@kici-dev/engine 0.1.16 → 0.1.18

package/dist/protocol/messages/dashboard.js

@@ -1,12 +1,14 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { actorPrincipalSchema } from "./actor.js";
 import { initFailureSchema } from "./execution-status.js";
 import { SourceSubtype } from "./source-registration.js";
+import { kiciBundleSchema } from "../../provenance/bundle.js";
 import { dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema } from "./access-log.js";
 import { dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema } from "./run-events.js";
 import { EventLogSource, EventLogStatus, PayloadOmittedReason } from "./event-log.js";
 import { ScalerBackendType } from "../../scaler/scaler-backend-type.js";
 import { ApprovalDecision, HoldScope, approverClauseSchema } from "../../approval/types.js";
+import { IfFailedPolicy } from "../../trigger/types.js";
 import { globalWorkflowsGetRequestSchema, globalWorkflowsGetResponseSchema, globalWorkflowsUpdateRequestSchema, globalWorkflowsUpdateResponseSchema } from "./dashboard-global-workflows.js";
 import { z } from "zod";
 //#region src/protocol/messages/dashboard.ts
@@ -47,6 +49,12 @@ const dashboardJobDetailSchema = z.object({
 	jobName: z.string(),
 	status: z.string(),
 	matrixValues: z.record(z.string(), z.unknown()).nullable(),
+	/** Base (logical) job name for a fan-out child; null for non-fanned jobs. */
+	baseJobName: z.string().nullable().optional(),
+	/** Fan-out kind for a child: 'matrix' | 'host'; null for non-fanned jobs. */
+	variantKind: z.string().nullable().optional(),
+	/** Fan-out label for a child: matrix suffix or hostname; null for non-fanned jobs. */
+	variantLabel: z.string().nullable().optional(),
 	startedAt: z.number().nullable(),
 	completedAt: z.number().nullable(),
 	durationMs: z.number().nullable(),
@@ -64,6 +72,16 @@ const dashboardJobDetailSchema = z.object({
 	* the job is a synthetic `rejected-*` or `init-failed-*` row; status will be 'failed'.
 	*/
 	initFailure: initFailureSchema.optional(),
+	/**
+	* Upstream dependency edges for this job (one entry per `needs` declaration),
+	* resolved by the orchestrator from execution_job_needs. `upstreamName` is the
+	* upstream job name; `ifFailed` is the per-edge failure policy. null/absent when
+	* the job has no upstreams.
+	*/
+	needs: z.array(z.object({
+		upstreamName: z.string(),
+		ifFailed: IfFailedPolicy
+	})).nullable().optional(),
 	steps: z.array(dashboardStepDetailSchema)
 });
 /** Trust context from orchestrator execution_runs (populated for PR-triggered runs). */
@@ -97,6 +115,36 @@ const dashboardStepLogsResponseSchema = z.object({
 	totalLines: z.number(),
 	error: z.string().optional()
 });
+/** Request the build-provenance attestations for a run. */
+const dashboardAttestationsListRequestSchema = z.object({
+	type: z.literal("dashboard.attestations.list"),
+	requestId: z.string(),
+	actor: actorPrincipalSchema,
+	runId: z.string()
+});
+/**
+* Single attestation in the list response, with its bundle inlined from object
+* storage so the dashboard verifies it without a second fetch. The bundle is a
+* KiCI Mode-A bundle (`@kici-dev/engine/provenance/bundle`).
+*/
+const attestationListItemSchema = z.object({
+	id: z.string(),
+	jobId: z.string(),
+	jobName: z.string().nullable(),
+	subjectName: z.string(),
+	subjectDigest: z.string(),
+	mode: z.string(),
+	mediaType: z.string(),
+	createdAt: z.string(),
+	bundle: kiciBundleSchema
+});
+/** Response with the run's attestations (correlates to dashboard.attestations.list). */
+const dashboardAttestationsListResponseSchema = z.object({
+	type: z.literal("dashboard.attestations.list.response"),
+	requestId: z.string(),
+	attestations: z.array(attestationListItemSchema),
+	error: z.string().optional()
+});
 /**
 * Run-summary projection from the orchestrator's execution_runs table.
