@kici-dev/engine 0.1.15 → 0.1.16

package/dist/approval/types.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Shared approval requirement + clause types.
+ *
+ * One normalized `ApprovalRequirement` is produced by both approval triggers —
+ * a mandatory environment policy and an explicit SDK `requireApproval` — and is
+ * consumed identically by the orchestrator gate, the resolver, the held-run
+ * store, and the agent step round-trip. Pure Zod (no node built-ins), so this
+ * module is safe in the browser-facing engine barrel.
+ */
+import { z } from 'zod';
+/**
+ * A single approver clause. `{ team }` is satisfied by any member of the named
+ * team; `{ user }` by that specific user. A flat AND list of clauses must all
+ * be satisfied to release a held element.
+ */
+export declare const approverClauseSchema: z.ZodUnion<readonly [z.ZodObject<{
+    team: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    user: z.ZodString;
+}, z.core.$strict>]>;
+export type ApproverClause = z.infer<typeof approverClauseSchema>;
+/** Granularity of a held element. */
+export declare const HoldScope: z.ZodEnum<{
+    job: "job";
+    step: "step";
+    workflow: "workflow";
+}>;
+export type HoldScope = z.infer<typeof HoldScope>;
+/** What triggered the hold: an environment policy (mandatory) or SDK code (explicit). */
+export declare const TriggerSource: z.ZodEnum<{
+    environment: "environment";
+    explicit: "explicit";
+}>;
+export type TriggerSource = z.infer<typeof TriggerSource>;
+/**
+ * The normalized requirement attached to a held element. `clauses` is a flat
+ * AND list; an empty list means "any approval-capable org member". `expiresAt`
+ * is an ISO timestamp; on expiry the element is rejected.
+ */
+export declare const approvalRequirementSchema: z.ZodObject<{
+    clauses: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        team: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        user: z.ZodString;
+    }, z.core.$strict>]>>;
+    expiresAt: z.ZodString;
+    reason: z.ZodString;
+}, z.core.$strip>;
+export type ApprovalRequirement = z.infer<typeof approvalRequirementSchema>;
+/** An individual approve/reject decision recorded against a held element. */
+export declare const ApprovalDecision: z.ZodEnum<{
+    approve: "approve";
+    reject: "reject";
+}>;
+export type ApprovalDecision = z.infer<typeof ApprovalDecision>;
+//# sourceMappingURL=types.d.ts.map

package/dist/approval/types.js

@@ -0,0 +1,42 @@
+import "../chunk-gOLHoazu.js";
+import { z } from "zod";
+//#region src/approval/types.ts
+/**
+* Shared approval requirement + clause types.
+*
+* One normalized `ApprovalRequirement` is produced by both approval triggers —
+* a mandatory environment policy and an explicit SDK `requireApproval` — and is
+* consumed identically by the orchestrator gate, the resolver, the held-run
+* store, and the agent step round-trip. Pure Zod (no node built-ins), so this
+* module is safe in the browser-facing engine barrel.
+*/
+/**
+* A single approver clause. `{ team }` is satisfied by any member of the named
+* team; `{ user }` by that specific user. A flat AND list of clauses must all
+* be satisfied to release a held element.
+*/
+const approverClauseSchema = z.union([z.object({ team: z.string().min(1) }).strict(), z.object({ user: z.string().min(1) }).strict()]);
+/** Granularity of a held element. */
+const HoldScope = z.enum([
+	"workflow",
+	"job",
+	"step"
+]);
+/** What triggered the hold: an environment policy (mandatory) or SDK code (explicit). */
+const TriggerSource = z.enum(["environment", "explicit"]);
+/**
+* The normalized requirement attached to a held element. `clauses` is a flat
+* AND list; an empty list means "any approval-capable org member". `expiresAt`
+* is an ISO timestamp; on expiry the element is rejected.
+*/
+const approvalRequirementSchema = z.object({
+	clauses: z.array(approverClauseSchema),
+	expiresAt: z.string(),
+	reason: z.string()
+});
+/** An individual approve/reject decision recorded against a held element. */
+const ApprovalDecision = z.enum(["approve", "reject"]);
+//#endregion
+export { ApprovalDecision, HoldScope, TriggerSource, approvalRequirementSchema, approverClauseSchema };
+
+//# sourceMappingURL=types.js.map

