@kici-dev/engine 0.0.0 → 0.1.0

package/dist/protocol/messages/platform-orchestrator.d.ts

@@ -0,0 +1,1888 @@
+import { z } from 'zod';
+/** Trust policy update pushed from Platform to orchestrator when policy or identity links change. */
+export declare const trustPolicyUpdateSchema: z.ZodObject<{
+    type: z.ZodLiteral<"trust_policy.update">;
+    orgId: z.ZodString;
+    policy: z.ZodObject<{
+        forkPolicy: z.ZodEnum<{
+            hold: "hold";
+            reject: "reject";
+            allow: "allow";
+        }>;
+        unknownContributorPolicy: z.ZodEnum<{
+            hold: "hold";
+            reject: "reject";
+        }>;
+        workflowChangePolicy: z.ZodEnum<{
+            hold: "hold";
+            reject: "reject";
+            allow: "allow";
+        }>;
+        approvalExpiryHours: z.ZodNumber;
+    }, z.core.$strip>;
+    identityLinks: z.ZodArray<z.ZodObject<{
+        userId: z.ZodString;
+        provider: z.ZodString;
+        providerUsername: z.ZodString;
+        providerUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>;
+    memberCiTrustLevels: z.ZodRecord<z.ZodString, z.ZodEnum<{
+        none: "none";
+        read: "read";
+        write: "write";
+        admin: "admin";
+    }>>;
+}, z.core.$strip>;
+export type TrustPolicyUpdate = z.infer<typeof trustPolicyUpdateSchema>;
+/**
+ * Internal shape of a fully-reassembled, HMAC-verified webhook relay handed
+ * to the orchestrator's `onWebhookRelay` callback.
+ *
+ * NOT a wire-parseable schema: this shape is intentionally absent from the
+ * `platformToOrchestratorMessageSchema` discriminated union so that a rogue
+ * or compromised Platform process (A10) cannot fabricate one and bypass the
+ * on-orchestrator HMAC verification gate. The only legitimate construction
+ * site is `completeChunkedRelay` in `packages/orchestrator/src/ws/platform-client.ts`,
+ * which synthesizes this shape AFTER `onVerifyInbound` returns `'accepted'`.
+ *
+ * Migration `packages/platform/src/db/migrations/012_drop_webhook_secret_columns.ts`
+ * makes the orch-side `verifyInboundWebhook` (called from `onVerifyInbound` on
+ * the chunked relay path `webhook.relay.start` / `webhook.relay.chunk`) the
+ * sole trust boundary against a malicious Platform; keeping this schema OUT
+ * of the wire union enforces that invariant statically.
+ */
+export declare const webhookRelaySchema: z.ZodObject<{
+    type: z.ZodLiteral<"webhook.relay">;
+    messageId: z.ZodString;
+    routingKey: z.ZodString;
+    deliveryId: z.ZodString;
+    event: z.ZodString;
+    action: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    payload: z.ZodUnknown;
+    requestId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * HMAC verification + processing result returned by orchestrator in webhook.ack.
+ *
+ * Used in the chunked relay protocol where the orchestrator (not Platform)
+ * verifies the inbound HMAC signature against its locally-stored secret.
+ *
+ * - `accepted`: signature verified (or method is `none`/IP allowlist OK), webhook
+ *   handed to the existing webhook processing pipeline.
+ * - `rejected_signature`: signature did not match any rotation secret. Maps to HTTP 401.
+ * - `rejected_unknown_source`: the routing key is not registered on this orchestrator
+ *   (or the provider is not yet implemented). Maps to HTTP 404 + Platform negative cache.
+ * - `rejected_misconfigured`: the orchestrator has the source but its verification config
+ *   is malformed (e.g. invalid JSON in generic_webhook_sources.verification_config) or
+ *   the chunked stream itself was malformed (out-of-order, oversize, base64 decode fail,
+ *   missing chunks at finalization, TTL expiry). Maps to HTTP 500.
+ */
+export declare const WebhookRelayResult: z.ZodEnum<{
+    accepted: "accepted";
+    rejected_signature: "rejected_signature";
+    rejected_unknown_source: "rejected_unknown_source";
+    rejected_misconfigured: "rejected_misconfigured";
+}>;
+export type WebhookRelayResult = z.infer<typeof WebhookRelayResult>;
+/**
+ * Maximum total body size accepted by the chunked webhook relay protocol.
