@kici-dev/engine 0.1.22 → 0.1.24

package/dist/protocol/messages/execution-status.js

@@ -1,6 +1,20 @@
 import "../../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/protocol/messages/execution-status.ts
+/** Max length for ids and short identifier fields (runId, jobId, sha, ref, …). */
+const STATUS_ID_MAX = 128;
+/** Max length for the repo identifier (`owner/repo` can be long). */
+const REPO_IDENTIFIER_MAX = 256;
+/** Max length for free-text fields (commit message, failure/error reason). */
+const STATUS_FREE_TEXT_MAX = 2e3;
+/** Max number of runs in a single `state.replay` snapshot. */
+const STATE_REPLAY_MAX_RUNS = 500;
+/** Max number of jobs attached to a single run in a `state.replay` snapshot. */
+const MAX_JOBS_PER_RUN = 1e3;
+/** Max number of `runsOn` / `secretsAccessed` label entries on a job/step. */
+const RUNS_ON_LABELS_MAX = 30;
+/** Max number of bound deployment-environment names on a job. */
+const ENVIRONMENTS_MAX = 30;
 /**
 * Status values for execution runs (execution_runs table).
 *
@@ -34,12 +48,33 @@ const ExecutionJobStatus = z.enum([
 	"timed_out_stale",
 	"drift_dropped"
 ]);
-/** Status values for execution steps (execution_steps table + step.status protocol messages). */
+/**
+* Status values for execution steps (execution_steps table + step.status protocol messages).
+*
+*  - `pending`   — a parallel-group child queued behind `maxParallel`, not yet launched.
+*  - `cancelled` — a parallel-group sibling aborted by fail-fast (NOT a failure).
+*/
 const ExecutionStepStatus = z.enum([
 	"running",
 	"success",
 	"failed",
-	"skipped"
+	"skipped",
+	"pending",
+	"cancelled"
+]);
+/**
+* How a step participates in a job's step concurrency model.
+*
+*  - `sequential`     — an ordinary step in the flat step sequence.
+*  - `parallel-child` — a child of a `parallel()` group, running concurrently
+*                       with its siblings, each its own observable step.
+*  - `parallel-group` — the structural group wrapper (no flat step index); used
+*                       only for the dashboard band aggregate, not persisted per step.
+*/
+const StepConcurrencyKind = z.enum([
+	"sequential",
+	"parallel-child",
+	"parallel-group"
 ]);
 /**
 * Distinct reasons a run/job ended because a configured wall-clock timeout
@@ -109,9 +144,9 @@ const initFailureSchema = z.object({
 	scope: z.enum(["run", "job"]),
 	category: InitFailureCategory,
 	/** Human-readable failure message (same content surfaced by RunFailureSummary). */
-	message: z.string(),
+	message: z.string().max(STATUS_FREE_TEXT_MAX),
 	/** Set when scope === 'job'. */
-	jobName: z.string().optional()
+	jobName: z.string().max(128).optional()
 });
 /** Terminal run states that indicate the run has completed. */
 const TERMINAL_RUN_STATES = new Set([
@@ -131,31 +166,50 @@ const TERMINAL_JOB_STATES = new Set([
 /** Structured execution status update for Platform metadata tracking. */
 const executionStatusSchema = z.object({
 	type: z.literal("execution.status"),
-	messageId: z.string(),
-	runId: z.string(),
-	workflowName: z.string(),
+	messageId: z.string().max(128),
+	runId: z.string().max(128),
+	workflowName: z.string().max(128),
 	status: ExecutionRunStatus,
-	repoIdentifier: z.string().optional(),
-	sha: z.string().optional(),
+	repoIdentifier: z.string().max(256).optional(),
+	/**
+	* Run-level repo provider (origin host: `github` / `gitlab` / `bitbucket` /
+	* `local`). Distinct from the routing-key-derived source provider; drives the
+	* dashboard's provider-aware repo links.
+	*/
+	repoProvider: z.string().max(128).optional(),
+	/** True when the run executed a developer's uploaded local working tree (`kici run remote`). */
+	localWorkingTree: z.boolean().optional(),
+	sha: z.string().max(128).optional(),
 	/** Git branch or tag (e.g. "main", "refs/tags/v1.0"). */