package/dist/audit/access-log-policy.js

@@ -136,6 +136,8 @@ const POLICY_BY_ACTION = {
 	"secret_scope.delete": { kind: "always" },
 	"held_run.approve": { kind: "always" },
 	"held_run.reject": { kind: "always" },
+	"held_run.request": { kind: "always" },
+	"held_run.expire": { kind: "always" },
 	"registration.disable": { kind: "always" },
 	"registration.delete": { kind: "always" },
 	"backend.sync": { kind: "always" },

package/dist/audit/retention-policy.js

@@ -52,6 +52,8 @@ const ACCESS_LOG_WARM_DAYS = {
 	"env_binding.set": 180,
 	"held_run.approve": 180,
 	"held_run.reject": 180,
+	"held_run.request": 180,
+	"held_run.expire": 180,
 	"registration.disable": 180,
 	"registration.delete": 180,
 	"backend.sync": 180,
@@ -286,6 +288,8 @@ const ACCESS_LOG_COLD_DAYS = {
 	"env_binding.set": 730,
 	"held_run.approve": 730,
 	"held_run.reject": 730,
+	"held_run.request": 730,
+	"held_run.expire": 730,
 	"registration.disable": 730,
 	"registration.delete": 730,
 	"backend.sync": 730,

package/dist/environment/types.d.ts

@@ -4,6 +4,7 @@
  * Environments are org-level entities that group secrets, variables,
  * and protection rules for deployment targets (dev, staging, production).
  */
+import type { ApproverClause } from '../approval/types.js';
 /** Environment entity — org-level deployment target with protection rules. */
 export interface Environment {
     id: string;
@@ -94,5 +95,12 @@ export interface ProtectionGateResult {
     reason?: string;
     holdUntil?: string;
     holdType?: 'reviewer' | 'timer' | 'concurrency' | 'security';
+    /**
+     * Approver clauses for a reviewer hold, mapped from the environment's
+     * `requiredReviewers`. Each reviewer string maps to a `{ user }` clause
+     * (team-named reviewers are a documented follow-up). Empty/undefined means
+     * "any approval-capable member".
+     */
+    clauses?: ApproverClause[];
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/index.d.ts

@@ -18,6 +18,7 @@ export * from './protocol/messages/execution-status.js';
 export * from './protocol/messages/scaler-event.js';
 export * from './protocol/messages/event-log.js';
 export * from './protocol/messages/access-log.js';
+export * from './approval/types.js';
 export * from './audit/access-log-policy.js';
 export * from './audit/retention-policy.js';
 export * from './audit/activity.js';