 *
@@ -521,7 +569,23 @@ const concurrencyStrategySchema = z.enum(["queue", "cancel-pending"]);
 const envListRequestSchema = z.object({
 	type: z.literal("dashboard.environments.list"),
 	requestId: z.string(),
-	actor: actorPrincipalSchema
+	actor: actorPrincipalSchema,
+	/**
+	* When true, each returned environment carries its reachable secret key
+	* names (never values) in `secretKeys`. Used by the developer CLI's
+	* `kici secrets list` / `kici types` commands.
+	*/
+	includeSecrets: z.boolean().optional(),
+	/**
+	* Target org the read must be scoped to, carried per-request by the Platform
+	* (the validated `:orgId` path param). The orchestrator honors this over its
+	* static connection-level org so a Platform-first `kici run remote` org —
+	* anchored only by `remote_sources` — sees its own environments even when the
+	* orchestrator's connection also serves a webhook source for a different org.
+	* Absent on the legacy customer-dashboard path, where the connection org is
+	* already the request org.
+	*/
+	orgId: z.string().optional()
 });
 const envListResponseSchema = z.object({
 	type: z.literal("dashboard.environments.list.response"),
@@ -534,7 +598,13 @@ const envListResponseSchema = z.object({
 		enabled: z.boolean(),
 		allowLocalExecution: z.boolean(),
 		createdAt: z.coerce.string(),
-		updatedAt: z.coerce.string()
+		updatedAt: z.coerce.string(),
+		/**
+		* Distinct secret key names reachable from this environment's scope
+		* bindings (never values). Present only when the request set
+		* `includeSecrets: true`.
+		*/
+		secretKeys: z.array(z.string()).optional()
 	})).optional(),
 	error: z.string().optional()
 });
@@ -1088,13 +1158,7 @@ const dashboardDiagnosticsResponseSchema = z.object({
 		/** Total number of registered agents (always populated regardless of includeAgents). */
 		agentCount: z.number().nullable().optional(),
 		/** Number of agents not bound to any scaler. */
-		statefulAgentCount: z.number().nullable().optional(),
-		/**
-		* Distinct host names of stateful (unbound) agents, derived from their
-		* self-reported kici:host: labels. Lets the dashboard surface the hosts of
-		* long-lived standalone agents on the collapsed "Stateful agents" header.
-		*/
-		statefulHosts: z.array(z.string()).optional()
+		statefulAgentCount: z.number().nullable().optional()
 	}),
 	agents: z.array(diagnosticsAgentSchema),
 	scalers: z.array(diagnosticsScalerSchema).optional(),
@@ -1312,10 +1376,128 @@ const backendTestResponseSchema = z.object({
 	latencyMs: z.number().optional(),
 	error: z.string().optional()
 });
+/** Enum of the five test-relay control message types (request side). */
+const TestRelayType = z.enum([
+	"test.relay.uploads.init",
+	"test.relay.trigger",
+	"test.relay.run.status",
+	"test.relay.run.logs",
+	"test.relay.cancel"
+]);
+/** Request an external presigned upload URL for the overlay tarball. */
+const testRelayUploadsInitRequestSchema = z.object({
+	type: z.literal("test.relay.uploads.init"),
+	requestId: z.string(),
+	actor: actorPrincipalSchema,
+	routingKey: z.string(),
+	sha: z.string().optional(),
+	fileCount: z.number().optional(),
+	compressedSize: z.number().optional()
+});
+/** Response with the external presigned upload URL + ephemeral encryption key. */
+const testRelayUploadsInitResponseSchema = z.object({
+	type: z.literal("test.relay.uploads.init.response"),
+	requestId: z.string(),
+	uploadId: z.string().optional(),
+	signedUrl: z.string().optional(),
+	publicKey: z.string().optional(),
+	expiresIn: z.number().optional(),
+	error: z.string().optional()
+});
+/** Trigger a remote test run (mirrors the orchestrator's TestTriggerInput). */
+const testRelayTriggerRequestSchema = z.object({
+	type: z.literal("test.relay.trigger"),
+	requestId: z.string(),
+	actor: actorPrincipalSchema,
