@kici-dev/engine 0.1.16 → 0.1.18

package/dist/protocol/messages/orchestrator-agent.d.ts

@@ -13,6 +13,21 @@ export declare const CacheRefScope: z.ZodEnum<{
     isolated: "isolated";
 }>;
 export type CacheRefScope = z.infer<typeof CacheRefScope>;
+/**
+ * Frozen snapshot of upstream job outputs for a result-aware dynamic generator.
+ *
+ * Captured once when the deferred eval job is dispatched (its upstreams are
+ * terminal at that point) and replayed unchanged on agent-side re-eval, so the
+ * generator sees the same `ctx.needs` data on both passes.
+ *
+ * - `jobs` maps an upstream job name to its outputs record.
+ * - `groups` maps a dynamic group name to its ordered member job names.
+ */
+export declare const upstreamSnapshotSchema: z.ZodObject<{
+    jobs: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    groups: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type UpstreamSnapshot = z.infer<typeof upstreamSnapshotSchema>;
 /**
  * Structured git-clone auth material. Carries everything the agent needs to
  * authenticate a single `git clone`:
@@ -352,6 +367,28 @@ export declare const cacheUserSaveCompleteSchema: z.ZodObject<{
     tarHash: z.ZodString;
     sizeBytes: z.ZodNumber;
 }, z.core.$strip>;
+/** Agent -> Orchestrator: request a presigned PUT URL for a provenance bundle. */
+export declare const provenanceUploadRequestSchema: z.ZodObject<{
+    type: z.ZodLiteral<"provenance.upload.request">;
+    messageId: z.ZodString;
+    jobId: z.ZodString;
+    subjectDigest: z.ZodString;
+}, z.core.$strip>;
+/** Orchestrator -> Agent: presigned PUT URL for the provenance bundle. */
+export declare const provenanceUploadResponseSchema: z.ZodObject<{
+    type: z.ZodLiteral<"provenance.upload.response">;
+    requestId: z.ZodString;
+    uploadUrl: z.ZodString;
+}, z.core.$strip>;
+/** Agent -> Orchestrator: confirm a provenance bundle upload (records an attestations row). */
+export declare const provenanceUploadCompleteSchema: z.ZodObject<{
+    type: z.ZodLiteral<"provenance.upload.complete">;
+    messageId: z.ZodString;
+    jobId: z.ZodString;
+    subjectName: z.ZodString;
+    subjectDigest: z.ZodString;
+    mediaType: z.ZodString;
+}, z.core.$strip>;
 /** Agent -> Orchestrator: emit a custom event from a running workflow step. */
 export declare const eventEmitSchema: z.ZodObject<{
     type: z.ZodLiteral<"event.emit">;
@@ -601,6 +638,10 @@ export declare const orchestratorToAgentMessageSchema: z.ZodDiscriminatedUnion<[
     requestId: z.ZodString;
     uploadUrl: z.ZodOptional<z.ZodString>;
     skip: z.ZodBoolean;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"provenance.upload.response">;
+    requestId: z.ZodString;
+    uploadUrl: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"event.emit.response">;
     requestId: z.ZodString;
@@ -804,6 +845,18 @@ export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[
     key: z.ZodString;
     tarHash: z.ZodString;
     sizeBytes: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"provenance.upload.request">;
+    messageId: z.ZodString;
+    jobId: z.ZodString;
+    subjectDigest: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"provenance.upload.complete">;
+    messageId: z.ZodString;
+    jobId: z.ZodString;
+    subjectName: z.ZodString;
+    subjectDigest: z.ZodString;
+    mediaType: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"event.emit">;
     jobId: z.ZodString;
@@ -882,6 +935,9 @@ export type CacheUserRestoreResponse = z.infer<typeof cacheUserRestoreResponseSc
 export type CacheUserSaveRequest = z.infer<typeof cacheUserSaveRequestSchema>;
 export type CacheUserSaveResponse = z.infer<typeof cacheUserSaveResponseSchema>;
 export type CacheUserSaveComplete = z.infer<typeof cacheUserSaveCompleteSchema>;
+export type ProvenanceUploadRequest = z.infer<typeof provenanceUploadRequestSchema>;
+export type ProvenanceUploadResponse = z.infer<typeof provenanceUploadResponseSchema>;
+export type ProvenanceUploadComplete = z.infer<typeof provenanceUploadCompleteSchema>;
 export type FleetLogsRequest = z.infer<typeof fleetLogsRequestSchema>;
 export type FleetBundleChunk = z.infer<typeof fleetBundleChunkSchema>;
 export type FleetBundleError = z.infer<typeof fleetBundleErrorSchema>;

