@kici-dev/engine 0.1.15 → 0.1.17

package/dist/protocol/messages/dashboard.d.ts

@@ -84,6 +84,13 @@ export declare const dashboardJobDetailSchema: z.ZodObject<{
         message: z.ZodString;
         jobName: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
+    needs: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
+        upstreamName: z.ZodString;
+        ifFailed: z.ZodEnum<{
+            run: "run";
+            skip: "skip";
+        }>;
+    }, z.core.$strip>>>>;
     steps: z.ZodArray<z.ZodObject<{
         stepIndex: z.ZodNumber;
         stepName: z.ZodString;
@@ -133,6 +140,13 @@ export declare const dashboardRunDetailResponseSchema: z.ZodObject<{
             message: z.ZodString;
             jobName: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
+        needs: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
+            upstreamName: z.ZodString;
+            ifFailed: z.ZodEnum<{
+                run: "run";
+                skip: "skip";
+            }>;
+        }, z.core.$strip>>>>;
         steps: z.ZodArray<z.ZodObject<{
             stepIndex: z.ZodNumber;
             stepName: z.ZodString;
@@ -186,6 +200,95 @@ export declare const dashboardStepLogsResponseSchema: z.ZodObject<{
     totalLines: z.ZodNumber;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/** Request the build-provenance attestations for a run. */
+export declare const dashboardAttestationsListRequestSchema: z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.attestations.list">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodString;
+}, z.core.$strip>;
+export type DashboardAttestationsListRequest = z.infer<typeof dashboardAttestationsListRequestSchema>;
+/**
+ * Single attestation in the list response, with its bundle inlined from object
+ * storage so the dashboard verifies it without a second fetch. The bundle is a
+ * KiCI Mode-A bundle (`@kici-dev/engine/provenance/bundle`).
+ */
+export declare const attestationListItemSchema: z.ZodObject<{
+    id: z.ZodString;
+    jobId: z.ZodString;
+    jobName: z.ZodNullable<z.ZodString>;
+    subjectName: z.ZodString;
+    subjectDigest: z.ZodString;
+    mode: z.ZodString;
+    mediaType: z.ZodString;
+    createdAt: z.ZodString;
+    bundle: z.ZodObject<{
+        mediaType: z.ZodLiteral<"application/vnd.kici.provenance.bundle+json;version=0.1">;
+        dsseEnvelope: z.ZodObject<{
+            payloadType: z.ZodString;
+            payload: z.ZodString;
+            signatures: z.ZodArray<z.ZodObject<{
+                keyid: z.ZodString;
+                sig: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+        verificationMaterial: z.ZodObject<{
+            publicKey: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+            identityToken: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type AttestationListItem = z.infer<typeof attestationListItemSchema>;
+/** Response with the run's attestations (correlates to dashboard.attestations.list). */
+export declare const dashboardAttestationsListResponseSchema: z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.attestations.list.response">;
+    requestId: z.ZodString;
+    attestations: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        jobId: z.ZodString;
+        jobName: z.ZodNullable<z.ZodString>;
+        subjectName: z.ZodString;
+        subjectDigest: z.ZodString;
+        mode: z.ZodString;
+        mediaType: z.ZodString;
+        createdAt: z.ZodString;
+        bundle: z.ZodObject<{
+            mediaType: z.ZodLiteral<"application/vnd.kici.provenance.bundle+json;version=0.1">;
+            dsseEnvelope: z.ZodObject<{
+                payloadType: z.ZodString;
+                payload: z.ZodString;
+                signatures: z.ZodArray<z.ZodObject<{
+                    keyid: z.ZodString;
+                    sig: z.ZodString;
+                }, z.core.$strip>>;
+            }, z.core.$strip>;
+            verificationMaterial: z.ZodObject<{
+                publicKey: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+                identityToken: z.ZodString;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+    error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type DashboardAttestationsListResponse = z.infer<typeof dashboardAttestationsListResponseSchema>;
 /**
  * Run-summary projection from the orchestrator's execution_runs table.