+	routingKey: z.string(),
+	fixtureId: z.string(),
+	event: z.object({
+		type: z.string(),
+		action: z.string().optional(),
+		targetBranch: z.string(),
+		sourceBranch: z.string().optional(),
+		payload: z.record(z.string(), z.unknown()),
+		changedFiles: z.array(z.string()).optional()
+	}),
+	workflowName: z.string().optional(),
+	uploadId: z.string().optional(),
+	cliPublicKey: z.string().optional(),
+	inlineLockFile: z.string().optional(),
+	fullRepo: z.boolean().optional(),
+	secrets: z.record(z.string(), z.string()).optional(),
+	encryptedSecrets: z.string().optional(),
+	encryptedSecretsKey: z.string().optional()
+});
+/** Response acknowledging a triggered run. */
+const testRelayTriggerResponseSchema = z.object({
+	type: z.literal("test.relay.trigger.response"),
+	requestId: z.string(),
+	runId: z.string().optional(),
+	status: z.enum(["accepted", "rejected"]).optional(),
+	reason: z.string().optional(),
+	jobIds: z.array(z.string()).optional(),
+	error: z.string().optional()
+});
+/** Request a snapshot of a run's status. */
+const testRelayRunStatusRequestSchema = z.object({
+	type: z.literal("test.relay.run.status"),
+	requestId: z.string(),
+	actor: actorPrincipalSchema,
+	runId: z.string()
+});
+/** Response carrying a run-status snapshot. */
+const testRelayRunStatusResponseSchema = z.object({
+	type: z.literal("test.relay.run.status.response"),
+	requestId: z.string(),
+	runId: z.string().optional(),
+	status: z.string().optional(),
+	jobs: z.array(z.object({
+		jobId: z.string(),
+		jobName: z.string(),
+		status: z.string(),
+		exitCode: z.number().nullable().optional(),
+		errorMessage: z.string().nullable().optional()
+	})).optional(),
+	done: z.boolean().optional(),
+	error: z.string().optional()
+});
+/** Request the next chunk of a run's logs from a cursor. */
+const testRelayRunLogsRequestSchema = z.object({
+	type: z.literal("test.relay.run.logs"),
+	requestId: z.string(),
+	actor: actorPrincipalSchema,
+	runId: z.string(),
+	cursor: z.number()
+});
+/** Response carrying the next log chunk + a monotonic cursor. */
+const testRelayRunLogsResponseSchema = z.object({
+	type: z.literal("test.relay.run.logs.response"),
+	requestId: z.string(),
+	lines: z.array(z.string()).optional(),
+	nextCursor: z.number().optional(),
+	done: z.boolean().optional(),
+	error: z.string().optional()
+});
+/** Request to cancel a run. */
+const testRelayCancelRequestSchema = z.object({
+	type: z.literal("test.relay.cancel"),
+	requestId: z.string(),
+	actor: actorPrincipalSchema,
+	runId: z.string().optional(),
+	branch: z.string().optional()
+});
+/** Response acknowledging a cancel. */
+const testRelayCancelResponseSchema = z.object({
+	type: z.literal("test.relay.cancel.response"),
+	requestId: z.string(),
+	cancelled: z.boolean().optional(),
+	error: z.string().optional()
+});
 /** Dashboard messages flowing from Platform to Orchestrator. */
 const dashboardPlatformToOrchSchema = z.discriminatedUnion("type", [
 	dashboardRunDetailRequestSchema,
 	dashboardStepLogsRequestSchema,
+	dashboardAttestationsListRequestSchema,
 	dashboardRunsListRequestSchema,
 	dashboardRunsFiltersRequestSchema,
 	dashboardSourcesListRequestSchema,
@@ -1368,12 +1550,18 @@ const dashboardPlatformToOrchSchema = z.discriminatedUnion("type", [
 	dashboardEventDlqDiscardRequestSchema,
 	globalWorkflowsGetRequestSchema,
 	globalWorkflowsUpdateRequestSchema,
-	dashboardAccessLogListRequestSchema
+	dashboardAccessLogListRequestSchema,
+	testRelayUploadsInitRequestSchema,
+	testRelayTriggerRequestSchema,
+	testRelayRunStatusRequestSchema,
+	testRelayRunLogsRequestSchema,
+	testRelayCancelRequestSchema
 ]);
 /** Dashboard messages flowing from Orchestrator to Platform. */
 const dashboardOrchToPlatformSchema = z.discriminatedUnion("type", [
 	dashboardRunDetailResponseSchema,
