish"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { did: string; identifierId: string; keyIds: string[]; version: number; versionId?: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "identifier.publish"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success" | "denied"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.did

did: string = Did

payload.identifierId

identifierId: string = Uuid

payload.keyIds

keyIds: string[]

payload.version

version: number

payload.versionId?

optional versionId?: string

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "identifier.converge"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { changed: ("identifier" | "probe" | "methods")[]; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "identifier.converge"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.changed

changed: ("identifier" | "probe" | "methods")[] = IssuanceConvergeChanges

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "registry.probe"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { changed: ("identifier" | "probe" | "methods")[]; registry: "centralized"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "registry.probe"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.changed

changed: ("identifier" | "probe" | "methods")[] = IssuanceConvergeChanges

payload.registry

registry: "centralized" = IdentifierRegistrySchema

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "placement.create"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { instanceId: string; state: "active" | "draining" | "retired"; subjectId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "placement.create"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.instanceId

instanceId: string = AgentInstanceId

payload.state

state: "active" | "draining" | "retired" = PlacementStateSchema

payload.subjectId

subjectId: string = Uuid

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "agent.converge"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { changed: ("registries" | "instance" | "scheme-refused" | "tenancy-refused" | "custody-refused")[]; instanceId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "agent.converge"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success" | "denied"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.changed

changed: ("registries" | "instance" | "scheme-refused" | "tenancy-refused" | "custody-refused")[] = AgentConvergeChanges

payload.instanceId

instanceId: string = AgentInstanceId

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "audit.checkpoint"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { fromSeq: number; keyId: string; toSeq: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "audit.checkpoint"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.fromSeq

fromSeq: number = Sequence

payload.keyId

keyId: string = KeyId

payload.toSeq

toSeq: number = Sequence

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "subject-key.rewrap"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { count: number; fromKekId: string; toKekId: string; unwrapFailed?: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "subject-key.rewrap"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.count

count: number

payload.fromKekId

fromKekId: string

payload.toKekId

toKekId: string

payload.unwrapFailed?

optional unwrapFailed?: number

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "bootstrap.plan"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { driftCount: number; runId: string; wouldChange: boolean; wouldRefuse?: boolean; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "bootstrap.plan"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.driftCount

driftCount: number

payload.runId

runId: string = Uuid

payload.wouldChange

wouldChange: boolean

payload.wouldRefuse?

optional wouldRefuse?: boolean

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "bootstrap.setup-code-issued"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { installerRunId: string; principal: "setup:installer"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "bootstrap.setup-code-issued"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.installerRunId

installerRunId: string = InstallerRunId

payload.principal

principal: "setup:installer"

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "bootstrap.setup-code-reissued"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { installerRunId: string; principal: "setup:installer"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "bootstrap.setup-code-reissued"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.installerRunId

installerRunId: string = InstallerRunId

payload.principal

principal: "setup:installer"

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "bootstrap.setup-redeemed"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { forwardedAddress?: string; installerRunId: string; principal: "setup:root"; socketAddress?: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "bootstrap.setup-redeemed"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.forwardedAddress?

optional forwardedAddress?: string

The client address the edge forwarded, when it forwarded one that is an address.

payload.installerRunId

installerRunId: string = InstallerRunId

payload.principal

principal: "setup:root"

payload.socketAddress?

optional socketAddress?: string

The peer address of the connection. Behind the edge this is the edge's. Absent when the service could not read one: an absence says "unknown", which a placeholder address would have said falsely.

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "bootstrap.setup-code-burned"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "denied"; payload: { attempts: number; forwardedAddress?: string; installerRunId: string; principal: "setup:root"; socketAddress?: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "bootstrap.setup-code-burned"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "denied"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.attempts

attempts: number

payload.forwardedAddress?

optional forwardedAddress?: string

The client address the edge forwarded, when it forwarded one that is an address.

payload.installerRunId

installerRunId: string = InstallerRunId

payload.principal

principal: "setup:root"

payload.socketAddress?

optional socketAddress?: string

The peer address of the connection. Behind the edge this is the edge's. Absent when the service could not read one: an absence says "unknown", which a placeholder address would have said falsely.