  *
@@ -341,7 +444,7 @@ export declare const dashboardSourceSummarySchema: z.ZodObject<{
         github_app: "github_app";
         generic_webhook: "generic_webhook";
         universal_git: "universal_git";
-        internal: "internal";
+        local: "local";
     }>;
     enabled: z.ZodBoolean;
     createdAt: z.ZodString;
@@ -386,7 +489,7 @@ export declare const dashboardSourcesListResponseSchema: z.ZodObject<{
             github_app: "github_app";
             generic_webhook: "generic_webhook";
             universal_git: "universal_git";
-            internal: "internal";
+            local: "local";
         }>;
         enabled: z.ZodBoolean;
         createdAt: z.ZodString;
@@ -976,6 +1079,8 @@ export declare const envListRequestSchema: z.ZodObject<{
         type: z.ZodLiteral<"system">;
         component: z.ZodString;
     }, z.core.$strip>], "type">;
+    includeSecrets: z.ZodOptional<z.ZodBoolean>;
+    orgId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 declare const envListResponseSchema: z.ZodObject<{
     type: z.ZodLiteral<"dashboard.environments.list.response">;
@@ -984,14 +1089,15 @@ declare const envListResponseSchema: z.ZodObject<{
         id: z.ZodString;
         name: z.ZodString;
         type: z.ZodEnum<{
-            fixed: "fixed";
             glob: "glob";
+            fixed: "fixed";
         }>;
         globPattern: z.ZodNullable<z.ZodString>;
         enabled: z.ZodBoolean;
         allowLocalExecution: z.ZodBoolean;
         createdAt: z.ZodCoercedString<unknown>;
         updatedAt: z.ZodCoercedString<unknown>;
+        secretKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -1027,8 +1133,8 @@ declare const envGetResponseSchema: z.ZodObject<{
         id: z.ZodString;
         name: z.ZodString;
         type: z.ZodEnum<{
-            fixed: "fixed";
             glob: "glob";
+            fixed: "fixed";
         }>;
         globPattern: z.ZodNullable<z.ZodString>;
         branchRestrictions: z.ZodNullable<z.ZodArray<z.ZodString>>;
@@ -1072,8 +1178,8 @@ export declare const envCreateRequestSchema: z.ZodObject<{
     }, z.core.$strip>], "type">;
     name: z.ZodString;
     envType: z.ZodEnum<{
-        fixed: "fixed";
         glob: "glob";
+        fixed: "fixed";
     }>;
     globPattern: z.ZodOptional<z.ZodString>;
     branchRestrictions: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -1114,8 +1220,8 @@ export declare const envUpdateRequestSchema: z.ZodObject<{
     updates: z.ZodObject<{
         name: z.ZodOptional<z.ZodString>;
         envType: z.ZodOptional<z.ZodEnum<{
-            fixed: "fixed";
             glob: "glob";
+            fixed: "fixed";
         }>>;
         globPattern: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         branchRestrictions: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
@@ -1671,6 +1777,34 @@ declare const heldRunsListResponseSchema: z.ZodObject<{
         expiresAt: z.ZodNullable<z.ZodCoercedString<unknown>>;
         contributorUsername: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         trustTier: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        jobId: z.ZodOptional<z.ZodString>;
+        holdScope: z.ZodOptional<z.ZodEnum<{
+            job: "job";
+            step: "step";
+            workflow: "workflow";
+        }>>;
+        stepIndex: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        requirement: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            clauses: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                team: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                user: z.ZodString;
+            }, z.core.$strict>]>>;
+            reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>>>;
+        decisions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            approverUserId: z.ZodString;
+            decision: z.ZodEnum<{
+                approve: "approve";
+                reject: "reject";
+            }>;
+            clausesSatisfied: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                team: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                user: z.ZodString;
+            }, z.core.$strict>]>>>>;
+            createdAt: z.ZodCoercedString<unknown>;
+        }, z.core.$strip>>>;
     }, z.core.$strip>>>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -2122,7 +2256,7 @@ export declare const registrationItemSchema: z.ZodObject<{
             github_app: "github_app";
             generic_webhook: "generic_webhook";
             universal_git: "universal_git";
-            internal: "internal";
+            local: "local";
         }>>;
         provider: z.ZodString;
     }, z.core.$strip>>>;
@@ -2152,7 +2286,7 @@ export declare const registrationsListResponseSchema: z.ZodObject<{
                 github_app: "github_app";
                 generic_webhook: "generic_webhook";
                 universal_git: "universal_git";
-                internal: "internal";
+                local: "local";
             }>>;
             provider: z.ZodString;
         }, z.core.$strip>>>;
@@ -2389,6 +2523,229 @@ export declare const backendTestResponseSchema: z.ZodObject<{
     latencyMs: z.ZodOptional<z.ZodNumber>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/** Enum of the five test-relay control message types (request side). */
+export declare const TestRelayType: z.ZodEnum<{
+    "test.relay.uploads.init": "test.relay.uploads.init";
+    "test.relay.trigger": "test.relay.trigger";
+    "test.relay.run.status": "test.relay.run.status";
+    "test.relay.run.logs": "test.relay.run.logs";
+    "test.relay.cancel": "test.relay.cancel";
+}>;
+export type TestRelayType = z.infer<typeof TestRelayType>;
+/** Request an external presigned upload URL for the overlay tarball. */
+export declare const testRelayUploadsInitRequestSchema: z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.uploads.init">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    routingKey: z.ZodString;
+    sha: z.ZodOptional<z.ZodString>;
+    fileCount: z.ZodOptional<z.ZodNumber>;
+    compressedSize: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type TestRelayUploadsInitRequest = z.infer<typeof testRelayUploadsInitRequestSchema>;
+/** Response with the external presigned upload URL + ephemeral encryption key. */
+export declare const testRelayUploadsInitResponseSchema: z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.uploads.init.response">;