 	dashboardStepLogsResponseSchema,
+	dashboardAttestationsListResponseSchema,
 	dashboardRunsListResponseSchema,
 	dashboardRunsFiltersResponseSchema,
 	dashboardSourcesListResponseSchema,
@@ -1426,7 +1614,12 @@ const dashboardOrchToPlatformSchema = z.discriminatedUnion("type", [
 	dashboardEventDlqDiscardResponseSchema,
 	globalWorkflowsGetResponseSchema,
 	globalWorkflowsUpdateResponseSchema,
-	dashboardAccessLogListResponseSchema
+	dashboardAccessLogListResponseSchema,
+	testRelayUploadsInitResponseSchema,
+	testRelayTriggerResponseSchema,
+	testRelayRunStatusResponseSchema,
+	testRelayRunLogsResponseSchema,
+	testRelayCancelResponseSchema
 ]);
 /** REST API response for run detail (jobs with nested steps). */
 const dashboardRunDetailApiResponseSchema = z.object({
@@ -1445,6 +1638,168 @@ const dashboardStepLogsApiResponseSchema = z.object({
 	lines: z.array(z.string()),
 	totalLines: z.number()
 });
+/**
+* REST API response for the run attestations list. The orchestrator-relayed
+* `attestations` array is augmented by Platform with the provenance trust root
+* from its own `oidcIssuer` config: `trustedIssuer` is the issuer the dashboard
+* pins each bundle's identity token to (never the bundle's own `iss`), and
+* `jwksUri` is the discovery JWKS endpoint the dashboard fetches to verify.
+* Both are null when the Platform has no provenance issuer configured — the
+* dashboard then lists + downloads the bundles but renders the badge as
+* "verification unavailable".
+*/
+const dashboardAttestationsApiResponseSchema = z.object({
+	trustedIssuer: z.string().nullable(),
+	jwksUri: z.string().nullable(),
+	attestations: z.array(attestationListItemSchema)
+});
+/** Resolved user identity attached to run attribution fields. */
+const runListPrincipalUserSchema = z.object({
+	sub: z.string(),
+	email: z.string().nullable(),
+	displayName: z.string().nullable()
+});
+/** Source identity attached to a run summary. */
+const runListSourceSchema = z.object({
+	routingKey: z.string(),
+	name: z.string().nullable(),
+	subtype: SourceSubtype.nullable(),
+	provider: z.string()
+});
+/** Single run summary in the paginated run list. */
+const runListItemSchema = z.object({
+	runId: z.string(),
+	workflowName: z.string(),
+	status: z.string(),
+	repoIdentifier: z.string().nullable(),
+	sha: z.string().nullable(),
+	ref: z.string().nullable(),
+	triggerEvent: z.string().nullable(),
+	commitMessage: z.string().nullable(),
+	jobCount: z.number().nullable(),
+	startedAt: z.coerce.string().nullable(),
+	completedAt: z.coerce.string().nullable(),
+	durationMs: z.number().nullable(),
+	parentRunId: z.string().nullable(),
+	originalRunId: z.string().nullable(),
+	triggeredBy: z.string().nullable(),
+	triggeredByUser: runListPrincipalUserSchema.nullable(),
+	cancelledBy: z.string().nullable(),
+	cancelledByUser: runListPrincipalUserSchema.nullable(),
+	failureReason: z.string().optional(),
+	hadCompileJob: z.boolean(),
+	compileJobId: z.string().nullable(),
+	source: runListSourceSchema.nullable()
+});
+/** Paginated run list response envelope. */
+const runListResponseSchema = z.object({
+	runs: z.array(runListItemSchema),
+	total: z.number(),
+	page: z.number(),
+	pageSize: z.number(),
+	hasMore: z.boolean()
+});
+const diagnosticsInfraAgentSchema = z.object({
+	agentId: z.string(),
+	labels: z.array(z.string()),
+	platform: z.string(),
+	arch: z.string(),
+	activeJobs: z.number(),
+	maxConcurrency: z.number(),
+	lastHeartbeatAt: z.number(),
+	registeredAt: z.number(),
+	version: z.string().nullable().optional(),
+	hostname: z.string().nullable().optional(),
+	osRelease: z.string().nullable().optional(),
+	osVersion: z.string().nullable().optional(),
+	totalMemoryMb: z.number().nullable().optional(),
+	cpuCount: z.number().nullable().optional(),
+	nodeVersion: z.string().nullable().optional(),