+ * 25 MiB matches GitHub's own webhook payload cap. Senders that need higher must
+ * connect their orchestrator directly (bypassing Platform).
+ */
+export declare const WEBHOOK_RELAY_MAX_BODY_BYTES: number;
+/**
+ * Recommended raw chunk size for the chunked relay protocol. 64 KiB raw becomes
+ * ~85 KiB base64 in JSON; permessage-deflate compresses it well. Sender (Platform)
+ * picks the actual size; receiver (orchestrator) just enforces totalSize and chunkCount.
+ */
+export declare const WEBHOOK_RELAY_CHUNK_SIZE: number;
+/**
+ * Start frame of the chunked webhook relay protocol (Platform -> orchestrator).
+ * Carries metadata + signature inputs only; body bytes follow in subsequent
+ * webhook.relay.chunk frames correlated by messageId.
+ *
+ * The orchestrator allocates a per-messageId reassembly buffer on receipt.
+ * No webhook.ack is sent until the final chunk completes the stream.
+ */
+export declare const webhookRelayStartSchema: z.ZodObject<{
+    type: z.ZodLiteral<"webhook.relay.start">;
+    messageId: z.ZodString;
+    routingKey: z.ZodString;
+    deliveryId: z.ZodString;
+    event: z.ZodString;
+    action: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    signatureHeaderName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    signatureHeader: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    clientIp: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    headers: z.ZodRecord<z.ZodString, z.ZodString>;
+    totalSize: z.ZodNumber;
+    chunkCount: z.ZodNumber;
+    requestId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type WebhookRelayStart = z.infer<typeof webhookRelayStartSchema>;
+/**
+ * One chunk of the body. Sequence is 0-indexed and MUST arrive strictly in order;
+ * the final=true chunk completes the stream and triggers verify+process on the
+ * orchestrator. Decoded chunk bytes (sum across the stream) MUST equal totalSize
+ * declared in webhook.relay.start.
+ */
+export declare const webhookRelayChunkSchema: z.ZodObject<{
+    type: z.ZodLiteral<"webhook.relay.chunk">;
+    messageId: z.ZodString;
+    sequence: z.ZodNumber;
+    data: z.ZodString;
+    final: z.ZodBoolean;
+}, z.core.$strip>;
+export type WebhookRelayChunk = z.infer<typeof webhookRelayChunkSchema>;
+/** Peer discovery notification sent by Platform when another orchestrator shares routing keys. */
+export declare const peerDiscoverSchema: z.ZodObject<{
+    type: z.ZodLiteral<"peer.discover">;
+    peer: z.ZodObject<{
+        connectionId: z.ZodString;
+        instanceId: z.ZodOptional<z.ZodString>;
+        address: z.ZodNullable<z.ZodString>;
+        routingKeys: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+/** Full peer list update pushed by Platform to all pool members when membership changes. Replaces peer.discover. */
+export declare const peerUpdateSchema: z.ZodObject<{
+    type: z.ZodLiteral<"peer.update">;
+    peers: z.ZodArray<z.ZodObject<{
+        connectionId: z.ZodString;
+        instanceId: z.ZodOptional<z.ZodString>;
+        address: z.ZodNullable<z.ZodString>;
+        routingKeys: z.ZodArray<z.ZodString>;
+        orchRole: z.ZodOptional<z.ZodEnum<{
+            coordinator: "coordinator";
+            worker: "worker";
+        }>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * Stale check run cleanup request sent by Platform when a replacement orchestrator
+ * reconnects after the previous one died. Contains metadata for runs that were
+ * marked timed_out_stale by Platform, so the orchestrator can update stuck GitHub
+ * check runs that the dead orchestrator left as "in_progress".
