@kici-dev/engine 0.1.23 → 0.1.24

package/dist/approval/types.d.ts

@@ -22,8 +22,8 @@ export type ApproverClause = z.infer<typeof approverClauseSchema>;
 /** Granularity of a held element. */
 export declare const HoldScope: z.ZodEnum<{
     job: "job";
-    step: "step";
     workflow: "workflow";
+    step: "step";
 }>;
 export type HoldScope = z.infer<typeof HoldScope>;
 /** What triggered the hold: an environment policy (mandatory) or SDK code (explicit). */

package/dist/audit/access-log-policy.d.ts

@@ -11,7 +11,10 @@
  * 1. `outcome !== 'allowed'` → always record (denied/error are full-fidelity).
  * 2. `actor.type === 'platform_operator'` → always record (compliance: any
  *    activity by a non-org member must be auditable in full).
- * 3. The per-action `POLICY_BY_ACTION` decision (`always` / `sample` /
+ * 3. agent-attributed actor (`actor.agent` present) → always record. The
+ *    agent-provenance guarantee is that every action an agent takes is fully
+ *    auditable; a sampled subset would break it.
+ * 4. The per-action `POLICY_BY_ACTION` decision (`always` / `sample` /
  *    `rate_limit`).
  *
  * Browser-safe: this module MUST NOT import any Node built-ins (`node:crypto`

package/dist/audit/access-log-policy.js

@@ -14,7 +14,10 @@ import { z } from "zod";
 * 1. `outcome !== 'allowed'` → always record (denied/error are full-fidelity).
 * 2. `actor.type === 'platform_operator'` → always record (compliance: any
 *    activity by a non-org member must be auditable in full).
-* 3. The per-action `POLICY_BY_ACTION` decision (`always` / `sample` /
+* 3. agent-attributed actor (`actor.agent` present) → always record. The
+*    agent-provenance guarantee is that every action an agent takes is fully
+*    auditable; a sampled subset would break it.
+* 4. The per-action `POLICY_BY_ACTION` decision (`always` / `sample` /
 *    `rate_limit`).
 *
 * Browser-safe: this module MUST NOT import any Node built-ins (`node:crypto`
@@ -38,6 +41,10 @@ const POLICY_BY_ACTION = {
 		kind: "sample",
 		allowedRate: .05
 	},
+	"run.structured.read": {
+		kind: "sample",
+		allowedRate: .05
+	},
 	"runs.list.read": {
 		kind: "sample",
 		allowedRate: .05
@@ -206,6 +213,7 @@ function actorKey(actor) {
 function shouldRecordAccess(action, outcome, actor, requestId, limiter) {
 	if (outcome !== "allowed") return true;
 	if (actor.type === "platform_operator") return true;
+	if (actor.type === "user" && actor.agent) return true;
 	const policy = POLICY_BY_ACTION[action];
 	switch (policy.kind) {
 		case "always": return true;

package/dist/audit/activity.d.ts

@@ -73,10 +73,10 @@ export declare const activityRowSchema: z.ZodObject<{
     details: z.ZodNullable<z.ZodUnknown>;
     requestId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     origin: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        agent: "agent";
         platform_proxy: "platform_proxy";
         admin_http: "admin_http";
         admin_cli: "admin_cli";
-        agent: "agent";
     }>>>;
 }, z.core.$strip>;
 export type ActivityRow = z.infer<typeof activityRowSchema>;
@@ -106,10 +106,10 @@ export declare const activityFilterSchema: z.ZodObject<{
         denied: "denied";
     }>>;
     origin: z.ZodOptional<z.ZodEnum<{
+        agent: "agent";
         platform_proxy: "platform_proxy";
         admin_http: "admin_http";
         admin_cli: "admin_cli";
-        agent: "agent";
     }>>;
     targetType: z.ZodOptional<z.ZodString>;
     targetId: z.ZodOptional<z.ZodString>;