package/dist/protocol/messages/orchestrator-agent.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { ExecutionJobStatus, ExecutionStepStatus } from "./execution-status.js";
 import { approverClauseSchema } from "../../approval/types.js";
 import { z } from "zod";
@@ -14,6 +14,20 @@ import { z } from "zod";
 */
 const CacheRefScope = z.enum(["shared", "isolated"]);
 /**
+* Frozen snapshot of upstream job outputs for a result-aware dynamic generator.
+*
+* Captured once when the deferred eval job is dispatched (its upstreams are
+* terminal at that point) and replayed unchanged on agent-side re-eval, so the
+* generator sees the same `ctx.needs` data on both passes.
+*
+* - `jobs` maps an upstream job name to its outputs record.
+* - `groups` maps a dynamic group name to its ordered member job names.
+*/
+const upstreamSnapshotSchema = z.object({
+	jobs: z.record(z.string(), z.record(z.string(), z.unknown())),
+	groups: z.record(z.string(), z.array(z.string()))
+});
+/**
 * Structured git-clone auth material. Carries everything the agent needs to
 * authenticate a single `git clone`:
 *
@@ -471,6 +485,34 @@ const cacheUserSaveCompleteSchema = z.object({
 	/** Tarball size in bytes (drives quota accounting). */
 	sizeBytes: z.number().int().nonnegative()
 });
+/** Agent -> Orchestrator: request a presigned PUT URL for a provenance bundle. */
+const provenanceUploadRequestSchema = z.object({
+	type: z.literal("provenance.upload.request"),
+	messageId: z.string(),
+	/** Job producing the attestation (ownership-checked; runId resolved server-side). */
+	jobId: z.string(),
+	/** Primary subject digest (lowercase hex) — the storage-key discriminator. */
+	subjectDigest: z.string()
+});
+/** Orchestrator -> Agent: presigned PUT URL for the provenance bundle. */
+const provenanceUploadResponseSchema = z.object({
+	type: z.literal("provenance.upload.response"),
+	requestId: z.string(),
+	/** Presigned PUT URL, or '' when storage is unavailable. */
+	uploadUrl: z.string()
+});
+/** Agent -> Orchestrator: confirm a provenance bundle upload (records an attestations row). */
+const provenanceUploadCompleteSchema = z.object({
+	type: z.literal("provenance.upload.complete"),
+	messageId: z.string(),
+	jobId: z.string(),
+	/** Caller-supplied artifact name. */
+	subjectName: z.string(),
+	/** Primary subject digest (lowercase hex). */
+	subjectDigest: z.string(),
+	/** Bundle media type. */
+	mediaType: z.string()
+});
 /** Agent -> Orchestrator: emit a custom event from a running workflow step. */
 const eventEmitSchema = z.object({
 	type: z.literal("event.emit"),
@@ -640,6 +682,7 @@ const orchestratorToAgentMessageSchema = z.discriminatedUnion("type", [
 	cacheUploadResponseSchema,
 	cacheUserRestoreResponseSchema,
 	cacheUserSaveResponseSchema,
+	provenanceUploadResponseSchema,
 	eventEmitResponseSchema,
 	agentApiResponseSchema,
 	agentAuthSuccessSchema,
@@ -665,6 +708,8 @@ const agentToOrchestratorMessageSchema = z.discriminatedUnion("type", [
 	cacheUserRestoreRequestSchema,
 	cacheUserSaveRequestSchema,
 	cacheUserSaveCompleteSchema,
+	provenanceUploadRequestSchema,
+	provenanceUploadCompleteSchema,
 	eventEmitSchema,
 	agentApiRequestSchema,
 	agentMetricsSchema,
@@ -674,6 +719,6 @@ const agentToOrchestratorMessageSchema = z.discriminatedUnion("type", [
 	stepApprovalRequestSchema
 ]);
 //#endregion
-export { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, registerAckSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema };
+export { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema };
 