+ */
+export declare const staleCheckrunCleanupSchema: z.ZodObject<{
+    type: z.ZodLiteral<"stale.checkrun.cleanup">;
+    runs: z.ZodArray<z.ZodObject<{
+        runId: z.ZodString;
+        provider: z.ZodString;
+        routingKey: z.ZodString;
+        repoIdentifier: z.ZodString;
+        sha: z.ZodString;
+        workflowName: z.ZodString;
+        jobNames: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type StaleCheckrunCleanup = z.infer<typeof staleCheckrunCleanupSchema>;
+/** Periodic OTel metrics push from orchestrator to Platform for centralized observability. */
+export declare const orchMetricsSchema: z.ZodObject<{
+    type: z.ZodLiteral<"orch.metrics">;
+    messageId: z.ZodString;
+    metrics: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        type: z.ZodEnum<{
+            counter: "counter";
+            histogram: "histogram";
+            gauge: "gauge";
+            upDownCounter: "upDownCounter";
+        }>;
+        value: z.ZodOptional<z.ZodNumber>;
+        labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        buckets: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            le: z.ZodNumber;
+            count: z.ZodNumber;
+        }, z.core.$strip>>>;
+        count: z.ZodOptional<z.ZodNumber>;
+        sum: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+    timestamp: z.ZodNumber;
+}, z.core.$strip>;
+export type OrchMetrics = z.infer<typeof orchMetricsSchema>;
+/**
+ * Acknowledgment that a webhook was received and processing started.
+ *
+ * Under the chunked relay protocol the orchestrator also reports the HMAC
+ * verification outcome here via `result`, and may include a non-secret-bearing
+ * diagnostic in `reason` when result is a rejection. Both fields are optional
+ * for backward compatibility during the rollout: pre-cutover senders omit them.
+ */
+export declare const webhookAckSchema: z.ZodObject<{
+    type: z.ZodLiteral<"webhook.ack">;
+    messageId: z.ZodString;
+    deliveryId: z.ZodString;
+    result: z.ZodOptional<z.ZodEnum<{
+        accepted: "accepted";
+        rejected_signature: "rejected_signature";
+        rejected_unknown_source: "rejected_unknown_source";
+        rejected_misconfigured: "rejected_misconfigured";
+    }>>;
+    reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+/** Execution lifecycle event reported back to Platform. */
+export declare const executionEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"execution.event">;
+    messageId: z.ZodString;
+    runId: z.ZodString;
+    event: z.ZodEnum<{
+        started: "started";
+        job_dispatched: "job_dispatched";
+        job_completed: "job_completed";
+        finished: "finished";
+    }>;
+    data: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    timestamp: z.ZodNumber;
+}, z.core.$strip>;
+/** Streaming log chunk from job execution. */
+export declare const logChunkSchema: z.ZodObject<{
+    type: z.ZodLiteral<"log.chunk">;
+    messageId: z.ZodString;
+    runId: z.ZodString;
+    jobId: z.ZodString;
+    stepIndex: z.ZodNumber;
+    lines: z.ZodArray<z.ZodString>;
+    timestamp: z.ZodNumber;
+}, z.core.$strip>;
+/** Cache lookup statistics forwarded from orchestrator to Platform for centralized metrics. */
+export declare const cacheStatsSchema: z.ZodObject<{
+    type: z.ZodLiteral<"cache.stats">;
+    cacheType: z.ZodEnum<{
+        source: "source";
+        dep: "dep";
+    }>;
+    hit: z.ZodBoolean;
+}, z.core.$strip>;
+export type CacheStats = z.infer<typeof cacheStatsSchema>;
+/** All messages that flow from Platform to Orchestrator.
+ *
+ * The single-frame `webhookRelaySchema` is intentionally NOT a member of this
+ * union: that shape carries an attacker-controlled `payload` and pre-existed
+ * the chunked relay's on-orch HMAC verification, so accepting it on the wire
+ * would let a compromised Platform (A10) fabricate webhook deliveries that
+ * bypass the only trust boundary against a malicious Platform (see the
+ * docblock on `webhookRelaySchema` above and migration
+ * `packages/platform/src/db/migrations/012_drop_webhook_secret_columns.ts`).