-	ref: z.string().optional(),
+	ref: z.string().max(128).optional(),
 	/** Trigger event type (e.g. "push", "pr:open"). */
-	triggerEvent: z.string().optional(),
+	triggerEvent: z.string().max(128).optional(),
 	/** First line of the commit message. */
-	commitMessage: z.string().optional(),
+	commitMessage: z.string().max(STATUS_FREE_TEXT_MAX).optional(),
 	jobCount: z.number().optional(),
 	startedAt: z.number(),
 	completedAt: z.number().optional(),
 	durationMs: z.number().optional(),
 	timestamp: z.number(),
 	/** Parent run ID for re-run lineage (null/undefined for original runs). */
-	parentRunId: z.string().nullable().optional(),
+	parentRunId: z.string().max(128).nullable().optional(),
 	/** Root ancestor run ID for re-run lineage (null/undefined for original runs). Always points to the first run in the chain. */
-	originalRunId: z.string().nullable().optional(),
+	originalRunId: z.string().max(128).nullable().optional(),
 	/** User identity that triggered this re-run (null/undefined for webhook-triggered). */
-	triggeredBy: z.string().nullable().optional(),
+	triggeredBy: z.string().max(128).nullable().optional(),
+	/**
+	* Triggering-actor identity captured from the provider event (the pusher / PR
+	* author), distinct from `triggeredBy` (the KiCI re-run user). Provider
+	* identities only — never tenant attribution (the wire-schema invariant: no
+	* `orgId` here). Powers the dashboard "triggered by @x" and actor-scope
+	* notifications. `triggerActorUsername` uses the wider repo-identifier bound
+	* because provider logins can be long display names.
+	*/
+	triggerActorProvider: z.string().max(128).nullable().optional(),
+	triggerActorUsername: z.string().max(256).nullable().optional(),
+	triggerActorUserId: z.string().max(128).nullable().optional(),
 	/** Human-readable reason why the run failed (only present for failed runs). */
-	failureReason: z.string().optional(),
+	failureReason: z.string().max(STATUS_FREE_TEXT_MAX).optional(),
 	/**
 	* Total raw log bytes accumulated across all jobs of this run, summed by the
 	* orchestrator from per-step `logBytesStreamed` values reported by the agent.
@@ -173,35 +227,41 @@ const executionStatusSchema = z.object({
 /** Per-step status forwarded from agent to Platform (real-time). */
 const stepStatusForwardSchema = z.object({
 	type: z.literal("step.status.forward"),
-	messageId: z.string(),
-	runId: z.string(),
-	jobId: z.string(),
-	jobName: z.string(),
+	messageId: z.string().max(128),
+	runId: z.string().max(128),
+	jobId: z.string().max(128),
+	jobName: z.string().max(128),
 	stepIndex: z.number(),
-	stepName: z.string(),
+	stepName: z.string().max(256),
 	state: ExecutionStepStatus,
 	timestamp: z.number(),
-	data: z.record(z.string(), z.unknown()).optional(),
+	data: z.record(z.string().max(128), z.unknown()).optional(),
 	/** Secret key names accessed by this step. Forwarded from agent for dashboard display. */
-	secretsAccessed: z.array(z.string()).optional()
+	secretsAccessed: z.array(z.string().max(128)).max(30).optional(),
+	/** Step concurrency role; absent means an ordinary sequential step. */
+	concurrencyKind: StepConcurrencyKind.optional(),
+	/** Parallel-group correlation id shared by a group's children (e.g. `g0`). */
+	groupId: z.string().max(128).optional()
 });
 /** Per-job status forwarded from orchestrator to Platform (real-time). */
 const jobStatusForwardSchema = z.object({
 	type: z.literal("job.status.forward"),
-	messageId: z.string(),
-	runId: z.string(),
-	jobId: z.string(),
-	jobName: z.string(),
+	messageId: z.string().max(128),
+	runId: z.string().max(128),
+	jobId: z.string().max(128),
+	jobName: z.string().max(128),
 	status: ExecutionJobStatus,
-	matrixValues: z.record(z.string(), z.unknown()).optional(),