package/dist/audit/retention-policy.js

@@ -13,6 +13,7 @@ import "../chunk-BTugEXQM.js";
 */
 const ACCESS_LOG_WARM_DAYS = {
 	"run.detail.read": 30,
+	"run.structured.read": 30,
 	"runs.list.read": 30,
 	"runs.filters.read": 30,
 	"sources.list.read": 30,
@@ -257,6 +258,7 @@ function secretAuditLogWarmSqlCase() {
 */
 const ACCESS_LOG_COLD_DAYS = {
 	"run.detail.read": 180,
+	"run.structured.read": 180,
 	"runs.list.read": 180,
 	"runs.filters.read": 180,
 	"sources.list.read": 180,

package/dist/environment/index.d.ts

@@ -1,4 +1,6 @@
 export type { Environment, EnvironmentBinding, EnvironmentVariable, EnvironmentSourceOverride, ScopedSecret, HeldRun, ProtectionGateResult, TrustTier, } from './types.js';
+export { TrustTierSchema } from './types.js';
 export { resolveSecretsForEnvironment, matchScopePattern, stripScopePrefix, } from './scope-resolver.js';
 export type { HostFacts } from './host-match.js';
+export { mergeOrderedMaps, EnvGateRejectReason } from './multi-env.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/environment/index.js

@@ -1,3 +1,5 @@
 import "../chunk-BTugEXQM.js";
+import { TrustTierSchema } from "./types.js";
 import { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix } from "./scope-resolver.js";
-export { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix };
+import { EnvGateRejectReason, mergeOrderedMaps } from "./multi-env.js";
+export { EnvGateRejectReason, TrustTierSchema, matchScopePattern, mergeOrderedMaps, resolveSecretsForEnvironment, stripScopePrefix };

package/dist/environment/multi-env.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Multi-environment merge helpers shared across the orchestrator dispatch path.
+ *
+ * A job may bind several deployment environments in order; their resolved
+ * secrets/variables are folded last-wins (a later environment's key overrides an
+ * earlier one) and their protection gates combine all-must-pass. This module is
+ * browser-safe (pure functions + a Zod enum, no Node built-ins) so it can be
+ * exported from the engine environment barrel.
+ */
+import { z } from 'zod';
+/**
+ * Reason a single bound environment rejects a run under all-must-pass
+ * aggregation. Used to name which environment and which rule blocked dispatch.
+ */
+export declare const EnvGateRejectReason: z.ZodEnum<{
+    branch_restricted: "branch_restricted";
+    trigger_filtered: "trigger_filtered";
+    repo_unmatched: "repo_unmatched";
+    trust_too_low: "trust_too_low";
+    env_disabled: "env_disabled";
+    env_not_found: "env_not_found";
+}>;
+export type EnvGateRejectReason = z.infer<typeof EnvGateRejectReason>;
+/**
+ * Fold an ordered list of per-environment resolved maps into one. Later entries
+ * override earlier keys (last-wins), matching the documented merge order for
+ * `environments: [...]`.
+ */
+export declare function mergeOrderedMaps(maps: ReadonlyArray<Record<string, string>>): Record<string, string>;
+//# sourceMappingURL=multi-env.d.ts.map

package/dist/environment/multi-env.js

@@ -0,0 +1,38 @@
+import "../chunk-BTugEXQM.js";
+import { z } from "zod";
+//#region src/environment/multi-env.ts
+/**
+* Multi-environment merge helpers shared across the orchestrator dispatch path.
+*
+* A job may bind several deployment environments in order; their resolved
+* secrets/variables are folded last-wins (a later environment's key overrides an
+* earlier one) and their protection gates combine all-must-pass. This module is
+* browser-safe (pure functions + a Zod enum, no Node built-ins) so it can be
+* exported from the engine environment barrel.
+*/
+/**
+* Reason a single bound environment rejects a run under all-must-pass
+* aggregation. Used to name which environment and which rule blocked dispatch.
+*/
+const EnvGateRejectReason = z.enum([
+	"branch_restricted",
+	"trigger_filtered",
+	"repo_unmatched",
+	"trust_too_low",
+	"env_disabled",
+	"env_not_found"
+]);
+/**
+* Fold an ordered list of per-environment resolved maps into one. Later entries
+* override earlier keys (last-wins), matching the documented merge order for
+* `environments: [...]`.
+*/
+function mergeOrderedMaps(maps) {
+	const out = {};
+	for (const m of maps) Object.assign(out, m);
+	return out;
+}
+//#endregion
+export { EnvGateRejectReason, mergeOrderedMaps };
+
+//# sourceMappingURL=multi-env.js.map