+ * The chunked path `webhook.relay.start` + `webhook.relay.chunk` is the sole
+ * legitimate route from Platform to `onWebhookRelay`. */
+export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"webhook.relay.start">;
+    messageId: z.ZodString;
+    routingKey: z.ZodString;
+    deliveryId: z.ZodString;
+    event: z.ZodString;
+    action: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    signatureHeaderName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    signatureHeader: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    clientIp: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    headers: z.ZodRecord<z.ZodString, z.ZodString>;
+    totalSize: z.ZodNumber;
+    chunkCount: z.ZodNumber;
+    requestId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"webhook.relay.chunk">;
+    messageId: z.ZodString;
+    sequence: z.ZodNumber;
+    data: z.ZodString;
+    final: z.ZodBoolean;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"trust_policy.update">;
+    orgId: z.ZodString;
+    policy: z.ZodObject<{
+        forkPolicy: z.ZodEnum<{
+            hold: "hold";
+            reject: "reject";
+            allow: "allow";
+        }>;
+        unknownContributorPolicy: z.ZodEnum<{
+            hold: "hold";
+            reject: "reject";
+        }>;
+        workflowChangePolicy: z.ZodEnum<{
+            hold: "hold";
+            reject: "reject";
+            allow: "allow";
+        }>;
+        approvalExpiryHours: z.ZodNumber;
+    }, z.core.$strip>;
+    identityLinks: z.ZodArray<z.ZodObject<{
+        userId: z.ZodString;
+        provider: z.ZodString;
+        providerUsername: z.ZodString;
+        providerUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>;
+    memberCiTrustLevels: z.ZodRecord<z.ZodString, z.ZodEnum<{
+        none: "none";
+        read: "read";
+        write: "write";
+        admin: "admin";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"source.register.ack">;
+    messageId: z.ZodString;
+    accepted: z.ZodArray<z.ZodString>;
+    rejected: z.ZodArray<z.ZodObject<{
+        routingKey: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>>;
+    peers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        connectionId: z.ZodString;
+        instanceId: z.ZodOptional<z.ZodString>;
+        address: z.ZodNullable<z.ZodString>;
+        routingKeys: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"source.deregister.ack">;
+    messageId: z.ZodString;
+    removed: z.ZodArray<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"auth.success">;
+    connectionId: z.ZodString;
+    orgPublicAlias: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"auth.failure">;
+    reason: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"peer.discover">;
+    peer: z.ZodObject<{
+        connectionId: z.ZodString;
+        instanceId: z.ZodOptional<z.ZodString>;
+        address: z.ZodNullable<z.ZodString>;
+        routingKeys: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"peer.update">;
+    peers: z.ZodArray<z.ZodObject<{
+        connectionId: z.ZodString;
+        instanceId: z.ZodOptional<z.ZodString>;
+        address: z.ZodNullable<z.ZodString>;
+        routingKeys: z.ZodArray<z.ZodString>;
+        orchRole: z.ZodOptional<z.ZodEnum<{
+            coordinator: "coordinator";
+            worker: "worker";
+        }>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"stale.checkrun.cleanup">;
+    runs: z.ZodArray<z.ZodObject<{
+        runId: z.ZodString;
+        provider: z.ZodString;
+        routingKey: z.ZodString;
+        repoIdentifier: z.ZodString;
+        sha: z.ZodString;
+        workflowName: z.ZodString;
+        jobNames: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.run.detail">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.step.logs">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodString;
+    jobId: z.ZodString;
+    stepIndex: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"run.rerun.request">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodString;
+    routingKey: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"run.manual_schedule.request">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    registrationId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"run.cancel.request">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodString;
+    force: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.payload">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.orch.logs">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodString;
+    jobId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.environments.list">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.environments.get">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    environmentId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.environments.create">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    name: z.ZodString;
+    envType: z.ZodEnum<{
+        fixed: "fixed";
+        glob: "glob";
+    }>;
+    globPattern: z.ZodOptional<z.ZodString>;
+    branchRestrictions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    concurrencyLimit: z.ZodOptional<z.ZodNumber>;
+    concurrencyStrategy: z.ZodOptional<z.ZodEnum<{
+        queue: "queue";
+        "cancel-pending": "cancel-pending";
+    }>>;
+    requiredReviewers: z.ZodOptional<z.ZodNumber>;
+    waitTimerSeconds: z.ZodOptional<z.ZodNumber>;
+    holdExpirySeconds: z.ZodOptional<z.ZodNumber>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.environments.update">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    environmentId: z.ZodString;
+    updates: z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        envType: z.ZodOptional<z.ZodEnum<{
+            fixed: "fixed";
+            glob: "glob";
+        }>>;
