Type Alias AuditEventKind

AuditEventKind:
    | "install"
    | "uninstall"
    | "update"
    | "enable"
    | "disable"
    | "capability_grant"
    | "capability_revoke"
    | "activate"
    | "deactivate"
    | "mutation_summary"
    | "network_fetch"
    | "unhealthy"
    | "killed"

Audit event types.

The audit log captures security-relevant lifecycle events for extensions. Records are append-only, local-only, and capped by both count and byte size.

What goes in:

install / uninstall / update
capability grant / revoke
activation / deactivation
mutation summary (count + scope, never content)
network fetch (URL + status + byte count, never body)
unhealthy / killed extension events

What does NOT go in:

model content
chat content
file contents
BYOK keys (by construction; the log never sees them)

Spec: docs/architecture/ai-customization/02-security.md §12.