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "bootstrap.setup-reopened"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { fromEngineVersion: number; installerRunId: string; principal: "setup:installer"; reopenedAtStep: "anchor" | "identifiers" | "organizations" | "identity-provider" | "accounts" | "key-store" | "configuration"; toEngineVersion: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "bootstrap.setup-reopened"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.fromEngineVersion

fromEngineVersion: number = EngineVersion

The engine version setup was completed with.

payload.installerRunId

installerRunId: string = InstallerRunId

payload.principal

principal: "setup:installer"

payload.reopenedAtStep

reopenedAtStep: "anchor" | "identifiers" | "organizations" | "identity-provider" | "accounts" | "key-store" | "configuration" = SetupStepIdSchema

The first step the completing version lacked.

payload.toEngineVersion

toEngineVersion: number = EngineVersion

The engine version of the image that reopened it. Always higher.

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "bootstrap.setup-step-applied"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { changed: boolean; environment?: string; governingAccount?: "created" | "present" | "skipped"; identifierMethod?: "webvh" | "web"; invitationSent?: boolean; principal: "setup:root"; runId: string; step: "anchor" | "identifiers" | "organizations" | "identity-provider" | "accounts" | "key-store" | "configuration"; versionId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "bootstrap.setup-step-applied"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.changed

changed: boolean

payload.environment?

optional environment?: string

With governingAccount: the environment class the step ran in.

payload.governingAccount?

optional governingAccount?: "created" | "present" | "skipped"

On the accounts step only (DW15, rule 7): whether this apply created the governing account, found it already there, or skipped it because the root account also governs. A skip is recorded so that it is a dated fact and not an absence.

payload.identifierMethod?

optional identifierMethod?: "webvh" | "web"

On the identifiers step only (W6), when the answers asked for the anchor's own identifier: the method it was asked with. Absent when no anchor identifier was asked for, so an absence is not read as a default.

payload.invitationSent?

optional invitationSent?: boolean

With governingAccount: created: whether the invitation was handed to the mail relay.

payload.principal

principal: "setup:root"

payload.runId

runId: string = Uuid

The run, as in the setup service's log.

payload.step

step: "anchor" | "identifiers" | "organizations" | "identity-provider" | "accounts" | "key-store" | "configuration" = SetupStepIdSchema

payload.versionId

versionId: string = Uuid

The configuration version the step was applied for.

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "bootstrap.setup-completed"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { engineVersion: number; principal: "setup:root"; versionId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "bootstrap.setup-completed"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.engineVersion

engineVersion: number = EngineVersion

payload.principal

principal: "setup:root"

payload.versionId

versionId: string = Uuid

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "signing-key.register"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { keyId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "signing-key.register"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.keyId

keyId: string = KeyId

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "placement.quota-held"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "denied"; payload: { perWindow: number; placed: number; windowSeconds: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "placement.quota-held"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "denied"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.perWindow

perWindow: number

payload.placed

placed: number

payload.windowSeconds

windowSeconds: number

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "identifier.publish"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { assertionKeyIds: string[]; commitsTo?: string; did?: string; identifierId: string; method: "webvh" | "web"; reason?: "document-mismatch" | "agent-refused" | "host-unverified" | "host-taken"; signedBy?: string; version: number; versionId?: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "identifier.publish"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success" | "denied"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.assertionKeyIds

assertionKeyIds: string[]

payload.commitsTo?

optional commitsTo?: string

payload.did?

optional did?: string

payload.identifierId

identifierId: string = Uuid

payload.method

method: "webvh" | "web" = IdentifierMethodSchema

payload.reason?

optional reason?: "document-mismatch" | "agent-refused" | "host-unverified" | "host-taken"

payload.signedBy?

optional signedBy?: string

payload.version

version: number

payload.versionId?

optional versionId?: string

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "identifier.key-discard"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { identifierId: string; keyIds: string[]; reason: "spent" | "unpublished"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "identifier.key-discard"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.identifierId

identifierId: string = Uuid

payload.keyIds

keyIds: string[]

payload.reason

reason: "spent" | "unpublished"

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

---

Type Literal

{ action: "bootstrap.root-invite"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { principal: "setup:installer"; runId: string; versionId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

action

action: "bootstrap.root-invite"

actor

actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

correlationId: string

occurredAt

occurredAt: string = Timestamp

onBehalfOf?

optional onBehalfOf?: string

outcome

outcome: "success"

Exactly the outcomes the action's registry entry lists.

payload

payload: object

payload.principal

principal: "setup:installer"

payload.runId

runId: string = Uuid

This resend, as in the command's output.

payload.versionId

versionId: string = Uuid

The configuration version the realm and the address were read from.

payloadHash

payloadHash: string

producerModule

producerModule: string

recordId

recordId: string = Uuid

target?

optional target?: object

target.id

id: string = Uuid

target.type

type: string

tenant

tenant: string = Tenant

Throws

not_a_producer or invalid_record.