package/dist/environment/types.d.ts

@@ -4,6 +4,7 @@
  * Environments are org-level entities that group secrets, variables,
  * and protection rules for deployment targets (dev, staging, production).
  */
+import { z } from 'zod';
 import type { ApproverClause } from '../approval/types.js';
 /** Environment entity — org-level deployment target with protection rules. */
 export interface Environment {
@@ -79,8 +80,13 @@ export interface EnvironmentSourceOverride {
     createdAt: string;
     updatedAt: string;
 }
-/** Trust tier for contributor-based CI execution gating. */
-export type TrustTier = 'trusted' | 'known' | 'unknown';
+/** Trust tier for contributor-based CI execution gating (single source of truth). */
+export declare const TrustTierSchema: z.ZodEnum<{
+    unknown: "unknown";
+    known: "known";
+    trusted: "trusted";
+}>;
+export type TrustTier = z.infer<typeof TrustTierSchema>;
 /** Held run record for protection gate enforcement. */
 export interface HeldRun {
     id: string;

package/dist/environment/types.js

@@ -1,2 +1,19 @@
 import "../chunk-BTugEXQM.js";
-export {};
+import { z } from "zod";
+//#region src/environment/types.ts
+/**
+* Environment types for KiCI's deployment environment model.
+*
+* Environments are org-level entities that group secrets, variables,
+* and protection rules for deployment targets (dev, staging, production).
+*/
+/** Trust tier for contributor-based CI execution gating (single source of truth). */
+const TrustTierSchema = z.enum([
+	"trusted",
+	"known",
+	"unknown"
+]);
+//#endregion
+export { TrustTierSchema };
+
+//# sourceMappingURL=types.js.map

package/dist/index.d.ts

@@ -11,10 +11,13 @@
 export * from './protocol/version.js';
 export * from './protocol/messages/common.js';
 export * from './protocol/messages/actor.js';
+export * from './protocol/messages/pat-kind.js';
+export * from './mcp/tool-schemas.js';
 export * from './protocol/messages/auth.js';
 export * from './protocol/messages/capabilities.js';
 export { webhookRelaySchema, webhookRelayStartSchema, webhookRelayChunkSchema, webhookAckSchema, WebhookRelayResult, WEBHOOK_RELAY_MAX_BODY_BYTES, WEBHOOK_RELAY_CHUNK_SIZE, executionEventSchema, logChunkSchema, peerDiscoverSchema, peerUpdateSchema, cacheStatsSchema, orchMetricsSchema, platformToOrchestratorMessageSchema, orchestratorToPlatformMessageSchema, type WebhookRelay, type WebhookRelayStart, type WebhookRelayChunk, type WebhookAck, type LogChunk, type PeerDiscover, type PeerUpdate, type CacheStats, type OrchMetrics, trustPolicyUpdateSchema, type TrustPolicyUpdate, staleCheckrunCleanupSchema, type StaleCheckrunCleanup, type PlatformToOrchestratorMessage, type OrchestratorToPlatformMessage, } from './protocol/messages/platform-orchestrator.js';
 export * from './protocol/messages/execution-status.js';
+export * from './protocol/messages/agent-run-result.js';
 export * from './protocol/messages/deployment-identity.js';
 export * from './protocol/messages/scaler-event.js';
 export * from './protocol/messages/event-log.js';