 //# sourceMappingURL=orchestrator-agent.js.map

package/dist/protocol/messages/peer.d.ts

@@ -140,6 +140,22 @@ export declare const jobRerouteSchema: z.ZodObject<{
     workflowName: z.ZodString;
     runsOnLabels: z.ZodArray<z.ZodArray<z.ZodString>>;
     excludeLabels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    runsOnPatterns: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"exact">;
+        value: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"regex">;
+        source: z.ZodString;
+        flags: z.ZodString;
+    }, z.core.$strip>], "kind">>>;
+    excludePatterns: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"exact">;
+        value: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"regex">;
+        source: z.ZodString;
+        flags: z.ZodString;
+    }, z.core.$strip>], "kind">>>;
     triedConnections: z.ZodArray<z.ZodString>;
     maxHops: z.ZodNumber;
     coordinatorId: z.ZodString;
@@ -488,6 +504,22 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     workflowName: z.ZodString;
     runsOnLabels: z.ZodArray<z.ZodArray<z.ZodString>>;
     excludeLabels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    runsOnPatterns: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"exact">;
+        value: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"regex">;
+        source: z.ZodString;
+        flags: z.ZodString;
+    }, z.core.$strip>], "kind">>>;
+    excludePatterns: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"exact">;
+        value: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"regex">;
+        source: z.ZodString;
+        flags: z.ZodString;
+    }, z.core.$strip>], "kind">>>;
     triedConnections: z.ZodArray<z.ZodString>;
     maxHops: z.ZodNumber;
     coordinatorId: z.ZodString;
@@ -756,6 +788,22 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     workflowName: z.ZodString;
     runsOnLabels: z.ZodArray<z.ZodArray<z.ZodString>>;
     excludeLabels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    runsOnPatterns: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"exact">;
+        value: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"regex">;
+        source: z.ZodString;
+        flags: z.ZodString;
+    }, z.core.$strip>], "kind">>>;
+    excludePatterns: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"exact">;
+        value: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"regex">;
+        source: z.ZodString;
+        flags: z.ZodString;
+    }, z.core.$strip>], "kind">>>;
     triedConnections: z.ZodArray<z.ZodString>;
     maxHops: z.ZodNumber;
     coordinatorId: z.ZodString;

package/dist/protocol/messages/peer.js

@@ -1,6 +1,7 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { ExecutionJobStatus } from "./execution-status.js";
 import { ScalerEventType } from "./scaler-event.js";
+import { LabelMatcher } from "../../labels-match.js";
 import { z } from "zod";
 //#region src/protocol/messages/peer.ts
 /** Agent summary included in peer heartbeat and auth response messages. */
@@ -160,6 +161,16 @@ const jobRerouteSchema = z.object({
 	runsOnLabels: z.array(z.array(z.string())),
 	/** Labels that the dispatched agent must NOT have (optional for backward compatibility). */
 	excludeLabels: z.array(z.string()).optional(),
+	/**
+	* Glob/regex include matchers the receiving peer's agent labels must
+	* satisfy (JS post-filter, applied on top of the exact `runsOnLabels`
+	* prefilter — same semantics as the single-orchestrator dispatch path).
+	* Absent is treated as `[]`. A pure-pattern job (no exact labels) carries
+	* its selector here; dropping it would let the job match any local agent.
+	*/
+	runsOnPatterns: z.array(LabelMatcher).optional(),
+	/** Glob/regex matchers that disqualify a candidate agent (JS post-filter). Absent is `[]`. */
+	excludePatterns: z.array(LabelMatcher).optional(),
 	triedConnections: z.array(z.string()),
 	maxHops: z.number(),
 	coordinatorId: z.string(),