package/dist/index.js

@@ -10,6 +10,7 @@ import { AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType
 import { browserJobContextSchema, browserRunEventSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, jobContextMessageSchema, runEventMessageSchema } from "./protocol/messages/run-events.js";
 import { EventLogSource, EventLogStatus, PayloadOmittedReason } from "./protocol/messages/event-log.js";
 import { ScalerBackendType } from "./scaler/scaler-backend-type.js";
+import { ApprovalDecision, HoldScope, TriggerSource, approvalRequirementSchema, approverClauseSchema } from "./approval/types.js";
 import { EnvDeleteErrorCode, EventLogPayloadStreamError, HeldRunQueueType, HeldRunStatus, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runRerunRequestSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
 import { WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, cacheStatsSchema, executionEventSchema, logChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema } from "./protocol/messages/platform-orchestrator.js";
 import { ScalerEventType } from "./protocol/messages/scaler-event.js";
@@ -20,8 +21,8 @@ import { logPullOrchToPlatformSchema, logPullPlatformToOrchSchema } from "./prot
 import { EVENT_LOG_PAYLOAD_CHUNK_BYTES } from "./protocol/event-log-payload.js";
 import { browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, platformToBrowserMessageSchema } from "./protocol/messages/browser.js";
 import { joinRequestSchema, joinResponseSchema } from "./protocol/messages/join.js";
-import { jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema } from "./protocol/messages/peer.js";
-import { CacheRefScope, JobRejectReason, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, registerAckSchema } from "./protocol/messages/orchestrator-agent.js";
+import { fleetSelectionSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema } from "./protocol/messages/peer.js";
+import { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, registerAckSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema } from "./protocol/messages/orchestrator-agent.js";
 import { testCancelResponseSchema, testCancelSchema, testEventSchema, testTriggerResponseSchema, testTriggerSchema } from "./protocol/messages/test-run.js";
 import { observeCompleteSchema, observeLogSchema, observeStatusSchema, observeStepSchema, observeSubscribeSchema } from "./protocol/messages/observe.js";
 import { NeedsEntrySchema, NeedsGroupEntrySchema, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob } from "./trigger/types.js";
@@ -44,4 +45,4 @@ import { parseMemoryString, resourceRequestNestedSchema, resourceSpecSchema, val
 import { RegisterableTriggerType } from "./registration/registerable-trigger-type.js";
 import { createWorkflowBundleConfig } from "./bundler/rolldown-config.js";
 import "./bundler/index.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckRunConclusion, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, InitFailureCategory, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LockFileParseError, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, ORCH_CAPABILITIES, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TimeoutReason, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, flattenActor, fnv1a32, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostLabel, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, observeCompleteSchema, observeLogSchema, observeStatusSchema, observeStepSchema, observeSubscribeSchema, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseMemoryString, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testCancelResponseSchema, testCancelSchema, testEventSchema, testTriggerResponseSchema, testTriggerSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, ApprovalDecision, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckRunConclusion, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, InitFailureCategory, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LockFileParseError, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, ORCH_CAPABILITIES, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, StepApprovalOutcome, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TimeoutReason, TriggerSource, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, approvalRequirementSchema, approverClauseSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, fleetSelectionSchema, fnv1a32, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostLabel, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, observeCompleteSchema, observeLogSchema, observeStatusSchema, observeStepSchema, observeSubscribeSchema, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseMemoryString, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testCancelResponseSchema, testCancelSchema, testEventSchema, testTriggerResponseSchema, testTriggerSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };

package/dist/protocol/messages/access-log.d.ts

@@ -94,6 +94,8 @@ export declare const AccessLogAction: z.ZodEnum<{
     "held_run.list.read": "held_run.list.read";
     "held_run.approve": "held_run.approve";
     "held_run.reject": "held_run.reject";
+    "held_run.request": "held_run.request";
+    "held_run.expire": "held_run.expire";
     "registration.list.read": "registration.list.read";
     "diagnostics.read": "diagnostics.read";
     "scaler.capacity.read": "scaler.capacity.read";
@@ -178,6 +180,8 @@ export declare const accessLogItemSchema: z.ZodObject<{
         "held_run.list.read": "held_run.list.read";
         "held_run.approve": "held_run.approve";
         "held_run.reject": "held_run.reject";
+        "held_run.request": "held_run.request";
+        "held_run.expire": "held_run.expire";
         "registration.list.read": "registration.list.read";
         "diagnostics.read": "diagnostics.read";
         "scaler.capacity.read": "scaler.capacity.read";
@@ -284,6 +288,8 @@ export declare const accessLogFilterSchema: z.ZodObject<{
         "held_run.list.read": "held_run.list.read";
         "held_run.approve": "held_run.approve";
         "held_run.reject": "held_run.reject";
+        "held_run.request": "held_run.request";
+        "held_run.expire": "held_run.expire";
         "registration.list.read": "registration.list.read";
         "diagnostics.read": "diagnostics.read";
         "scaler.capacity.read": "scaler.capacity.read";
@@ -412,6 +418,8 @@ export declare const dashboardAccessLogListRequestSchema: z.ZodObject<{
         "held_run.list.read": "held_run.list.read";
         "held_run.approve": "held_run.approve";
         "held_run.reject": "held_run.reject";
+        "held_run.request": "held_run.request";
+        "held_run.expire": "held_run.expire";
         "registration.list.read": "registration.list.read";
         "diagnostics.read": "diagnostics.read";
         "scaler.capacity.read": "scaler.capacity.read";
@@ -528,6 +536,8 @@ export declare const dashboardAccessLogListResponseSchema: z.ZodObject<{
             "held_run.list.read": "held_run.list.read";
             "held_run.approve": "held_run.approve";
             "held_run.reject": "held_run.reject";
+            "held_run.request": "held_run.request";
+            "held_run.expire": "held_run.expire";
             "registration.list.read": "registration.list.read";
             "diagnostics.read": "diagnostics.read";
             "scaler.capacity.read": "scaler.capacity.read";