package/dist/index.js

@@ -3,20 +3,24 @@ import { CheckMode, CheckStepOutcome } from "./check-mode.js";
 import { MIN_PROTOCOL_VERSION, PROTOCOL_VERSION } from "./protocol/version.js";
 import { WS_MAX_PAYLOAD_BYTES, ackSchema, errorSchema, heartbeatSchema, nackSchema } from "./protocol/messages/common.js";
 import { ActorType, actorPrincipalSchema, apiKeyActorSchema, flattenActor, parseActor, platformOperatorActorSchema, serviceAccountActorSchema, stringifyActor, systemActorSchema, userActorSchema } from "./protocol/messages/actor.js";
-import { ORCH_CAPABILITIES, OrchRole, hasOrchCapability, orchCapabilitiesSchema } from "./protocol/messages/capabilities.js";
-import { authFailureSchema, authRequestSchema, authSuccessSchema } from "./protocol/messages/auth.js";
-import { CacheOutcome, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema } from "./protocol/messages/execution-status.js";
-import { DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema } from "./protocol/messages/deployment-identity.js";
-import { SourceProvider, SourceSubtype, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema } from "./protocol/messages/source-registration.js";
+import { PatKind } from "./protocol/messages/pat-kind.js";
+import { cancelRunToolSchema, getRunToolSchema, getStepLogsToolSchema, listRunsToolSchema, listWorkflowsToolSchema, rerunRunToolSchema, triggerRunToolSchema } from "./mcp/tool-schemas.js";
+import { CacheOutcome, CacheRunEventType, CacheStepType, ENVIRONMENTS_MAX, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, MAX_JOBS_PER_RUN, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, STATE_REPLAY_MAX_RUNS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema } from "./protocol/messages/execution-status.js";
+import { TrustTierSchema } from "./environment/types.js";
+import { AgentFailureCategory, agentJobResultSchema, agentRunResultSchema, agentStepLogsSchema, agentStepResultSchema, untrusted, wrapUntrusted } from "./protocol/messages/agent-run-result.js";
 import { AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, accessLogFilterSchema, accessLogItemSchema, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema } from "./protocol/messages/access-log.js";
 import { browserJobContextSchema, browserRunEventSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, jobContextMessageSchema, runEventMessageSchema } from "./protocol/messages/run-events.js";
 import { EventLogSource, EventLogStatus, PayloadOmittedReason } from "./protocol/messages/event-log.js";
+import { DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema } from "./protocol/messages/deployment-identity.js";
+import { SourceProvider, SourceSubtype, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema } from "./protocol/messages/source-registration.js";
 import { ScalerBackendType } from "./scaler/scaler-backend-type.js";
 import { ApprovalDecision, HoldScope, TriggerSource, approvalRequirementSchema, approverClauseSchema } from "./approval/types.js";
-import { NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, resolveWhenToRunOn } from "./trigger/types.js";
+import { NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, resolveWhenToRunOn } from "./trigger/types.js";
 import { HostTargetSelector, HostTargetValue, LabelMatcher, compileRegexMatcher, hostSatisfiesTarget, matcherMatches, matcherSatisfiedBy, partitionMatchers } from "./labels-match.js";
 import { HostInventoryEntry, HostPropertyValue, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, coerceHostPropertyValue, parseHostPropertyAssignments } from "./inventory.js";
-import { EnvDeleteErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListItemSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingEntrySchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
+import { DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EnvDeleteErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingEntrySchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
+import { ORCH_CAPABILITIES, OrchRole, hasOrchCapability, orchCapabilitiesSchema } from "./protocol/messages/capabilities.js";
+import { authFailureSchema, authRequestSchema, authSuccessSchema } from "./protocol/messages/auth.js";
 import { WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, cacheStatsSchema, executionEventSchema, logChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema } from "./protocol/messages/platform-orchestrator.js";
 import { ScalerEventType } from "./protocol/messages/scaler-event.js";
 import { AccessLogPolicyKind, POLICY_BY_ACTION, fnv1a32, shouldRecordAccess, shouldRecordSecretResolve } from "./audit/access-log-policy.js";
@@ -35,6 +39,7 @@ import { DispatchInputType, InputDescriptor, InputsDescriptorMapSchema } from ".
 import { UnsupportedDispatchInputError, extractInputDescriptor, extractInputsDescriptorMap } from "./inputs/extract.js";