package/dist/protocol/messages/platform-orchestrator.d.ts

@@ -410,6 +410,7 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     type: z.ZodLiteral<"auth.success">;
     connectionId: z.ZodString;
     orgPublicAlias: z.ZodOptional<z.ZodString>;
+    orgId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"auth.failure">;
     reason: z.ZodString;
@@ -492,6 +493,29 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     runId: z.ZodString;
     jobId: z.ZodString;
     stepIndex: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.attestations.list">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.runs.list">;
     requestId: z.ZodString;
@@ -702,6 +726,8 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         type: z.ZodLiteral<"system">;
         component: z.ZodString;
     }, z.core.$strip>], "type">;
+    includeSecrets: z.ZodOptional<z.ZodBoolean>;
+    orgId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.environments.get">;
     requestId: z.ZodString;
@@ -749,8 +775,8 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     }, z.core.$strip>], "type">;
     name: z.ZodString;
     envType: z.ZodEnum<{
-        fixed: "fixed";
         glob: "glob";
+        fixed: "fixed";
     }>;
     globPattern: z.ZodOptional<z.ZodString>;
     branchRestrictions: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -789,8 +815,8 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     updates: z.ZodObject<{
         name: z.ZodOptional<z.ZodString>;
         envType: z.ZodOptional<z.ZodEnum<{
-            fixed: "fixed";
             glob: "glob";
+            fixed: "fixed";
         }>>;
         globPattern: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         branchRestrictions: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
@@ -1830,9 +1856,11 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         "run.payload.read": "run.payload.read";
         "run.orch_logs.read": "run.orch_logs.read";
         "step.logs.read": "step.logs.read";
+        "attestations.read": "attestations.read";
         "run.cancel": "run.cancel";
         "run.rerun": "run.rerun";
         "run.manual_schedule": "run.manual_schedule";
+        "run.trigger": "run.trigger";
         "job.cancel": "job.cancel";
         "event_log.list.read": "event_log.list.read";
         "event_log.detail.read": "event_log.detail.read";
@@ -1893,8 +1921,8 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     targetType: z.ZodOptional<z.ZodEnum<{
         run: "run";
         job: "job";
-        step: "step";
         payload: "payload";
+        step: "step";
         event_log: "event_log";
         event_log_payload: "event_log_payload";
         secret_scope: "secret_scope";
@@ -1915,6 +1943,143 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     q: z.ZodOptional<z.ZodString>;
     limit: z.ZodOptional<z.ZodNumber>;
     cursor: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.uploads.init">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    routingKey: z.ZodString;
+    sha: z.ZodOptional<z.ZodString>;
+    fileCount: z.ZodOptional<z.ZodNumber>;
+    compressedSize: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.trigger">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    routingKey: z.ZodString;
+    fixtureId: z.ZodString;
+    event: z.ZodObject<{
+        type: z.ZodString;
+        action: z.ZodOptional<z.ZodString>;
+        targetBranch: z.ZodString;
+        sourceBranch: z.ZodOptional<z.ZodString>;
+        payload: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        changedFiles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+    workflowName: z.ZodOptional<z.ZodString>;
+    uploadId: z.ZodOptional<z.ZodString>;
+    cliPublicKey: z.ZodOptional<z.ZodString>;
+    inlineLockFile: z.ZodOptional<z.ZodString>;
+    fullRepo: z.ZodOptional<z.ZodBoolean>;
+    secrets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    encryptedSecrets: z.ZodOptional<z.ZodString>;
+    encryptedSecretsKey: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.run.status">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.run.logs">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodString;
+    cursor: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.cancel">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodOptional<z.ZodString>;
+    branch: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>], "type">;
 /** All messages that flow from Orchestrator to Platform.
  *
@@ -1966,6 +2131,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
         failed: "failed";
         cancelled: "cancelled";
         cancelling: "cancelling";
+        held: "held";
     }>;
     repoIdentifier: z.ZodOptional<z.ZodString>;
     sha: z.ZodOptional<z.ZodString>;
@@ -2077,6 +2243,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             failed: "failed";
             cancelled: "cancelled";
             cancelling: "cancelling";
+            held: "held";
         }>;
         routingKey: z.ZodOptional<z.ZodString>;
         repoIdentifier: z.ZodOptional<z.ZodString>;
@@ -2155,7 +2322,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             github_app: "github_app";
             generic_webhook: "generic_webhook";
             universal_git: "universal_git";
-            internal: "internal";
+            local: "local";
         }>;
     }, z.core.$strip>>;
     instanceId: z.ZodOptional<z.ZodString>;

package/dist/protocol/messages/platform-orchestrator.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { heartbeatSchema } from "./common.js";
 import { orchCapabilitiesSchema } from "./capabilities.js";
 import { authFailureSchema, authRequestSchema, authSuccessSchema } from "./auth.js";