+	matrixValues: z.record(z.string().max(128), z.unknown()).optional(),
 	startedAt: z.number().optional(),
 	completedAt: z.number().optional(),
 	durationMs: z.number().optional(),
-	errorMessage: z.string().nullable().optional(),
-	agentId: z.string().nullable().optional(),
-	orchestratorId: z.string().nullable().optional(),
+	errorMessage: z.string().max(STATUS_FREE_TEXT_MAX).nullable().optional(),
+	agentId: z.string().max(128).nullable().optional(),
+	orchestratorId: z.string().max(128).nullable().optional(),
 	/** Labels used for agent routing. */
-	runsOnLabels: z.array(z.string()).optional(),
+	runsOnLabels: z.array(z.string().max(128)).max(30).optional(),
+	/** Ordered bound deployment-environment names for this job (multi-env jobs). */
+	environments: z.array(z.string().max(128)).max(30).optional(),
 	/**
 	* Total raw log bytes accumulated across all steps of this job, summed by
 	* the orchestrator from per-step `logBytesStreamed` values reported by the
@@ -216,41 +276,42 @@ const jobStatusForwardSchema = z.object({
 /** State replay sent on orchestrator reconnection -- full snapshot of active runs and jobs. */
 const stateReplaySchema = z.object({
 	type: z.literal("state.replay"),
-	messageId: z.string(),
+	messageId: z.string().max(128),
 	runs: z.array(z.object({
-		runId: z.string(),
-		workflowName: z.string(),
+		runId: z.string().max(128),
+		workflowName: z.string().max(128),
 		status: ExecutionRunStatus,
-		routingKey: z.string().optional(),
-		repoIdentifier: z.string().optional(),
-		sha: z.string().optional(),
-		ref: z.string().optional(),
-		triggerEvent: z.string().optional(),
-		commitMessage: z.string().optional(),
+		routingKey: z.string().max(128).optional(),
+		repoIdentifier: z.string().max(256).optional(),
+		sha: z.string().max(128).optional(),
+		ref: z.string().max(128).optional(),
+		triggerEvent: z.string().max(128).optional(),
+		commitMessage: z.string().max(STATUS_FREE_TEXT_MAX).optional(),
 		jobCount: z.number(),
 		startedAt: z.number(),
 		completedAt: z.number().optional(),
 		durationMs: z.number().optional(),
-		parentRunId: z.string().nullable().optional(),
-		originalRunId: z.string().nullable().optional(),
-		triggeredBy: z.string().nullable().optional(),
+		parentRunId: z.string().max(128).nullable().optional(),
+		originalRunId: z.string().max(128).nullable().optional(),
+		triggeredBy: z.string().max(128).nullable().optional(),
 		/** Human-readable reason why the run failed (only present for failed runs). */
-		failureReason: z.string().optional(),
+		failureReason: z.string().max(STATUS_FREE_TEXT_MAX).optional(),
 		jobs: z.array(z.object({
-			jobId: z.string(),
-			jobName: z.string(),
-			status: z.string(),
+			jobId: z.string().max(128),
+			jobName: z.string().max(128),
+			status: z.string().max(128),
 			startedAt: z.number().optional(),
 			completedAt: z.number().optional(),
 			durationMs: z.number().optional(),
-			errorMessage: z.string().nullable().optional(),
-			agentId: z.string().nullable().optional(),
-			runsOnLabels: z.array(z.string()).optional()
-		}))
-	})),
+			errorMessage: z.string().max(STATUS_FREE_TEXT_MAX).nullable().optional(),
+			agentId: z.string().max(128).nullable().optional(),
+			runsOnLabels: z.array(z.string().max(128)).max(30).optional(),
+			environments: z.array(z.string().max(128)).max(30).optional()
+		})).max(MAX_JOBS_PER_RUN)
+	})).max(500),
 	timestamp: z.number()
 });
 //#endregion
-export { CacheOutcome, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema };
+export { CacheOutcome, CacheRunEventType, CacheStepType, ENVIRONMENTS_MAX, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, MAX_JOBS_PER_RUN, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, STATE_REPLAY_MAX_RUNS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema };
 