+	memoryUsedMb: z.number().nullable().optional(),
+	memoryAvailableMb: z.number().nullable().optional(),
+	uptimeSeconds: z.number().nullable().optional(),
+	runningAsUser: z.string().nullable().optional(),
+	runningAsUid: z.number().nullable().optional(),
+	scalerName: z.string().nullable().optional()
+});
+const diagnosticsInfraScalerSchema = z.object({
+	name: z.string(),
+	type: z.string(),
+	maxAgents: z.number(),
+	activeAgents: z.number(),
+	labelSets: z.array(z.array(z.string())),
+	config: z.record(z.string(), z.unknown()).optional(),
+	hosts: z.array(z.string()).optional()
+});
+const diagnosticsInfraOrchestratorSchema = z.object({
+	connectionId: z.string(),
+	clusterName: z.string().nullable().optional(),
+	instanceId: z.string().nullable().optional(),
+	routingKeys: z.array(z.string()),
+	connected: z.boolean(),
+	connectedAt: z.number().nullable().optional(),
+	lastHeartbeat: z.number().nullable().optional(),
+	version: z.string().nullable().optional(),
+	mode: z.string().nullable().optional(),
+	role: z.string().nullable().optional(),
+	raftRole: z.string().nullable().optional(),
+	raftTerm: z.number().nullable().optional(),
+	raftLeaderId: z.string().nullable().optional(),
+	scalerBackends: z.array(z.string()),
+	s3LogAccess: z.boolean().nullable().optional(),
+	agentCount: z.number(),
+	runningJobs: z.number(),
+	queuedJobs: z.number(),
+	pendingLabelGaps: z.array(z.string()),
+	agents: z.array(diagnosticsInfraAgentSchema),
+	hostname: z.string().nullable().optional(),
+	osRelease: z.string().nullable().optional(),
+	osVersion: z.string().nullable().optional(),
+	totalMemoryMb: z.number().nullable().optional(),
+	cpuCount: z.number().nullable().optional(),
+	nodeVersion: z.string().nullable().optional(),
+	memoryUsedMb: z.number().nullable().optional(),
+	memoryAvailableMb: z.number().nullable().optional(),
+	uptimeSeconds: z.number().nullable().optional(),
+	runningAsUser: z.string().nullable().optional(),
+	runningAsUid: z.number().nullable().optional(),
+	statefulAgentCount: z.number(),
+	scalers: z.array(diagnosticsInfraScalerSchema),
+	dependencyHealth: z.array(z.object({
+		name: z.string(),
+		status: z.enum([
+			"pass",
+			"warn",
+			"fail"
+		]),
+		message: z.string().nullable(),
+		details: z.record(z.string(), z.unknown()).optional(),
+		durationMs: z.number().optional()
+	})).optional(),
+	error: z.string().optional()
+});
+const diagnosticsInfraAlertSchema = z.object({
+	type: z.string(),
+	message: z.string(),
+	severity: z.string()
+});
+const diagnosticsInfrastructureResponseSchema = z.object({
+	orchestrators: z.array(diagnosticsInfraOrchestratorSchema),
+	alerts: z.array(diagnosticsInfraAlertSchema),
+	latestVersion: z.string().nullable().optional()
+});
+const diagnosticsExecutionMetricsSchema = z.object({
+	totalRuns: z.number(),
+	successRate: z.number(),
+	avgDurationSeconds: z.number(),
+	queuedJobs: z.number(),
+	runningJobs: z.number()
+});
+const diagnosticsSummaryResponseSchema = z.object({
+	connections: z.array(z.unknown()),
+	executionMetrics: diagnosticsExecutionMetricsSchema,
+	orphanedConnections: z.number()
+});
 /** Single infrastructure event for a run (from run_events table). */
 const runEventSchema = z.object({
 	id: z.string(),
@@ -1503,6 +1858,6 @@ const orgMemberSchema = z.object({
 /** Response for org members list endpoint. */
 const memberListResponseSchema = z.object({ members: z.array(orgMemberSchema) });
 //#endregion
-export { EnvDeleteErrorCode, EventLogPayloadStreamError, HeldRunQueueType, HeldRunStatus, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runRerunRequestSchema, trustPolicyResponseSchema };
+export { EnvDeleteErrorCode, EventLogPayloadStreamError, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListItemSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema };
 