+    requestId: z.ZodString;
+    uploadId: z.ZodOptional<z.ZodString>;
+    signedUrl: z.ZodOptional<z.ZodString>;
+    publicKey: z.ZodOptional<z.ZodString>;
+    expiresIn: z.ZodOptional<z.ZodNumber>;
+    error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type TestRelayUploadsInitResponse = z.infer<typeof testRelayUploadsInitResponseSchema>;
+/** Trigger a remote test run (mirrors the orchestrator's TestTriggerInput). */
+export declare const testRelayTriggerRequestSchema: z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.trigger">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    routingKey: z.ZodString;
+    fixtureId: z.ZodString;
+    event: z.ZodObject<{
+        type: z.ZodString;
+        action: z.ZodOptional<z.ZodString>;
+        targetBranch: z.ZodString;
+        sourceBranch: z.ZodOptional<z.ZodString>;
+        payload: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        changedFiles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+    workflowName: z.ZodOptional<z.ZodString>;
+    uploadId: z.ZodOptional<z.ZodString>;
+    cliPublicKey: z.ZodOptional<z.ZodString>;
+    inlineLockFile: z.ZodOptional<z.ZodString>;
+    fullRepo: z.ZodOptional<z.ZodBoolean>;
+    secrets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    encryptedSecrets: z.ZodOptional<z.ZodString>;
+    encryptedSecretsKey: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type TestRelayTriggerRequest = z.infer<typeof testRelayTriggerRequestSchema>;
+/** Response acknowledging a triggered run. */
+export declare const testRelayTriggerResponseSchema: z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.trigger.response">;
+    requestId: z.ZodString;
+    runId: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodEnum<{
+        accepted: "accepted";
+        rejected: "rejected";
+    }>>;
+    reason: z.ZodOptional<z.ZodString>;
+    jobIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type TestRelayTriggerResponse = z.infer<typeof testRelayTriggerResponseSchema>;
+/** Request a snapshot of a run's status. */
+export declare const testRelayRunStatusRequestSchema: z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.run.status">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodString;
+}, z.core.$strip>;
+export type TestRelayRunStatusRequest = z.infer<typeof testRelayRunStatusRequestSchema>;
+/** Response carrying a run-status snapshot. */
+export declare const testRelayRunStatusResponseSchema: z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.run.status.response">;
+    requestId: z.ZodString;
+    runId: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodString>;
+    jobs: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        jobId: z.ZodString;
+        jobName: z.ZodString;
+        status: z.ZodString;
+        exitCode: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        errorMessage: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>>;
+    done: z.ZodOptional<z.ZodBoolean>;
+    error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type TestRelayRunStatusResponse = z.infer<typeof testRelayRunStatusResponseSchema>;
+/** Request the next chunk of a run's logs from a cursor. */
+export declare const testRelayRunLogsRequestSchema: z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.run.logs">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodString;
+    cursor: z.ZodNumber;
+}, z.core.$strip>;
+export type TestRelayRunLogsRequest = z.infer<typeof testRelayRunLogsRequestSchema>;
+/** Response carrying the next log chunk + a monotonic cursor. */
+export declare const testRelayRunLogsResponseSchema: z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.run.logs.response">;
+    requestId: z.ZodString;
+    lines: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    nextCursor: z.ZodOptional<z.ZodNumber>;
+    done: z.ZodOptional<z.ZodBoolean>;
+    error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type TestRelayRunLogsResponse = z.infer<typeof testRelayRunLogsResponseSchema>;
+/** Request to cancel a run. */
+export declare const testRelayCancelRequestSchema: z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.cancel">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodOptional<z.ZodString>;
+    branch: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type TestRelayCancelRequest = z.infer<typeof testRelayCancelRequestSchema>;
+/** Response acknowledging a cancel. */
+export declare const testRelayCancelResponseSchema: z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.cancel.response">;
+    requestId: z.ZodString;
+    cancelled: z.ZodOptional<z.ZodBoolean>;
+    error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type TestRelayCancelResponse = z.infer<typeof testRelayCancelResponseSchema>;
+/** Union of the five Platform→orchestrator test-relay control requests. */
+export type TestRelayRequest = TestRelayUploadsInitRequest | TestRelayTriggerRequest | TestRelayRunStatusRequest | TestRelayRunLogsRequest | TestRelayCancelRequest;
 /** Dashboard messages flowing from Platform to Orchestrator. */
 export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     type: z.ZodLiteral<"dashboard.run.detail">;
@@ -2438,6 +2795,29 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
     runId: z.ZodString;
     jobId: z.ZodString;
     stepIndex: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.attestations.list">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.runs.list">;
     requestId: z.ZodString;
@@ -2648,6 +3028,8 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
         type: z.ZodLiteral<"system">;
         component: z.ZodString;
     }, z.core.$strip>], "type">;
+    includeSecrets: z.ZodOptional<z.ZodBoolean>;
+    orgId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.environments.get">;
     requestId: z.ZodString;
@@ -2695,8 +3077,8 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
     }, z.core.$strip>], "type">;
     name: z.ZodString;
     envType: z.ZodEnum<{
-        fixed: "fixed";
         glob: "glob";
+        fixed: "fixed";
     }>;
     globPattern: z.ZodOptional<z.ZodString>;
     branchRestrictions: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -2735,8 +3117,8 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
     updates: z.ZodObject<{
         name: z.ZodOptional<z.ZodString>;
         envType: z.ZodOptional<z.ZodEnum<{
-            fixed: "fixed";
             glob: "glob";