 import { buildZodFromDescriptor, buildZodObjectFromMap } from "./inputs/build.js";
 import { DispatchInputError, coerceDispatchInputs, parseInputPairs } from "./inputs/coerce.js";
+import { assertScheduleInputsSatisfiable, isInputSatisfiableFromDefaults, resolveScheduleInputs } from "./inputs/schedule.js";
 import "./inputs/index.js";
 import { isTerminal, transition } from "./state-machine/machine.js";
 import "./state-machine/index.js";
@@ -47,6 +52,7 @@ import { WsRateLimiter } from "./ws/rate-limiter.js";
 import { AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, KICI_AGENT_ENV_PREFIX, SANDBOX_DEFAULT_VARS } from "./env/environment-allowlist.js";
 import "./secrets/index.js";
 import { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix } from "./environment/scope-resolver.js";
+import { EnvGateRejectReason, mergeOrderedMaps } from "./environment/multi-env.js";
 import "./environment/index.js";
 import { CAPABILITY_LABEL_PREFIX, HOST_LABEL_PREFIX, INIT_LABEL, KNOWN_ROLES, PRIVILEGED_ROOT_LABEL, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, agentTypeLabel, capabilityLabel, deriveOsArchLabels, hostLabel, isSelfReportedLabel, mergeAutoLabels, normalizeRunsOn, parseHostLabel, resolveRoleLabels, scalerAgentLabels, scalerLabel, validateNoReservedLabels } from "./labels.js";
 import { parseMemoryString, resourceRequestNestedSchema, resourceSpecSchema, validateResourceRequest } from "./scaler/resource-types.js";
@@ -56,4 +62,4 @@ import "./bundler/index.js";
 import { applyIncludeExclude, expandMatrix, expandMultiDimension, expandSingleDimension } from "./matrix/expand.js";
 import { formatExpandedJobName, formatMatrixSuffix } from "./matrix/format.js";
 import { FanoutCause, FanoutError, MAX_FANOUT_JOBS, VariantKind, fanoutEnvelopeFields, hostEnvelopeFields, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields } from "./fanout/materialize.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, ApprovalDecision, CAPABILITY_LABEL_PREFIX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, INIT_LABEL, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, MAX_FANOUT_JOBS, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_CAPABILITIES, OnUnreachableMode, OrchRole, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, RunsOnPick, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, StepApprovalOutcome, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TestRelayType, TimeoutReason, TriggerSource, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approverClauseSchema, attestationListItemSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, capabilityLabel, coerceDispatchInputs, coerceHostPropertyValue, compileRegexMatcher, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, envBindingEntrySchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, githubWebhookPath, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentFailureCategory, ApprovalDecision, CAPABILITY_LABEL_PREFIX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, ENVIRONMENTS_MAX, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EnvGateRejectReason, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, INIT_LABEL, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_CAPABILITIES, OnUnreachableMode, OrchRole, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PatKind, PayloadOmittedReason, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RegisterableTriggerType, RunsOnPick, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, StepApprovalOutcome, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TestRelayType, TimeoutReason, TriggerSource, TrustTierSchema, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentJobResultSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentRunResultSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approverClauseSchema, assertScheduleInputsSatisfiable, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, capabilityLabel, coerceDispatchInputs, coerceHostPropertyValue, compileRegexMatcher, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, envBindingEntrySchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubWebhookPath, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isInputSatisfiableFromDefaults, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, listRunsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rerunRunToolSchema, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForEnvironment, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, transition, triggerRunToolSchema, trustPolicyResponseSchema, trustPolicyUpdateSchema, untrusted, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, wrapUntrusted };

package/dist/inputs/index.d.ts

@@ -2,4 +2,5 @@ export * from './descriptor.js';
 export * from './extract.js';
 export * from './build.js';
 export * from './coerce.js';
+export * from './schedule.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/inputs/index.js