 //# sourceMappingURL=execution-status.js.map

package/dist/protocol/messages/orchestrator-agent.d.ts

@@ -298,8 +298,10 @@ export declare const agentStepStatusSchema: z.ZodObject<{
     state: z.ZodEnum<{
         skipped: "skipped";
         success: "success";
+        pending: "pending";
         running: "running";
         failed: "failed";
+        cancelled: "cancelled";
     }>;
     timestamp: z.ZodNumber;
     data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -313,6 +315,12 @@ export declare const agentStepStatusSchema: z.ZodObject<{
         "hook:afterStep": "hook:afterStep";
     }>>;
     secretsAccessed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    concurrencyKind: z.ZodOptional<z.ZodEnum<{
+        sequential: "sequential";
+        "parallel-child": "parallel-child";
+        "parallel-group": "parallel-group";
+    }>>;
+    groupId: z.ZodOptional<z.ZodString>;
     logBytesStreamed: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 /** Agent -> Orchestrator: report that a job belongs to a concurrency group. */
@@ -342,8 +350,8 @@ export declare const jobConcurrencyAckSchema: z.ZodObject<{
     type: z.ZodLiteral<"job.concurrency.ack">;
     requestId: z.ZodString;
     action: z.ZodEnum<{
-        proceed: "proceed";
         wait: "wait";
+        proceed: "proceed";
         cancel: "cancel";
     }>;
     reason: z.ZodOptional<z.ZodString>;
@@ -513,8 +521,8 @@ export declare const fleetBundleErrorSchema: z.ZodObject<{
 }, z.core.$strip>;
 /** Outcome of a step-level approval hold, sent back to the waiting agent. */
 export declare const StepApprovalOutcome: z.ZodEnum<{
-    rejected: "rejected";
     approved: "approved";
+    rejected: "rejected";
     expired: "expired";
 }>;
 export type StepApprovalOutcome = z.infer<typeof StepApprovalOutcome>;
@@ -575,8 +583,8 @@ export declare const stepApprovalResolvedSchema: z.ZodObject<{
     jobId: z.ZodString;
     stepIndex: z.ZodNumber;
     outcome: z.ZodEnum<{
-        rejected: "rejected";
         approved: "approved";
+        rejected: "rejected";
         expired: "expired";
     }>;
     reason: z.ZodOptional<z.ZodString>;
@@ -674,8 +682,8 @@ export declare const orchestratorToAgentMessageSchema: z.ZodDiscriminatedUnion<[
     type: z.ZodLiteral<"job.concurrency.ack">;
     requestId: z.ZodString;
     action: z.ZodEnum<{
-        proceed: "proceed";
         wait: "wait";
+        proceed: "proceed";
         cancel: "cancel";
     }>;
     reason: z.ZodOptional<z.ZodString>;
@@ -729,8 +737,8 @@ export declare const orchestratorToAgentMessageSchema: z.ZodDiscriminatedUnion<[
     jobId: z.ZodString;
     stepIndex: z.ZodNumber;
     outcome: z.ZodEnum<{
-        rejected: "rejected";
         approved: "approved";
+        rejected: "rejected";
         expired: "expired";
     }>;
     reason: z.ZodOptional<z.ZodString>;
@@ -825,8 +833,10 @@ export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[
     state: z.ZodEnum<{
         skipped: "skipped";
         success: "success";
+        pending: "pending";
         running: "running";
         failed: "failed";
+        cancelled: "cancelled";
     }>;
     timestamp: z.ZodNumber;
     data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -840,6 +850,12 @@ export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[
         "hook:afterStep": "hook:afterStep";
     }>>;
     secretsAccessed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    concurrencyKind: z.ZodOptional<z.ZodEnum<{
+        sequential: "sequential";
+        "parallel-child": "parallel-child";
+        "parallel-group": "parallel-group";
+    }>>;
+    groupId: z.ZodOptional<z.ZodString>;
     logBytesStreamed: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"job.heartbeat">;

package/dist/protocol/messages/orchestrator-agent.js

@@ -1,5 +1,5 @@
 import "../../chunk-BTugEXQM.js";
-import { ExecutionJobStatus, ExecutionStepStatus } from "./execution-status.js";
+import { ExecutionJobStatus, ExecutionStepStatus, StepConcurrencyKind } from "./execution-status.js";
 import { approverClauseSchema } from "../../approval/types.js";
 import { z } from "zod";
 //#region src/protocol/messages/orchestrator-agent.ts
@@ -351,6 +351,10 @@ const agentStepStatusSchema = z.object({
 	]).optional(),
 	/** Secret key names accessed by this step via ctx.secrets.get()/expose(). Never contains values. */
 	secretsAccessed: z.array(z.string()).optional(),
+	/** Step concurrency role; absent means an ordinary sequential step. */
+	concurrencyKind: StepConcurrencyKind.optional(),
+	/** Parallel-group correlation id shared by a group's children (e.g. `g0`). */
+	groupId: z.string().optional(),
 	/**
 	* Total raw bytes streamed by this step's LogStreamer at terminal time.
 	* Counts agent-side raw bytes (the same count fed to the transient