+            fixed: "fixed";
         }>>;
         globPattern: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         branchRestrictions: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
@@ -3776,9 +4158,11 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
         "run.payload.read": "run.payload.read";
         "run.orch_logs.read": "run.orch_logs.read";
         "step.logs.read": "step.logs.read";
+        "attestations.read": "attestations.read";
         "run.cancel": "run.cancel";
         "run.rerun": "run.rerun";
         "run.manual_schedule": "run.manual_schedule";
+        "run.trigger": "run.trigger";
         "job.cancel": "job.cancel";
         "event_log.list.read": "event_log.list.read";
         "event_log.detail.read": "event_log.detail.read";
@@ -3807,6 +4191,8 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
         "held_run.list.read": "held_run.list.read";
         "held_run.approve": "held_run.approve";
         "held_run.reject": "held_run.reject";
+        "held_run.request": "held_run.request";
+        "held_run.expire": "held_run.expire";
         "registration.list.read": "registration.list.read";
         "diagnostics.read": "diagnostics.read";
         "scaler.capacity.read": "scaler.capacity.read";
@@ -3837,8 +4223,8 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
     targetType: z.ZodOptional<z.ZodEnum<{
         run: "run";
         job: "job";
-        step: "step";
         payload: "payload";
+        step: "step";
         event_log: "event_log";
         event_log_payload: "event_log_payload";
         secret_scope: "secret_scope";
@@ -3859,43 +4245,187 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
     q: z.ZodOptional<z.ZodString>;
     limit: z.ZodOptional<z.ZodNumber>;
     cursor: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>], "type">;
-/** Dashboard messages flowing from Orchestrator to Platform. */
-export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    type: z.ZodLiteral<"dashboard.run.detail.response">;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.uploads.init">;
     requestId: z.ZodString;
-    jobs: z.ZodArray<z.ZodObject<{
-        jobId: z.ZodString;
-        jobName: z.ZodString;
-        status: z.ZodString;
-        matrixValues: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-        startedAt: z.ZodNullable<z.ZodNumber>;
-        completedAt: z.ZodNullable<z.ZodNumber>;
-        durationMs: z.ZodNullable<z.ZodNumber>;
-        agentId: z.ZodNullable<z.ZodString>;
-        orchestratorId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        errorMessage: z.ZodNullable<z.ZodString>;
-        runsOnLabels: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
-        outputs: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>>;
-        secretOutputKeys: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
-        initFailure: z.ZodOptional<z.ZodObject<{
-            scope: z.ZodEnum<{
-                run: "run";
-                job: "job";
-            }>;
-            category: z.ZodEnum<{
-                secret_resolution: "secret_resolution";
-                install_secrets: "install_secrets";
-                lock_resolution: "lock_resolution";
-                build_coordination: "build_coordination";
-                environment_rules: "environment_rules";
-                dynamic_eval: "dynamic_eval";
-                no_agent: "no_agent";
-                matrix_expansion: "matrix_expansion";
-            }>;
-            message: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    routingKey: z.ZodString;
+    sha: z.ZodOptional<z.ZodString>;
+    fileCount: z.ZodOptional<z.ZodNumber>;
+    compressedSize: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.trigger">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    routingKey: z.ZodString;
+    fixtureId: z.ZodString;
+    event: z.ZodObject<{
+        type: z.ZodString;
+        action: z.ZodOptional<z.ZodString>;
+        targetBranch: z.ZodString;
+        sourceBranch: z.ZodOptional<z.ZodString>;
+        payload: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        changedFiles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+    workflowName: z.ZodOptional<z.ZodString>;
+    uploadId: z.ZodOptional<z.ZodString>;
+    cliPublicKey: z.ZodOptional<z.ZodString>;
+    inlineLockFile: z.ZodOptional<z.ZodString>;
+    fullRepo: z.ZodOptional<z.ZodBoolean>;
+    secrets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    encryptedSecrets: z.ZodOptional<z.ZodString>;
+    encryptedSecretsKey: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.run.status">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.run.logs">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodString;
+    cursor: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.cancel">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodOptional<z.ZodString>;
+    branch: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "type">;
+/** Dashboard messages flowing from Orchestrator to Platform. */
+export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.run.detail.response">;
+    requestId: z.ZodString;
+    jobs: z.ZodArray<z.ZodObject<{
+        jobId: z.ZodString;
+        jobName: z.ZodString;
+        status: z.ZodString;
+        matrixValues: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        startedAt: z.ZodNullable<z.ZodNumber>;
+        completedAt: z.ZodNullable<z.ZodNumber>;
+        durationMs: z.ZodNullable<z.ZodNumber>;
+        agentId: z.ZodNullable<z.ZodString>;
+        orchestratorId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        errorMessage: z.ZodNullable<z.ZodString>;
+        runsOnLabels: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        outputs: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>>;
+        secretOutputKeys: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        initFailure: z.ZodOptional<z.ZodObject<{
+            scope: z.ZodEnum<{
+                run: "run";
+                job: "job";
+            }>;
+            category: z.ZodEnum<{
+                secret_resolution: "secret_resolution";
+                install_secrets: "install_secrets";
+                lock_resolution: "lock_resolution";
+                build_coordination: "build_coordination";
+                environment_rules: "environment_rules";
+                dynamic_eval: "dynamic_eval";
+                no_agent: "no_agent";