+        globPattern: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        branchRestrictions: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        concurrencyLimit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        concurrencyStrategy: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            queue: "queue";
+            "cancel-pending": "cancel-pending";
+        }>>>;
+        requiredReviewers: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        waitTimerSeconds: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        holdExpirySeconds: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        enabled: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.environments.delete">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    environmentId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.environments.variables.list">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    environmentId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.environments.variables.set">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    environmentId: z.ZodString;
+    key: z.ZodString;
+    value: z.ZodString;
+    locked: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.environments.variables.delete">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    environmentId: z.ZodString;
+    key: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.environments.source-overrides.list">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    environmentId: z.ZodString;
+    routingKey: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.environments.source-overrides.set">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    environmentId: z.ZodString;
+    routingKey: z.ZodString;
+    key: z.ZodString;
+    value: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.environments.source-overrides.delete">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    environmentId: z.ZodString;
+    routingKey: z.ZodString;
+    key: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.environments.bindings.list">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    environmentId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.environments.bindings.set">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    environmentId: z.ZodString;
+    scopePatterns: z.ZodArray<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.environments.secrets.list">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.environments.secrets.set">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    scope: z.ZodString;
+    key: z.ZodString;
+    value: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.environments.secrets.delete">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    scope: z.ZodString;
+    key: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.environments.secrets.scope.create">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    scope: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.environments.secrets.scope.rename">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    oldScope: z.ZodString;
+    newScope: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.environments.secrets.scope.delete">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    scope: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.environments.history">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    environmentName: z.ZodString;
+    limit: z.ZodOptional<z.ZodNumber>;
+    offset: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.held-runs.list">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    status: z.ZodOptional<z.ZodEnum<{
+        pending: "pending";
+        rejected: "rejected";
+        approved: "approved";
+        expired: "expired";
+    }>>;
+    queueType: z.ZodOptional<z.ZodEnum<{
+        environment: "environment";
+        security: "security";
+    }>>;
+    runId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.held-runs.approve">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    heldRunId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.held-runs.reject">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    heldRunId: z.ZodString;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.registrations.list">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    triggerType: z.ZodOptional<z.ZodString>;
+    repoIdentifier: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.registration.disable">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    registrationId: z.ZodString;
+    disabled: z.ZodBoolean;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.registration.delete">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    registrationId: z.ZodString;
+    cancelActiveRuns: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.diagnostics">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    includeAgents: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.scaler.capacity">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.scaler.agents">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    scalerName: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.backends.list">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.backends.get">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    name: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.backends.sync">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.backends.sync.one">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    name: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.backends.test">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    name: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.event-log.list">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    orgId: z.ZodString;
+    routingKey: z.ZodOptional<z.ZodString>;
+    event: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodEnum<{