package/dist/protocol/messages/pat-kind.d.ts

@@ -0,0 +1,16 @@
+import { z } from 'zod';
+/**
+ * Kind of personal access token.
+ *
+ * - `user` — an ordinary PAT acting as the human who minted it.
+ * - `agent` — a PAT minted for a coding agent. It still runs with the user's
+ *   permissions (no authority change), but its agent origin is carried into
+ *   every audit / access-log row via `actor.agent`, and it is the only
+ *   credential the developer MCP server accepts.
+ */
+export declare const PatKind: z.ZodEnum<{
+    user: "user";
+    agent: "agent";
+}>;
+export type PatKind = z.infer<typeof PatKind>;
+//# sourceMappingURL=pat-kind.d.ts.map

package/dist/protocol/messages/pat-kind.js

@@ -0,0 +1,17 @@
+import "../../chunk-BTugEXQM.js";
+import { z } from "zod";
+//#region src/protocol/messages/pat-kind.ts
+/**
+* Kind of personal access token.
+*
+* - `user` — an ordinary PAT acting as the human who minted it.
+* - `agent` — a PAT minted for a coding agent. It still runs with the user's
+*   permissions (no authority change), but its agent origin is carried into
+*   every audit / access-log row via `actor.agent`, and it is the only
+*   credential the developer MCP server accepts.
+*/
+const PatKind = z.enum(["user", "agent"]);
+//#endregion
+export { PatKind };
+
+//# sourceMappingURL=pat-kind.js.map

package/dist/protocol/messages/peer.d.ts

@@ -3,8 +3,8 @@ import { z } from 'zod';
 export declare const peerCapabilitiesSchema: z.ZodObject<{
     s3LogAccess: z.ZodBoolean;
     logRoutingOverride: z.ZodOptional<z.ZodEnum<{
-        coordinator: "coordinator";
         direct: "direct";
+        coordinator: "coordinator";
     }>>;
 }, z.core.$strip>;
 /** Scaler capacity summary included in peer heartbeat and auth response for routing decisions. */
@@ -72,8 +72,8 @@ export declare const peerAuthResponseSchema: z.ZodObject<{
     capabilities: z.ZodOptional<z.ZodObject<{
         s3LogAccess: z.ZodBoolean;
         logRoutingOverride: z.ZodOptional<z.ZodEnum<{
-            coordinator: "coordinator";
             direct: "direct";
+            coordinator: "coordinator";
         }>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
@@ -97,8 +97,8 @@ export declare const peerHeartbeatSchema: z.ZodObject<{
     capabilities: z.ZodObject<{
         s3LogAccess: z.ZodBoolean;
         logRoutingOverride: z.ZodOptional<z.ZodEnum<{
-            coordinator: "coordinator";
             direct: "direct";
+            coordinator: "coordinator";
         }>>;
     }, z.core.$strip>;
     scalerCapacity: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -464,8 +464,8 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     capabilities: z.ZodOptional<z.ZodObject<{
         s3LogAccess: z.ZodBoolean;
         logRoutingOverride: z.ZodOptional<z.ZodEnum<{
-            coordinator: "coordinator";
             direct: "direct";
+            coordinator: "coordinator";
         }>>;
     }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
@@ -487,8 +487,8 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     capabilities: z.ZodObject<{
         s3LogAccess: z.ZodBoolean;
         logRoutingOverride: z.ZodOptional<z.ZodEnum<{
-            coordinator: "coordinator";
             direct: "direct";
+            coordinator: "coordinator";
         }>>;
     }, z.core.$strip>;
     scalerCapacity: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -765,8 +765,8 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     capabilities: z.ZodOptional<z.ZodObject<{
         s3LogAccess: z.ZodBoolean;
         logRoutingOverride: z.ZodOptional<z.ZodEnum<{
-            coordinator: "coordinator";
             direct: "direct";
+            coordinator: "coordinator";
         }>>;
     }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
@@ -788,8 +788,8 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     capabilities: z.ZodObject<{
         s3LogAccess: z.ZodBoolean;
         logRoutingOverride: z.ZodOptional<z.ZodEnum<{
-            coordinator: "coordinator";
             direct: "direct";
+            coordinator: "coordinator";
         }>>;
     }, z.core.$strip>;
     scalerCapacity: z.ZodOptional<z.ZodArray<z.ZodObject<{