+                matrix_expansion: "matrix_expansion";
+            }>;
+            message: z.ZodString;
             jobName: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
+        needs: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
+            upstreamName: z.ZodString;
+            ifFailed: z.ZodEnum<{
+                run: "run";
+                skip: "skip";
+            }>;
+        }, z.core.$strip>>>>;
         steps: z.ZodArray<z.ZodObject<{
             stepIndex: z.ZodNumber;
             stepName: z.ZodString;
@@ -3946,6 +4476,35 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
     lines: z.ZodArray<z.ZodString>;
     totalLines: z.ZodNumber;
     error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.attestations.list.response">;
+    requestId: z.ZodString;
+    attestations: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        jobId: z.ZodString;
+        jobName: z.ZodNullable<z.ZodString>;
+        subjectName: z.ZodString;
+        subjectDigest: z.ZodString;
+        mode: z.ZodString;
+        mediaType: z.ZodString;
+        createdAt: z.ZodString;
+        bundle: z.ZodObject<{
+            mediaType: z.ZodLiteral<"application/vnd.kici.provenance.bundle+json;version=0.1">;
+            dsseEnvelope: z.ZodObject<{
+                payloadType: z.ZodString;
+                payload: z.ZodString;
+                signatures: z.ZodArray<z.ZodObject<{
+                    keyid: z.ZodString;
+                    sig: z.ZodString;
+                }, z.core.$strip>>;
+            }, z.core.$strip>;
+            verificationMaterial: z.ZodObject<{
+                publicKey: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+                identityToken: z.ZodString;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+    error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.runs.list.response">;
     requestId: z.ZodString;
@@ -4006,7 +4565,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             github_app: "github_app";
             generic_webhook: "generic_webhook";
             universal_git: "universal_git";
-            internal: "internal";
+            local: "local";
         }>;
         enabled: z.ZodBoolean;
         createdAt: z.ZodString;
@@ -4047,14 +4606,15 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
         id: z.ZodString;
         name: z.ZodString;
         type: z.ZodEnum<{
-            fixed: "fixed";
             glob: "glob";
+            fixed: "fixed";
         }>;
         globPattern: z.ZodNullable<z.ZodString>;
         enabled: z.ZodBoolean;
         allowLocalExecution: z.ZodBoolean;
         createdAt: z.ZodCoercedString<unknown>;
         updatedAt: z.ZodCoercedString<unknown>;
+        secretKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
@@ -4064,8 +4624,8 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
         id: z.ZodString;
         name: z.ZodString;
         type: z.ZodEnum<{
-            fixed: "fixed";
             glob: "glob";
+            fixed: "fixed";
         }>;
         globPattern: z.ZodNullable<z.ZodString>;
         branchRestrictions: z.ZodNullable<z.ZodArray<z.ZodString>>;
@@ -4216,6 +4776,34 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
         expiresAt: z.ZodNullable<z.ZodCoercedString<unknown>>;
         contributorUsername: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         trustTier: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        jobId: z.ZodOptional<z.ZodString>;
+        holdScope: z.ZodOptional<z.ZodEnum<{
+            job: "job";
+            step: "step";
+            workflow: "workflow";
+        }>>;
+        stepIndex: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        requirement: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            clauses: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                team: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                user: z.ZodString;
+            }, z.core.$strict>]>>;
+            reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>>>;
+        decisions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            approverUserId: z.ZodString;
+            decision: z.ZodEnum<{
+                approve: "approve";
+                reject: "reject";
+            }>;
+            clausesSatisfied: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                team: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                user: z.ZodString;
+            }, z.core.$strict>]>>>>;
+            createdAt: z.ZodCoercedString<unknown>;
+        }, z.core.$strip>>>;
     }, z.core.$strip>>>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
@@ -4250,7 +4838,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
                 github_app: "github_app";
                 generic_webhook: "generic_webhook";
                 universal_git: "universal_git";
-                internal: "internal";
+                local: "local";
             }>>;
             provider: z.ZodString;
         }, z.core.$strip>>>;
@@ -4702,9 +5290,11 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             "run.payload.read": "run.payload.read";
             "run.orch_logs.read": "run.orch_logs.read";
             "step.logs.read": "step.logs.read";
+            "attestations.read": "attestations.read";
             "run.cancel": "run.cancel";
             "run.rerun": "run.rerun";
             "run.manual_schedule": "run.manual_schedule";
+            "run.trigger": "run.trigger";
             "job.cancel": "job.cancel";
             "event_log.list.read": "event_log.list.read";
             "event_log.detail.read": "event_log.detail.read";
@@ -4733,6 +5323,8 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             "held_run.list.read": "held_run.list.read";
             "held_run.approve": "held_run.approve";
             "held_run.reject": "held_run.reject";
+            "held_run.request": "held_run.request";
+            "held_run.expire": "held_run.expire";
             "registration.list.read": "registration.list.read";
             "diagnostics.read": "diagnostics.read";
             "scaler.capacity.read": "scaler.capacity.read";
@@ -4753,8 +5345,8 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
         targetType: z.ZodNullable<z.ZodEnum<{
             run: "run";
             job: "job";
-            step: "step";
             payload: "payload";