+        failed: "failed";
+        received: "received";
+        processed: "processed";
+        duplicate: "duplicate";
+        lockfile_missing: "lockfile_missing";
+    }>>;
+    fromTimestamp: z.ZodOptional<z.ZodString>;
+    toTimestamp: z.ZodOptional<z.ZodString>;
+    deliveryId: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodNumber>;
+    cursor: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.event-log.detail">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    orgId: z.ZodString;
+    deliveryId: z.ZodString;
+    routingKey: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.event-log.payload.stream">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    orgId: z.ZodString;
+    deliveryId: z.ZodString;
+    routingKey: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.global-workflows.get">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.global-workflows.update">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    allowedRepos: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
+        routingKey: z.ZodOptional<z.ZodString>;
+        pattern: z.ZodString;
+    }, z.core.$strip>>>>;
+    deniedRepos: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
+        routingKey: z.ZodOptional<z.ZodString>;
+        pattern: z.ZodString;
+    }, z.core.$strip>>>>;
+    elevatedRepos: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
+        routingKey: z.ZodOptional<z.ZodString>;
+        pattern: z.ZodString;
+    }, z.core.$strip>>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.access-log.list">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    orgId: z.ZodString;
+    actorType: z.ZodOptional<z.ZodEnum<{
+        user: "user";
+        api_key: "api_key";
+        service_account: "service_account";
+        platform_operator: "platform_operator";
+        system: "system";
+    }>>;
+    actorId: z.ZodOptional<z.ZodString>;
+    action: z.ZodOptional<z.ZodEnum<{
+        "run.detail.read": "run.detail.read";
+        "run.payload.read": "run.payload.read";
+        "run.orch_logs.read": "run.orch_logs.read";
+        "step.logs.read": "step.logs.read";
+        "run.cancel": "run.cancel";
+        "run.rerun": "run.rerun";
+        "run.manual_schedule": "run.manual_schedule";
+        "job.cancel": "job.cancel";
+        "event_log.list.read": "event_log.list.read";
+        "event_log.detail.read": "event_log.detail.read";
+        "event_log.payload.read": "event_log.payload.read";
+        "environment.list.read": "environment.list.read";
+        "environment.get.read": "environment.get.read";
+        "environment.create": "environment.create";
+        "environment.update": "environment.update";
+        "environment.delete": "environment.delete";
+        "env_var.list.read": "env_var.list.read";
+        "env_var.set": "env_var.set";
+        "env_var.delete": "env_var.delete";
+        "source_override.list.read": "source_override.list.read";
+        "source_override.set": "source_override.set";
+        "source_override.delete": "source_override.delete";
+        "env_binding.list.read": "env_binding.list.read";
+        "env_binding.set": "env_binding.set";
+        "secret.list.read": "secret.list.read";
+        "secret.set": "secret.set";
+        "secret.delete": "secret.delete";
+        "secret.reveal": "secret.reveal";
+        "secret_scope.create": "secret_scope.create";
+        "secret_scope.rename": "secret_scope.rename";
+        "secret_scope.delete": "secret_scope.delete";
+        "environment.history.read": "environment.history.read";
+        "held_run.list.read": "held_run.list.read";
+        "held_run.approve": "held_run.approve";
+        "held_run.reject": "held_run.reject";
+        "registration.list.read": "registration.list.read";
+        "registration.disable": "registration.disable";
+        "registration.delete": "registration.delete";
+        "diagnostics.read": "diagnostics.read";
+        "scaler.capacity.read": "scaler.capacity.read";
+        "scaler.agents.read": "scaler.agents.read";
+        "backend.list.read": "backend.list.read";
+        "backend.get.read": "backend.get.read";
+        "backend.sync": "backend.sync";
+        "backend.sync.one": "backend.sync.one";
+        "backend.test": "backend.test";
+        "global_workflows.get.read": "global_workflows.get.read";
+        "global_workflows.update": "global_workflows.update";
+        "access_log.list.read": "access_log.list.read";
+        "event_dlq.list.read": "event_dlq.list.read";
+        "event_dlq.retry": "event_dlq.retry";
+        "event_dlq.discard": "event_dlq.discard";
+        archive_chunk: "archive_chunk";
+    }>>;
+    source: z.ZodOptional<z.ZodEnum<{
+        platform_proxy: "platform_proxy";
+        admin_http: "admin_http";
+        admin_cli: "admin_cli";
+    }>>;
+    outcome: z.ZodOptional<z.ZodEnum<{
+        error: "error";
+        allowed: "allowed";
+        denied: "denied";
+    }>>;
+    targetType: z.ZodOptional<z.ZodEnum<{
+        run: "run";
+        job: "job";
+        step: "step";
+        payload: "payload";
+        event_log: "event_log";
+        event_log_payload: "event_log_payload";
+        secret_scope: "secret_scope";
+        environment: "environment";
+        registration: "registration";
+        backend: "backend";
+        diagnostics: "diagnostics";
+        scaler: "scaler";
+        held_run: "held_run";
+        access_log: "access_log";
+        event_dlq: "event_dlq";
+    }>>;
+    targetId: z.ZodOptional<z.ZodString>;
+    fromTimestamp: z.ZodOptional<z.ZodString>;
+    toTimestamp: z.ZodOptional<z.ZodString>;
+    q: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodNumber>;
+    cursor: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "type">;
+/** All messages that flow from Orchestrator to Platform.