 //# sourceMappingURL=dashboard.js.map

package/dist/protocol/messages/event-log.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/protocol/messages/event-log.ts
 /**

package/dist/protocol/messages/execution-status.d.ts

@@ -1,5 +1,14 @@
 import { z } from 'zod';
-/** Status values for execution runs (execution_runs table). */
+/**
+ * Status values for execution runs (execution_runs table).
+ *
+ * `held` = the run is paused at the workflow install gate (a `registries:` /
+ * `installEnv:` protection rule returned hold/wait/queue). It is alive and
+ * resumable — NOT terminal — so it is deliberately absent from
+ * `TERMINAL_RUN_STATES`. On release (reviewer approve, wait-timer expiry,
+ * concurrency slot free) the run resumes into job dispatch; on reject it
+ * transitions to `cancelled`.
+ */
 export declare const ExecutionRunStatus: z.ZodEnum<{
     success: "success";
     pending: "pending";
@@ -7,6 +16,7 @@ export declare const ExecutionRunStatus: z.ZodEnum<{
     failed: "failed";
     cancelled: "cancelled";
     cancelling: "cancelling";
+    held: "held";
 }>;
 export type ExecutionRunStatus = z.infer<typeof ExecutionRunStatus>;
 /** Status values for execution jobs (execution_jobs table + job.status protocol messages). */
@@ -146,6 +156,7 @@ export declare const executionStatusSchema: z.ZodObject<{
         failed: "failed";
         cancelled: "cancelled";
         cancelling: "cancelling";
+        held: "held";
     }>;
     repoIdentifier: z.ZodOptional<z.ZodString>;
     sha: z.ZodOptional<z.ZodString>;
@@ -263,6 +274,7 @@ export declare const stateReplaySchema: z.ZodObject<{
             failed: "failed";
             cancelled: "cancelled";
             cancelling: "cancelling";
+            held: "held";
         }>;
         routingKey: z.ZodOptional<z.ZodString>;
         repoIdentifier: z.ZodOptional<z.ZodString>;

package/dist/protocol/messages/execution-status.js

@@ -1,14 +1,24 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/protocol/messages/execution-status.ts
-/** Status values for execution runs (execution_runs table). */
+/**
+* Status values for execution runs (execution_runs table).
+*
+* `held` = the run is paused at the workflow install gate (a `registries:` /
+* `installEnv:` protection rule returned hold/wait/queue). It is alive and
+* resumable — NOT terminal — so it is deliberately absent from
+* `TERMINAL_RUN_STATES`. On release (reviewer approve, wait-timer expiry,
+* concurrency slot free) the run resumes into job dispatch; on reject it
+* transitions to `cancelled`.
+*/
 const ExecutionRunStatus = z.enum([
 	"pending",
 	"running",
 	"success",
 	"failed",
 	"cancelled",
-	"cancelling"
+	"cancelling",
+	"held"
 ]);
 /** Status values for execution jobs (execution_jobs table + job.status protocol messages). */
 const ExecutionJobStatus = z.enum([