+            step: "step";
             event_log: "event_log";
             event_log_payload: "event_log_payload";
             secret_scope: "secret_scope";
@@ -4786,6 +5378,51 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
     }, z.core.$strip>>>;
     nextCursor: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.uploads.init.response">;
+    requestId: z.ZodString;
+    uploadId: z.ZodOptional<z.ZodString>;
+    signedUrl: z.ZodOptional<z.ZodString>;
+    publicKey: z.ZodOptional<z.ZodString>;
+    expiresIn: z.ZodOptional<z.ZodNumber>;
+    error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.trigger.response">;
+    requestId: z.ZodString;
+    runId: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodEnum<{
+        accepted: "accepted";
+        rejected: "rejected";
+    }>>;
+    reason: z.ZodOptional<z.ZodString>;
+    jobIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.run.status.response">;
+    requestId: z.ZodString;
+    runId: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodString>;
+    jobs: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        jobId: z.ZodString;
+        jobName: z.ZodString;
+        status: z.ZodString;
+        exitCode: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        errorMessage: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>>;
+    done: z.ZodOptional<z.ZodBoolean>;
+    error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.run.logs.response">;
+    requestId: z.ZodString;
+    lines: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    nextCursor: z.ZodOptional<z.ZodNumber>;
+    done: z.ZodOptional<z.ZodBoolean>;
+    error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.cancel.response">;
+    requestId: z.ZodString;
+    cancelled: z.ZodOptional<z.ZodBoolean>;
+    error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>], "type">;
 export type DashboardRunDetailRequest = z.infer<typeof dashboardRunDetailRequestSchema>;
 export type DashboardStepLogsRequest = z.infer<typeof dashboardStepLogsRequestSchema>;
@@ -4887,6 +5524,13 @@ export declare const dashboardRunDetailApiResponseSchema: z.ZodObject<{
             message: z.ZodString;
             jobName: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
+        needs: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
+            upstreamName: z.ZodString;
+            ifFailed: z.ZodEnum<{
+                run: "run";
+                skip: "skip";
+            }>;
+        }, z.core.$strip>>>>;
         steps: z.ZodArray<z.ZodObject<{
             stepIndex: z.ZodNumber;
             stepName: z.ZodString;
@@ -4936,8 +5580,344 @@ export declare const dashboardStepLogsApiResponseSchema: z.ZodObject<{
     lines: z.ZodArray<z.ZodString>;
     totalLines: z.ZodNumber;
 }, z.core.$strip>;
+/**
+ * REST API response for the run attestations list. The orchestrator-relayed
+ * `attestations` array is augmented by Platform with the provenance trust root
+ * from its own `oidcIssuer` config: `trustedIssuer` is the issuer the dashboard
+ * pins each bundle's identity token to (never the bundle's own `iss`), and
+ * `jwksUri` is the discovery JWKS endpoint the dashboard fetches to verify.
+ * Both are null when the Platform has no provenance issuer configured — the
+ * dashboard then lists + downloads the bundles but renders the badge as
+ * "verification unavailable".
+ */
+export declare const dashboardAttestationsApiResponseSchema: z.ZodObject<{
+    trustedIssuer: z.ZodNullable<z.ZodString>;
+    jwksUri: z.ZodNullable<z.ZodString>;
+    attestations: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        jobId: z.ZodString;
+        jobName: z.ZodNullable<z.ZodString>;
+        subjectName: z.ZodString;
+        subjectDigest: z.ZodString;
+        mode: z.ZodString;
+        mediaType: z.ZodString;
+        createdAt: z.ZodString;
+        bundle: z.ZodObject<{
+            mediaType: z.ZodLiteral<"application/vnd.kici.provenance.bundle+json;version=0.1">;
+            dsseEnvelope: z.ZodObject<{
+                payloadType: z.ZodString;
+                payload: z.ZodString;
+                signatures: z.ZodArray<z.ZodObject<{
+                    keyid: z.ZodString;
+                    sig: z.ZodString;
+                }, z.core.$strip>>;
+            }, z.core.$strip>;
+            verificationMaterial: z.ZodObject<{
+                publicKey: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+                identityToken: z.ZodString;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/** Single run summary in the paginated run list. */
+export declare const runListItemSchema: z.ZodObject<{
+    runId: z.ZodString;
+    workflowName: z.ZodString;
+    status: z.ZodString;
+    repoIdentifier: z.ZodNullable<z.ZodString>;
+    sha: z.ZodNullable<z.ZodString>;
+    ref: z.ZodNullable<z.ZodString>;
+    triggerEvent: z.ZodNullable<z.ZodString>;
+    commitMessage: z.ZodNullable<z.ZodString>;
+    jobCount: z.ZodNullable<z.ZodNumber>;
+    startedAt: z.ZodNullable<z.ZodCoercedString<unknown>>;
+    completedAt: z.ZodNullable<z.ZodCoercedString<unknown>>;
+    durationMs: z.ZodNullable<z.ZodNumber>;
+    parentRunId: z.ZodNullable<z.ZodString>;
+    originalRunId: z.ZodNullable<z.ZodString>;
+    triggeredBy: z.ZodNullable<z.ZodString>;
+    triggeredByUser: z.ZodNullable<z.ZodObject<{
+        sub: z.ZodString;
+        email: z.ZodNullable<z.ZodString>;
+        displayName: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    cancelledBy: z.ZodNullable<z.ZodString>;
+    cancelledByUser: z.ZodNullable<z.ZodObject<{
+        sub: z.ZodString;
+        email: z.ZodNullable<z.ZodString>;
+        displayName: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    failureReason: z.ZodOptional<z.ZodString>;
+    hadCompileJob: z.ZodBoolean;
+    compileJobId: z.ZodNullable<z.ZodString>;
+    source: z.ZodNullable<z.ZodObject<{
+        routingKey: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        subtype: z.ZodNullable<z.ZodEnum<{
+            github_app: "github_app";
+            generic_webhook: "generic_webhook";
+            universal_git: "universal_git";
+            local: "local";
+        }>>;
+        provider: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type RunListItem = z.infer<typeof runListItemSchema>;
+/** Paginated run list response envelope. */
+export declare const runListResponseSchema: z.ZodObject<{
+    runs: z.ZodArray<z.ZodObject<{