+ *
+ * Note: Dashboard response messages (dashboard.run.detail.response,
+ * dashboard.step.logs.response, dashboard.orch.logs.response) are intentionally
+ * excluded here. They are parsed separately via dashboardOrchToPlatformSchema so
+ * the Platform WS handler can route them to the DashboardProxy for request
+ * correlation. */
+export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"webhook.ack">;
+    messageId: z.ZodString;
+    deliveryId: z.ZodString;
+    result: z.ZodOptional<z.ZodEnum<{
+        accepted: "accepted";
+        rejected_signature: "rejected_signature";
+        rejected_unknown_source: "rejected_unknown_source";
+        rejected_misconfigured: "rejected_misconfigured";
+    }>>;
+    reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"execution.event">;
+    messageId: z.ZodString;
+    runId: z.ZodString;
+    event: z.ZodEnum<{
+        started: "started";
+        job_dispatched: "job_dispatched";
+        job_completed: "job_completed";
+        finished: "finished";
+    }>;
+    data: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    timestamp: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"log.chunk">;
+    messageId: z.ZodString;
+    runId: z.ZodString;
+    jobId: z.ZodString;
+    stepIndex: z.ZodNumber;
+    lines: z.ZodArray<z.ZodString>;
+    timestamp: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"execution.status">;
+    messageId: z.ZodString;
+    runId: z.ZodString;
+    workflowName: z.ZodString;
+    status: z.ZodEnum<{
+        success: "success";
+        pending: "pending";
+        running: "running";
+        failed: "failed";
+        cancelled: "cancelled";
+        cancelling: "cancelling";
+    }>;
+    repoIdentifier: z.ZodOptional<z.ZodString>;
+    sha: z.ZodOptional<z.ZodString>;
+    ref: z.ZodOptional<z.ZodString>;
+    triggerEvent: z.ZodOptional<z.ZodString>;
+    commitMessage: z.ZodOptional<z.ZodString>;
+    jobCount: z.ZodOptional<z.ZodNumber>;
+    startedAt: z.ZodNumber;
+    completedAt: z.ZodOptional<z.ZodNumber>;
+    durationMs: z.ZodOptional<z.ZodNumber>;
+    timestamp: z.ZodNumber;
+    parentRunId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    originalRunId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    triggeredBy: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    failureReason: z.ZodOptional<z.ZodString>;
+    logBytes: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"step.status.forward">;
+    messageId: z.ZodString;
+    runId: z.ZodString;
+    jobId: z.ZodString;
+    jobName: z.ZodString;
+    stepIndex: z.ZodNumber;
+    stepName: z.ZodString;
+    state: z.ZodEnum<{
+        success: "success";
+        running: "running";
+        failed: "failed";
+        skipped: "skipped";
+    }>;
+    timestamp: z.ZodNumber;
+    data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    secretsAccessed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"job.status.forward">;
+    messageId: z.ZodString;
+    runId: z.ZodString;
+    jobId: z.ZodString;
+    jobName: z.ZodString;
+    status: z.ZodEnum<{
+        success: "success";
+        pending: "pending";
+        running: "running";
+        failed: "failed";
+        cancelled: "cancelled";
+        cancelling: "cancelling";
+        queued: "queued";
+        recovering: "recovering";
+        skipped: "skipped";
+        timed_out_stale: "timed_out_stale";
+        drift_dropped: "drift_dropped";
+    }>;
+    matrixValues: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    startedAt: z.ZodOptional<z.ZodNumber>;
+    completedAt: z.ZodOptional<z.ZodNumber>;
+    durationMs: z.ZodOptional<z.ZodNumber>;
+    errorMessage: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    agentId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    orchestratorId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    runsOnLabels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    logBytes: z.ZodOptional<z.ZodNumber>;
+    timestamp: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"state.replay">;
+    messageId: z.ZodString;
+    runs: z.ZodArray<z.ZodObject<{
+        runId: z.ZodString;
+        workflowName: z.ZodString;
+        status: z.ZodEnum<{
+            success: "success";
+            pending: "pending";
+            running: "running";
+            failed: "failed";
+            cancelled: "cancelled";
+            cancelling: "cancelling";
+        }>;
+        routingKey: z.ZodOptional<z.ZodString>;
+        repoIdentifier: z.ZodOptional<z.ZodString>;
+        sha: z.ZodOptional<z.ZodString>;
+        ref: z.ZodOptional<z.ZodString>;
+        triggerEvent: z.ZodOptional<z.ZodString>;
+        commitMessage: z.ZodOptional<z.ZodString>;
+        jobCount: z.ZodNumber;
+        startedAt: z.ZodNumber;
+        completedAt: z.ZodOptional<z.ZodNumber>;
+        durationMs: z.ZodOptional<z.ZodNumber>;
+        parentRunId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        originalRunId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        triggeredBy: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        failureReason: z.ZodOptional<z.ZodString>;
+        jobs: z.ZodArray<z.ZodObject<{
+            jobId: z.ZodString;
+            jobName: z.ZodString;
+            status: z.ZodString;
+            startedAt: z.ZodOptional<z.ZodNumber>;