@@ -3,4 +3,5 @@ import { DispatchInputType, InputDescriptor, InputsDescriptorMapSchema } from ".
 import { UnsupportedDispatchInputError, extractInputDescriptor, extractInputsDescriptorMap } from "./extract.js";
 import { buildZodFromDescriptor, buildZodObjectFromMap } from "./build.js";
 import { DispatchInputError, coerceDispatchInputs, parseInputPairs } from "./coerce.js";
-export { DispatchInputError, DispatchInputType, InputDescriptor, InputsDescriptorMapSchema, UnsupportedDispatchInputError, buildZodFromDescriptor, buildZodObjectFromMap, coerceDispatchInputs, extractInputDescriptor, extractInputsDescriptorMap, parseInputPairs };
+import { assertScheduleInputsSatisfiable, isInputSatisfiableFromDefaults, resolveScheduleInputs } from "./schedule.js";
+export { DispatchInputError, DispatchInputType, InputDescriptor, InputsDescriptorMapSchema, UnsupportedDispatchInputError, assertScheduleInputsSatisfiable, buildZodFromDescriptor, buildZodObjectFromMap, coerceDispatchInputs, extractInputDescriptor, extractInputsDescriptorMap, isInputSatisfiableFromDefaults, parseInputPairs, resolveScheduleInputs };

package/dist/inputs/schedule.d.ts

@@ -0,0 +1,19 @@
+import type { InputDescriptorT, InputsDescriptorMap } from './descriptor.js';
+/**
+ * A schedule input resolves with no operator value, so it must be satisfiable
+ * from an empty value set: it either declares a default or is optional. Bare
+ * required and bare nullable inputs are not satisfiable (Zod still requires the
+ * key to be present).
+ */
+export declare function isInputSatisfiableFromDefaults(d: InputDescriptorT): boolean;
+/** Throw naming the first schedule input that can never resolve on a fire. */
+export declare function assertScheduleInputsSatisfiable(map: InputsDescriptorMap): void;
+/**
+ * Resolve defaults-only schedule inputs (no operator pairs). Returns undefined
+ * when the trigger declares no inputs or nothing resolves to a value. Throws
+ * `DispatchInputError` on an invalid descriptor — compile-time validation
+ * (`assertScheduleInputsSatisfiable`) makes this unreachable for a
+ * freshly-compiled lock; no silent fallback.
+ */
+export declare function resolveScheduleInputs(map: InputsDescriptorMap | undefined): Record<string, unknown> | undefined;
+//# sourceMappingURL=schedule.d.ts.map

package/dist/inputs/schedule.js

@@ -0,0 +1,33 @@
+import "../chunk-BTugEXQM.js";
+import { coerceDispatchInputs } from "./coerce.js";
+//#region src/inputs/schedule.ts
+/**
+* A schedule input resolves with no operator value, so it must be satisfiable
+* from an empty value set: it either declares a default or is optional. Bare
+* required and bare nullable inputs are not satisfiable (Zod still requires the
+* key to be present).
+*/
+function isInputSatisfiableFromDefaults(d) {
+	return d.default !== void 0 || d.optional === true;
+}
+/** Throw naming the first schedule input that can never resolve on a fire. */
+function assertScheduleInputsSatisfiable(map) {
+	for (const [name, d] of Object.entries(map)) if (!isInputSatisfiableFromDefaults(d)) throw new Error(`schedule input "${name}" must declare a .default() or be .optional() — schedule triggers fire with no operator input`);
+}
+/**
+* Resolve defaults-only schedule inputs (no operator pairs). Returns undefined
+* when the trigger declares no inputs or nothing resolves to a value. Throws
+* `DispatchInputError` on an invalid descriptor — compile-time validation
+* (`assertScheduleInputsSatisfiable`) makes this unreachable for a
+* freshly-compiled lock; no silent fallback.
+*/
+function resolveScheduleInputs(map) {
+	if (!map || Object.keys(map).length === 0) return void 0;
+	const r = coerceDispatchInputs({}, map);
+	if ("error" in r) throw r.error;
+	return Object.keys(r.values).length > 0 ? r.values : void 0;
+}
+//#endregion
+export { assertScheduleInputsSatisfiable, isInputSatisfiableFromDefaults, resolveScheduleInputs };
+
+//# sourceMappingURL=schedule.js.map