+        runId: z.ZodString;
+        workflowName: z.ZodString;
+        status: z.ZodString;
+        repoIdentifier: z.ZodNullable<z.ZodString>;
+        sha: z.ZodNullable<z.ZodString>;
+        ref: z.ZodNullable<z.ZodString>;
+        triggerEvent: z.ZodNullable<z.ZodString>;
+        commitMessage: z.ZodNullable<z.ZodString>;
+        jobCount: z.ZodNullable<z.ZodNumber>;
+        startedAt: z.ZodNullable<z.ZodCoercedString<unknown>>;
+        completedAt: z.ZodNullable<z.ZodCoercedString<unknown>>;
+        durationMs: z.ZodNullable<z.ZodNumber>;
+        parentRunId: z.ZodNullable<z.ZodString>;
+        originalRunId: z.ZodNullable<z.ZodString>;
+        triggeredBy: z.ZodNullable<z.ZodString>;
+        triggeredByUser: z.ZodNullable<z.ZodObject<{
+            sub: z.ZodString;
+            email: z.ZodNullable<z.ZodString>;
+            displayName: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+        cancelledBy: z.ZodNullable<z.ZodString>;
+        cancelledByUser: z.ZodNullable<z.ZodObject<{
+            sub: z.ZodString;
+            email: z.ZodNullable<z.ZodString>;
+            displayName: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+        failureReason: z.ZodOptional<z.ZodString>;
+        hadCompileJob: z.ZodBoolean;
+        compileJobId: z.ZodNullable<z.ZodString>;
+        source: z.ZodNullable<z.ZodObject<{
+            routingKey: z.ZodString;
+            name: z.ZodNullable<z.ZodString>;
+            subtype: z.ZodNullable<z.ZodEnum<{
+                github_app: "github_app";
+                generic_webhook: "generic_webhook";
+                universal_git: "universal_git";
+                local: "local";
+            }>>;
+            provider: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    total: z.ZodNumber;
+    page: z.ZodNumber;
+    pageSize: z.ZodNumber;
+    hasMore: z.ZodBoolean;
+}, z.core.$strip>;
+export type RunListResponse = z.infer<typeof runListResponseSchema>;
+declare const diagnosticsInfraAgentSchema: z.ZodObject<{
+    agentId: z.ZodString;
+    labels: z.ZodArray<z.ZodString>;
+    platform: z.ZodString;
+    arch: z.ZodString;
+    activeJobs: z.ZodNumber;
+    maxConcurrency: z.ZodNumber;
+    lastHeartbeatAt: z.ZodNumber;
+    registeredAt: z.ZodNumber;
+    version: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    hostname: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    osRelease: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    osVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    totalMemoryMb: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    cpuCount: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    nodeVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    memoryUsedMb: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    memoryAvailableMb: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    uptimeSeconds: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    runningAsUser: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    runningAsUid: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    scalerName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+declare const diagnosticsInfraOrchestratorSchema: z.ZodObject<{
+    connectionId: z.ZodString;
+    clusterName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    instanceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    routingKeys: z.ZodArray<z.ZodString>;
+    connected: z.ZodBoolean;
+    connectedAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    lastHeartbeat: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    version: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    mode: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    role: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    raftRole: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    raftTerm: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    raftLeaderId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    scalerBackends: z.ZodArray<z.ZodString>;
+    s3LogAccess: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    agentCount: z.ZodNumber;
+    runningJobs: z.ZodNumber;
+    queuedJobs: z.ZodNumber;
+    pendingLabelGaps: z.ZodArray<z.ZodString>;
+    agents: z.ZodArray<z.ZodObject<{
+        agentId: z.ZodString;
+        labels: z.ZodArray<z.ZodString>;
+        platform: z.ZodString;
+        arch: z.ZodString;
+        activeJobs: z.ZodNumber;
+        maxConcurrency: z.ZodNumber;
+        lastHeartbeatAt: z.ZodNumber;
+        registeredAt: z.ZodNumber;
+        version: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        hostname: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        osRelease: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        osVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        totalMemoryMb: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        cpuCount: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        nodeVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        memoryUsedMb: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        memoryAvailableMb: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        uptimeSeconds: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        runningAsUser: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        runningAsUid: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        scalerName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>;
+    hostname: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    osRelease: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    osVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    totalMemoryMb: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    cpuCount: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    nodeVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    memoryUsedMb: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    memoryAvailableMb: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    uptimeSeconds: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    runningAsUser: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    runningAsUid: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    statefulAgentCount: z.ZodNumber;
+    statefulHosts: z.ZodArray<z.ZodString>;
+    scalers: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        type: z.ZodString;
+        maxAgents: z.ZodNumber;