package/dist/protocol/messages/access-log.js

@@ -89,6 +89,8 @@ const AccessLogAction = z.enum([
 	"held_run.list.read",
 	"held_run.approve",
 	"held_run.reject",
+	"held_run.request",
+	"held_run.expire",
 	"registration.list.read",
 	"registration.disable",
 	"registration.delete",

package/dist/protocol/messages/dashboard.d.ts

@@ -1671,6 +1671,34 @@ declare const heldRunsListResponseSchema: z.ZodObject<{
         expiresAt: z.ZodNullable<z.ZodCoercedString<unknown>>;
         contributorUsername: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         trustTier: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        jobId: z.ZodOptional<z.ZodString>;
+        holdScope: z.ZodOptional<z.ZodEnum<{
+            job: "job";
+            step: "step";
+            workflow: "workflow";
+        }>>;
+        stepIndex: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        requirement: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            clauses: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                team: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                user: z.ZodString;
+            }, z.core.$strict>]>>;
+            reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>>>;
+        decisions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            approverUserId: z.ZodString;
+            decision: z.ZodEnum<{
+                approve: "approve";
+                reject: "reject";
+            }>;
+            clausesSatisfied: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                team: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                user: z.ZodString;
+            }, z.core.$strict>]>>>>;
+            createdAt: z.ZodCoercedString<unknown>;
+        }, z.core.$strip>>>;
     }, z.core.$strip>>>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -3807,6 +3835,8 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
         "held_run.list.read": "held_run.list.read";
         "held_run.approve": "held_run.approve";
         "held_run.reject": "held_run.reject";
+        "held_run.request": "held_run.request";
+        "held_run.expire": "held_run.expire";
         "registration.list.read": "registration.list.read";
         "diagnostics.read": "diagnostics.read";
         "scaler.capacity.read": "scaler.capacity.read";
@@ -4216,6 +4246,34 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
         expiresAt: z.ZodNullable<z.ZodCoercedString<unknown>>;
         contributorUsername: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         trustTier: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        jobId: z.ZodOptional<z.ZodString>;
+        holdScope: z.ZodOptional<z.ZodEnum<{
+            job: "job";
+            step: "step";
+            workflow: "workflow";
+        }>>;
+        stepIndex: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        requirement: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            clauses: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                team: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                user: z.ZodString;
+            }, z.core.$strict>]>>;
+            reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>>>;
+        decisions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            approverUserId: z.ZodString;
+            decision: z.ZodEnum<{
+                approve: "approve";
+                reject: "reject";
+            }>;
+            clausesSatisfied: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                team: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                user: z.ZodString;
+            }, z.core.$strict>]>>>>;
+            createdAt: z.ZodCoercedString<unknown>;
+        }, z.core.$strip>>>;
     }, z.core.$strip>>>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
@@ -4733,6 +4791,8 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             "held_run.list.read": "held_run.list.read";
             "held_run.approve": "held_run.approve";
             "held_run.reject": "held_run.reject";
+            "held_run.request": "held_run.request";
+            "held_run.expire": "held_run.expire";
             "registration.list.read": "registration.list.read";
             "diagnostics.read": "diagnostics.read";
             "scaler.capacity.read": "scaler.capacity.read";