package/dist/protocol/messages/run-events.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { actorPrincipalSchema } from "./actor.js";
 import { z } from "zod";
 //#region src/protocol/messages/run-events.ts

package/dist/protocol/messages/scaler-event.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/protocol/messages/scaler-event.ts
 /**

package/dist/protocol/messages/source-registration.d.ts

@@ -4,7 +4,7 @@ import { z } from 'zod';
  * grouping logic) to render an icon and friendly label for each source.
  *
  * Distinct from `provider` (which collapses universal-git, generic_webhook, and
- * internal into the single value `'generic'`): subtype keeps the "what kind of
+ * local into the single value `'generic'`): subtype keeps the "what kind of
  * orchestrator-side wiring is this?" distinction visible all the way through
  * the API and UI.
  *
@@ -13,19 +13,20 @@ import { z } from 'zod';
  * - `generic_webhook` — `generic_webhook_sources` row with `provider_type='generic'`.
  * - `universal_git`   — `generic_webhook_sources` row with a non-null `git_config`
  *                      (universal-git provider — gitea, gitlab, forgejo, etc.).
- * - `internal`        — `generic_webhook_sources` row with `provider_type='internal'`
- *                      (E2E / staging stg-ha smoke-test plumbing).
+ * - `local`           — `generic_webhook_sources` row with `provider_type='local'`
+ *                      (a git repository present on the agent's filesystem,
+ *                      cloned via `file://`).
  */
 export declare const SourceSubtype: z.ZodEnum<{
     github_app: "github_app";
     generic_webhook: "generic_webhook";
     universal_git: "universal_git";
-    internal: "internal";
+    local: "local";
 }>;
 export type SourceSubtype = z.infer<typeof SourceSubtype>;
 /**
  * Source provider family used by Platform's webhook router. Coarser-grained
- * than `SourceSubtype` — every universal-git / generic_webhook / internal row
+ * than `SourceSubtype` — every universal-git / generic_webhook / local row
  * collapses to `'generic'` here because Platform routes them through the same
  * generic webhook ingress.
  */
@@ -53,7 +54,7 @@ export declare const sourceRegistrationSchema: z.ZodObject<{
             github_app: "github_app";
             generic_webhook: "generic_webhook";
             universal_git: "universal_git";
-            internal: "internal";
+            local: "local";
         }>;
     }, z.core.$strip>>;
     instanceId: z.ZodOptional<z.ZodString>;

package/dist/protocol/messages/source-registration.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/protocol/messages/source-registration.ts
 /**
@@ -6,7 +6,7 @@ import { z } from "zod";
 * grouping logic) to render an icon and friendly label for each source.
 *
 * Distinct from `provider` (which collapses universal-git, generic_webhook, and
-* internal into the single value `'generic'`): subtype keeps the "what kind of
+* local into the single value `'generic'`): subtype keeps the "what kind of
 * orchestrator-side wiring is this?" distinction visible all the way through
 * the API and UI.
 *
@@ -15,18 +15,19 @@ import { z } from "zod";
 * - `generic_webhook` — `generic_webhook_sources` row with `provider_type='generic'`.
 * - `universal_git`   — `generic_webhook_sources` row with a non-null `git_config`
 *                      (universal-git provider — gitea, gitlab, forgejo, etc.).
-* - `internal`        — `generic_webhook_sources` row with `provider_type='internal'`
-*                      (E2E / staging stg-ha smoke-test plumbing).
+* - `local`           — `generic_webhook_sources` row with `provider_type='local'`
+*                      (a git repository present on the agent's filesystem,
+*                      cloned via `file://`).
 */
 const SourceSubtype = z.enum([
 	"github_app",
 	"generic_webhook",
 	"universal_git",
-	"internal"
+	"local"
 ]);
 /**
 * Source provider family used by Platform's webhook router. Coarser-grained
-* than `SourceSubtype` — every universal-git / generic_webhook / internal row
+* than `SourceSubtype` — every universal-git / generic_webhook / local row
 * collapses to `'generic'` here because Platform routes them through the same
 * generic webhook ingress.
 */

package/dist/protocol/version.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/protocol/version.ts
 /**
 * Protocol version. Sent during WebSocket handshake.