+        activeAgents: z.ZodNumber;
+        labelSets: z.ZodArray<z.ZodArray<z.ZodString>>;
+        config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        hosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    dependencyHealth: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        status: z.ZodEnum<{
+            pass: "pass";
+            warn: "warn";
+            fail: "fail";
+        }>;
+        message: z.ZodNullable<z.ZodString>;
+        details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        durationMs: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>>;
+    error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const diagnosticsInfrastructureResponseSchema: z.ZodObject<{
+    orchestrators: z.ZodArray<z.ZodObject<{
+        connectionId: z.ZodString;
+        clusterName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        instanceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        routingKeys: z.ZodArray<z.ZodString>;
+        connected: z.ZodBoolean;
+        connectedAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        lastHeartbeat: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        version: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        mode: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        role: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        raftRole: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        raftTerm: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        raftLeaderId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        scalerBackends: z.ZodArray<z.ZodString>;
+        s3LogAccess: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        agentCount: z.ZodNumber;
+        runningJobs: z.ZodNumber;
+        queuedJobs: z.ZodNumber;
+        pendingLabelGaps: z.ZodArray<z.ZodString>;
+        agents: z.ZodArray<z.ZodObject<{
+            agentId: z.ZodString;
+            labels: z.ZodArray<z.ZodString>;
+            platform: z.ZodString;
+            arch: z.ZodString;
+            activeJobs: z.ZodNumber;
+            maxConcurrency: z.ZodNumber;
+            lastHeartbeatAt: z.ZodNumber;
+            registeredAt: z.ZodNumber;
+            version: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            hostname: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            osRelease: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            osVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            totalMemoryMb: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+            cpuCount: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+            nodeVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            memoryUsedMb: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+            memoryAvailableMb: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+            uptimeSeconds: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+            runningAsUser: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            runningAsUid: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+            scalerName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>>;
+        hostname: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        osRelease: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        osVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        totalMemoryMb: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        cpuCount: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        nodeVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        memoryUsedMb: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        memoryAvailableMb: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        uptimeSeconds: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        runningAsUser: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        runningAsUid: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        statefulAgentCount: z.ZodNumber;
+        statefulHosts: z.ZodArray<z.ZodString>;
+        scalers: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            type: z.ZodString;
+            maxAgents: z.ZodNumber;
+            activeAgents: z.ZodNumber;
+            labelSets: z.ZodArray<z.ZodArray<z.ZodString>>;
+            config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            hosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        dependencyHealth: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            status: z.ZodEnum<{
+                pass: "pass";
+                warn: "warn";
+                fail: "fail";
+            }>;
+            message: z.ZodNullable<z.ZodString>;
+            details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            durationMs: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>>;
+        error: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    alerts: z.ZodArray<z.ZodObject<{
+        type: z.ZodString;
+        message: z.ZodString;
+        severity: z.ZodString;
+    }, z.core.$strip>>;
+    latestVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export type DiagnosticsInfrastructureResponse = z.infer<typeof diagnosticsInfrastructureResponseSchema>;
+export type DiagnosticsOrchestrator = z.infer<typeof diagnosticsInfraOrchestratorSchema>;
+export type DiagnosticsAgent = z.infer<typeof diagnosticsInfraAgentSchema>;
+export declare const diagnosticsSummaryResponseSchema: z.ZodObject<{
+    connections: z.ZodArray<z.ZodUnknown>;
+    executionMetrics: z.ZodObject<{
+        totalRuns: z.ZodNumber;
+        successRate: z.ZodNumber;
+        avgDurationSeconds: z.ZodNumber;
+        queuedJobs: z.ZodNumber;
+        runningJobs: z.ZodNumber;
+    }, z.core.$strip>;
+    orphanedConnections: z.ZodNumber;
+}, z.core.$strip>;
+export type DiagnosticsSummaryResponse = z.infer<typeof diagnosticsSummaryResponseSchema>;
 export type DashboardRunDetailApiResponse = z.infer<typeof dashboardRunDetailApiResponseSchema>;
 export type DashboardStepLogsApiResponse = z.infer<typeof dashboardStepLogsApiResponseSchema>;
+export type DashboardAttestationsApiResponse = z.infer<typeof dashboardAttestationsApiResponseSchema>;
 export type DashboardJobDetail = z.infer<typeof dashboardJobDetailSchema>;
 /** Single environment from the list response. */
 export type DashboardEnvironment = NonNullable<EnvListResponse['environments']>[number];