package/dist/protocol/messages/dashboard.js

@@ -6,6 +6,7 @@ import { dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSche
 import { dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema } from "./run-events.js";
 import { EventLogSource, EventLogStatus, PayloadOmittedReason } from "./event-log.js";
 import { ScalerBackendType } from "../../scaler/scaler-backend-type.js";
+import { ApprovalDecision, HoldScope, approverClauseSchema } from "../../approval/types.js";
 import { globalWorkflowsGetRequestSchema, globalWorkflowsGetResponseSchema, globalWorkflowsUpdateRequestSchema, globalWorkflowsUpdateResponseSchema } from "./dashboard-global-workflows.js";
 import { z } from "zod";
 //#region src/protocol/messages/dashboard.ts
@@ -906,7 +907,20 @@ const heldRunsListResponseSchema = z.object({
 		reason: z.string().nullable(),
 		expiresAt: z.coerce.string().nullable(),
 		contributorUsername: z.string().nullable().optional(),
-		trustTier: z.string().nullable().optional()
+		trustTier: z.string().nullable().optional(),
+		jobId: z.string().optional(),
+		holdScope: HoldScope.optional(),
+		stepIndex: z.number().nullable().optional(),
+		requirement: z.object({
+			clauses: z.array(approverClauseSchema),
+			reason: z.string().nullable().optional()
+		}).nullable().optional(),
+		decisions: z.array(z.object({
+			approverUserId: z.string(),
+			decision: ApprovalDecision,
+			clausesSatisfied: z.array(approverClauseSchema).nullable().optional(),
+			createdAt: z.coerce.string()
+		})).optional()
 	})).optional(),
 	error: z.string().optional()
 });