+            completedAt: z.ZodOptional<z.ZodNumber>;
+            durationMs: z.ZodOptional<z.ZodNumber>;
+            errorMessage: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            agentId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            runsOnLabels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    timestamp: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"source.register">;
+    messageId: z.ZodString;
+    sources: z.ZodArray<z.ZodObject<{
+        provider: z.ZodEnum<{
+            github: "github";
+            gitlab: "gitlab";
+            bitbucket: "bitbucket";
+            generic: "generic";
+        }>;
+        routingKey: z.ZodString;
+        name: z.ZodString;
+        subtype: z.ZodEnum<{
+            github_app: "github_app";
+            generic_webhook: "generic_webhook";
+            universal_git: "universal_git";
+            internal: "internal";
+        }>;
+    }, z.core.$strip>>;
+    instanceId: z.ZodOptional<z.ZodString>;
+    address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    version: z.ZodOptional<z.ZodString>;
+    mode: z.ZodOptional<z.ZodEnum<{
+        platform: "platform";
+        hybrid: "hybrid";
+        independent: "independent";
+    }>>;
+    scalerBackends: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    s3LogAccess: z.ZodOptional<z.ZodBoolean>;
+    queueTimeoutMs: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"source.deregister">;
+    messageId: z.ZodString;
+    routingKeys: z.ZodArray<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"cache.stats">;
+    cacheType: z.ZodEnum<{
+        source: "source";
+        dep: "dep";
+    }>;
+    hit: z.ZodBoolean;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"auth.request">;
+    token: z.ZodString;
+    protocolVersion: z.ZodNumber;
+    capabilities: z.ZodOptional<z.ZodObject<{
+        orchRole: z.ZodOptional<z.ZodEnum<{
+            coordinator: "coordinator";
+            worker: "worker";
+        }>>;
+    }, z.core.$loose>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"heartbeat">;
+    timestamp: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"run.event">;
+    runId: z.ZodString;
+    eventType: z.ZodString;
+    timestampMs: z.ZodNumber;
+    sourceService: z.ZodEnum<{
+        platform: "platform";
+        orchestrator: "orchestrator";
+        agent: "agent";
+    }>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    traceId: z.ZodOptional<z.ZodString>;
+    spanId: z.ZodOptional<z.ZodString>;
+    parentSpanId: z.ZodOptional<z.ZodString>;
+    durationMs: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    jobId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    stepIndex: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"job.context">;
+    runId: z.ZodString;
+    jobId: z.ZodString;
+    context: z.ZodObject<{
+        envVars: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            value: z.ZodString;
+            category: z.ZodEnum<{
+                user: "user";
+                system: "system";
+                inherited: "inherited";
+                secret: "secret";
+            }>;
+        }, z.core.$strip>>>;
+        runtime: z.ZodOptional<z.ZodObject<{
+            nodeVersion: z.ZodOptional<z.ZodString>;
+            os: z.ZodOptional<z.ZodString>;
+            arch: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        sandboxType: z.ZodOptional<z.ZodString>;
+        labels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        workingDirectory: z.ZodOptional<z.ZodString>;
+        gitRef: z.ZodOptional<z.ZodString>;
+        lockFileVersion: z.ZodOptional<z.ZodString>;
+        sdkVersion: z.ZodOptional<z.ZodString>;
+        depCacheStatus: z.ZodOptional<z.ZodString>;
+        networkIsolation: z.ZodOptional<z.ZodString>;
+        scalerContext: z.ZodOptional<z.ZodObject<{
+            backendType: z.ZodString;
+            scalerName: z.ZodString;
+        }, z.core.$loose>>;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"orch.metrics">;
+    messageId: z.ZodString;
+    metrics: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        type: z.ZodEnum<{
+            counter: "counter";
+            histogram: "histogram";
+            gauge: "gauge";
+            upDownCounter: "upDownCounter";
+        }>;
+        value: z.ZodOptional<z.ZodNumber>;
+        labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        buckets: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            le: z.ZodNumber;
+            count: z.ZodNumber;
+        }, z.core.$strip>>>;
+        count: z.ZodOptional<z.ZodNumber>;
+        sum: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+    timestamp: z.ZodNumber;
+}, z.core.$strip>], "type">;
+export type WebhookRelay = z.infer<typeof webhookRelaySchema>;
+export type WebhookAck = z.infer<typeof webhookAckSchema>;
+export type ExecutionEvent = z.infer<typeof executionEventSchema>;
+export type LogChunk = z.infer<typeof logChunkSchema>;
+export type PeerDiscover = z.infer<typeof peerDiscoverSchema>;
+export type PeerUpdate = z.infer<typeof peerUpdateSchema>;
+export type PlatformToOrchestratorMessage = z.infer<typeof platformToOrchestratorMessageSchema>;
+export type OrchestratorToPlatformMessage = z.infer<typeof orchestratorToPlatformMessageSchema>;
+//# sourceMappingURL=platform-orchestrator.d.ts.map