audit

const (
	DecisionAllow   Decision = "allow"
	DecisionAsk     Decision = "ask"
	DecisionDeny    Decision = "deny"
	DecisionUnknown Decision = "unknown"
)

const (
	DecisionBySystem  DecisionBy = "system"
	DecisionByHuman   DecisionBy = "human"
	DecisionByPolicy  DecisionBy = "policy"
	DecisionByUnknown DecisionBy = "unknown"
)

const (
	KindRunStarted     Kind = "run_started"
	KindRunFinished    Kind = "run_finished"
	KindSessionStarted Kind = "session_started"
	// KindSupervisionFinished means Relayer stopped supervising the session;
	// it does not claim that a persistent tmux process exited.
	KindSupervisionFinished Kind = "supervision_finished"
	KindSessionFinished     Kind = "session_finished"
	KindEventDetected       Kind = "event_detected"
	// KindEventWithdrawn records that an occurrence which was awaiting a human
	// stopped being pending without a decision being delivered. It is the only
	// evidence that a supervision gate opened on its own.
	KindEventWithdrawn  Kind = "event_withdrawn"
	KindPolicyEvaluated Kind = "policy_evaluated"
	KindDecision        Kind = "decision"
	KindDelivery        Kind = "delivery"
	// KindOperatorInput records only the lifecycle of a direct, human line
	// submission. Entry intentionally has no field for the submitted text,
	// its length, or the encoded terminal bytes.
	KindOperatorInput Kind = "operator_input"
	// KindAttachStarted and KindAttachFinished record that a human took or
	// dropped direct control of a terminal. They never carry what was typed
	// while holding it: SanitizeEntry drops Summary, EventID and Rule for them
	// as it does for the recording and control kinds.
	KindAttachStarted  Kind = "attach_started"
	KindAttachFinished Kind = "attach_finished"
	KindBackendError   Kind = "backend_error"
	KindSessionCleanup Kind = "session_cleanup"
	// Recording kinds describe the lifecycle of a stored terminal replay. They
	// state that a recording exists and how large it is; the captured stream
	// itself is never a field of Entry, and neither is any recorded keystroke.
	// SanitizeEntry drops Summary, EventID and Rule for them, so a caller has
	// no free-form field left to put one in.
	KindRecordingStarted  Kind = "recording_started"
	KindRecordingFinished Kind = "recording_finished"
	KindRecordingExported Kind = "recording_exported"
	KindRecordingDeleted  Kind = "recording_deleted"
	// Control kinds record which operator held the interactive keyboard and how
	// the hand-over happened. They never carry what was typed while holding it:
	// SanitizeEntry drops Summary, EventID and Rule for them as it does for the
	// recording kinds.
	KindControlRequested Kind = "control_requested"
	KindControlGranted   Kind = "control_granted"
	KindControlDeclined  Kind = "control_declined"
	KindControlReleased  Kind = "control_released"
	KindControlForced    Kind = "control_forced"
	KindUnknown          Kind = "unknown"
)

const (
	ModeOff      Mode = "off"
	ModeMetadata Mode = "metadata"
	ModeDetailed Mode = "detailed"
)

const (
	OutcomeStarted                   Outcome = "started"
	OutcomeFinished                  Outcome = "finished"
	OutcomeDetected                  Outcome = "detected"
	OutcomePending                   Outcome = "pending"
	OutcomeInFlight                  Outcome = "in_flight"
	OutcomeApplied                   Outcome = "applied"
	OutcomeAsk                       Outcome = "ask"
	OutcomeDryRun                    Outcome = "dry_run"
	OutcomeFallbackUnsupported       Outcome = "fallback_unsupported"
	OutcomeFallbackStale             Outcome = "fallback_stale"
	OutcomeFallbackDeliveryUncertain Outcome = "fallback_delivery_uncertain"
	OutcomeSucceeded                 Outcome = "succeeded"
	OutcomeFailed                    Outcome = "failed"
	OutcomeCancelled                 Outcome = "cancelled"
	OutcomeSkipped                   Outcome = "skipped"
	OutcomeUnknown                   Outcome = "unknown"
)