package/dist/protocol/messages/orchestrator-agent.d.ts

@@ -424,6 +424,81 @@ export declare const agentApiResponseSchema: z.ZodObject<{
     result: z.ZodOptional<z.ZodUnknown>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/** Orchestrator asks an agent for its log/diagnostic mini-bundle. */
+export declare const fleetLogsRequestSchema: z.ZodObject<{
+    type: z.ZodLiteral<"fleet.logs.request">;
+    requestId: z.ZodString;
+    logWindowHours: z.ZodNumber;
+    maxBytes: z.ZodNumber;
+}, z.core.$strip>;
+/** One base64 frame of an agent's mini-bundle ZIP. */
+export declare const fleetBundleChunkSchema: z.ZodObject<{
+    type: z.ZodLiteral<"fleet.bundle.chunk">;
+    requestId: z.ZodString;
+    seq: z.ZodNumber;
+    isLast: z.ZodBoolean;
+    dataB64: z.ZodString;
+}, z.core.$strip>;
+/** Agent failed to build/stream its mini-bundle. */
+export declare const fleetBundleErrorSchema: z.ZodObject<{
+    type: z.ZodLiteral<"fleet.bundle.error">;
+    requestId: z.ZodString;
+    message: z.ZodString;
+}, z.core.$strip>;
+/** Outcome of a step-level approval hold, sent back to the waiting agent. */
+export declare const StepApprovalOutcome: z.ZodEnum<{
+    rejected: "rejected";
+    approved: "approved";
+    expired: "expired";
+}>;
+export type StepApprovalOutcome = z.infer<typeof StepApprovalOutcome>;
+/**
+ * Agent -> Orchestrator: a step carrying `requireApproval` is about to run and
+ * the agent is blocking its step loop until the orchestrator resolves the
+ * approval. The orchestrator creates a step-scoped `held_runs` row from the
+ * normalized requirement and replies with `step.approval-resolved` once the
+ * hold is approved, rejected, or expired. The agent keeps heartbeats flowing
+ * during the wait so it is not reaped as stale.
+ *
+ * NOT fast-pathed — the `log.chunk` / `heartbeat` manual-validator invariant is
+ * untouched by this message.
+ */
+export declare const stepApprovalRequestSchema: z.ZodObject<{
+    type: z.ZodLiteral<"step.approval-request">;
+    messageId: z.ZodString;
+    runId: z.ZodString;
+    jobId: z.ZodString;
+    stepIndex: z.ZodNumber;
+    stepName: z.ZodString;
+    clauses: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        team: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        user: z.ZodString;
+    }, z.core.$strict>]>>;
+    reason: z.ZodString;
+    timeoutSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type StepApprovalRequest = z.infer<typeof stepApprovalRequestSchema>;
+/**
+ * Orchestrator -> Agent: resolution of a step-level approval hold. `requestId`
+ * correlates to the originating `step.approval-request.messageId`. On
+ * `approved` the agent runs the step with its live workspace intact; on
+ * `rejected`/`expired` it fails the job with a clear reason.
+ */
+export declare const stepApprovalResolvedSchema: z.ZodObject<{
+    type: z.ZodLiteral<"step.approval-resolved">;
+    requestId: z.ZodString;
+    runId: z.ZodString;
+    jobId: z.ZodString;
+    stepIndex: z.ZodNumber;
+    outcome: z.ZodEnum<{
+        rejected: "rejected";
+        approved: "approved";
+        expired: "expired";
+    }>;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type StepApprovalResolved = z.infer<typeof stepApprovalResolvedSchema>;
 /** All messages that flow from Orchestrator to Agent. */
 export declare const orchestratorToAgentMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     type: z.ZodLiteral<"job.dispatch">;
@@ -542,6 +617,23 @@ export declare const orchestratorToAgentMessageSchema: z.ZodDiscriminatedUnion<[
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"auth.failure">;
     reason: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"fleet.logs.request">;
+    requestId: z.ZodString;
+    logWindowHours: z.ZodNumber;
+    maxBytes: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"step.approval-resolved">;
+    requestId: z.ZodString;
+    runId: z.ZodString;
+    jobId: z.ZodString;
+    stepIndex: z.ZodNumber;
+    outcome: z.ZodEnum<{
+        rejected: "rejected";
+        approved: "approved";
+        expired: "expired";
+    }>;
+    reason: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>], "type">;
 /** All messages that flow from Agent to Orchestrator. */
 export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -752,6 +844,30 @@ export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[
     type: z.ZodLiteral<"auth.request">;
     token: z.ZodString;
     protocolVersion: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"fleet.bundle.chunk">;
+    requestId: z.ZodString;
+    seq: z.ZodNumber;
+    isLast: z.ZodBoolean;
+    dataB64: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"fleet.bundle.error">;
+    requestId: z.ZodString;
+    message: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"step.approval-request">;
+    messageId: z.ZodString;
+    runId: z.ZodString;
+    jobId: z.ZodString;
+    stepIndex: z.ZodNumber;
+    stepName: z.ZodString;
+    clauses: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        team: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        user: z.ZodString;
+    }, z.core.$strict>]>>;
+    reason: z.ZodString;
+    timeoutSeconds: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>], "type">;
 export type JobDispatch = z.infer<typeof jobDispatchSchema>;
 export type JobCancel = z.infer<typeof jobCancelSchema>;
@@ -766,5 +882,9 @@ export type CacheUserRestoreResponse = z.infer<typeof cacheUserRestoreResponseSc
 export type CacheUserSaveRequest = z.infer<typeof cacheUserSaveRequestSchema>;
 export type CacheUserSaveResponse = z.infer<typeof cacheUserSaveResponseSchema>;
 export type CacheUserSaveComplete = z.infer<typeof cacheUserSaveCompleteSchema>;
+export type FleetLogsRequest = z.infer<typeof fleetLogsRequestSchema>;
+export type FleetBundleChunk = z.infer<typeof fleetBundleChunkSchema>;
+export type FleetBundleError = z.infer<typeof fleetBundleErrorSchema>;
+export type OrchestratorToAgentMessage = z.infer<typeof orchestratorToAgentMessageSchema>;
 export type AgentToOrchestratorMessage = z.infer<typeof agentToOrchestratorMessageSchema>;
 //# sourceMappingURL=orchestrator-agent.d.ts.map