package/dist/protocol/messages/join.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/protocol/messages/join.ts
 /** Join request sent by a new orchestrator (via Platform relay or direct peer). */

package/dist/protocol/messages/log-pull.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/protocol/messages/log-pull.ts
 /** Request historical logs for a completed or running execution. */

package/dist/protocol/messages/observe.d.ts

@@ -17,6 +17,7 @@ export declare const observeStatusSchema: z.ZodObject<{
         failed: "failed";
         cancelled: "cancelled";
         cancelling: "cancelling";
+        held: "held";
     }>;
     jobName: z.ZodOptional<z.ZodString>;
     timestamp: z.ZodNumber;

package/dist/protocol/messages/oidc-token-relay.d.ts

@@ -0,0 +1,31 @@
+import { z } from 'zod';
+/**
+ * agent.api method name for the provenance ID-token relay.
+ *
+ * Single source of truth: both the orchestrator's relay-handler registration
+ * and the SDK `ctx.kici.oidc.token()` wrapper import this constant, so the
+ * wire method name lives in exactly one place.
+ */
+export declare const OIDC_TOKEN_REQUEST_METHOD = "oidc.token.request";
+/**
+ * Params an agent sends with an OIDC_TOKEN_REQUEST_METHOD call. The agent
+ * supplies only the job it is running plus the requested token audience; the
+ * orchestrator binds the mint to the job the agent actually owns and derives
+ * every identity claim server-side, so the agent never asserts a repo/ref.
+ */
+export declare const oidcTokenRequestParamsSchema: z.ZodObject<{
+    jobId: z.ZodString;
+    audience: z.ZodString;
+}, z.core.$strip>;
+export type OidcTokenRequestParams = z.infer<typeof oidcTokenRequestParamsSchema>;
+/**
+ * Result the orchestrator returns to the agent: the minted short-lived JWT
+ * plus its lifetime and identifier.
+ */
+export declare const oidcTokenResultSchema: z.ZodObject<{
+    token: z.ZodString;
+    expiresIn: z.ZodNumber;
+    jti: z.ZodString;
+}, z.core.$strip>;
+export type OidcTokenResult = z.infer<typeof oidcTokenResultSchema>;
+//# sourceMappingURL=oidc-token-relay.d.ts.map

package/dist/protocol/messages/oidc-token-relay.js

@@ -0,0 +1,34 @@
+import "../../chunk-BTugEXQM.js";
+import { z } from "zod";
+//#region src/protocol/messages/oidc-token-relay.ts
+/**
+* agent.api method name for the provenance ID-token relay.
+*
+* Single source of truth: both the orchestrator's relay-handler registration
+* and the SDK `ctx.kici.oidc.token()` wrapper import this constant, so the
+* wire method name lives in exactly one place.
+*/
+const OIDC_TOKEN_REQUEST_METHOD = "oidc.token.request";
+/**
+* Params an agent sends with an OIDC_TOKEN_REQUEST_METHOD call. The agent
+* supplies only the job it is running plus the requested token audience; the
+* orchestrator binds the mint to the job the agent actually owns and derives
+* every identity claim server-side, so the agent never asserts a repo/ref.
+*/
+const oidcTokenRequestParamsSchema = z.object({
+	jobId: z.string().min(1),
+	audience: z.string().min(1).max(255)
+});
+/**
+* Result the orchestrator returns to the agent: the minted short-lived JWT
+* plus its lifetime and identifier.
+*/
+const oidcTokenResultSchema = z.object({
+	token: z.string(),
+	expiresIn: z.number().int().positive(),
+	jti: z.string()
+});
+//#endregion
+export { OIDC_TOKEN_REQUEST_METHOD, oidcTokenRequestParamsSchema, oidcTokenResultSchema };
+
+//# sourceMappingURL=oidc-token-relay.js.map