package/dist/mcp/tool-schemas.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Zod argument schemas for the KiCI MCP tools.
+ *
+ * Browser-safe (zod only) and shared between the Platform-hosted developer MCP
+ * and the sibling orchestrator-side admin MCP so both expose an identical tool
+ * argument contract. Each export is a Zod *raw shape* (a plain object of Zod
+ * fields) so it can be passed directly as an MCP tool `inputSchema`.
+ */
+import { z } from 'zod';
+export declare const listRunsToolSchema: {
+    orgId: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodNumber>;
+};
+export declare const getRunToolSchema: {
+    orgId: z.ZodOptional<z.ZodString>;
+    runId: z.ZodString;
+};
+export declare const getStepLogsToolSchema: {
+    orgId: z.ZodOptional<z.ZodString>;
+    runId: z.ZodString;
+    jobId: z.ZodString;
+    stepIndex: z.ZodNumber;
+};
+export declare const listWorkflowsToolSchema: {
+    orgId: z.ZodOptional<z.ZodString>;
+};
+export declare const cancelRunToolSchema: {
+    orgId: z.ZodOptional<z.ZodString>;
+    runId: z.ZodString;
+    force: z.ZodOptional<z.ZodBoolean>;
+};
+export declare const rerunRunToolSchema: {
+    orgId: z.ZodOptional<z.ZodString>;
+    runId: z.ZodString;
+};
+export declare const triggerRunToolSchema: {
+    orgId: z.ZodOptional<z.ZodString>;
+    registrationId: z.ZodString;
+};
+//# sourceMappingURL=tool-schemas.d.ts.map

package/dist/mcp/tool-schemas.js

@@ -0,0 +1,49 @@
+import "../chunk-BTugEXQM.js";
+import { z } from "zod";
+//#region src/mcp/tool-schemas.ts
+/**
+* Zod argument schemas for the KiCI MCP tools.
+*
+* Browser-safe (zod only) and shared between the Platform-hosted developer MCP
+* and the sibling orchestrator-side admin MCP so both expose an identical tool
+* argument contract. Each export is a Zod *raw shape* (a plain object of Zod
+* fields) so it can be passed directly as an MCP tool `inputSchema`.
+*/
+/**
+* Optional organization id. When the calling user belongs to exactly one org
+* it is resolved automatically; pass it explicitly when a member of several.
+*/
+const orgIdArg = z.string().min(1).optional().describe("Organization id. Optional when you belong to exactly one organization.");
+const listRunsToolSchema = {
+	orgId: orgIdArg,
+	status: z.string().optional().describe("Filter by run status (e.g. success, failed, running)."),
+	limit: z.number().int().min(1).max(100).optional().describe("Maximum number of runs to return (default 20).")
+};
+const getRunToolSchema = {
+	orgId: orgIdArg,
+	runId: z.string().min(1).describe("The run id to fetch.")
+};
+const getStepLogsToolSchema = {
+	orgId: orgIdArg,
+	runId: z.string().min(1).describe("The run id."),
+	jobId: z.string().min(1).describe("The job id within the run."),
+	stepIndex: z.number().int().min(0).describe("Zero-based step index within the job.")
+};
+const listWorkflowsToolSchema = { orgId: orgIdArg };
+const cancelRunToolSchema = {
+	orgId: orgIdArg,
+	runId: z.string().min(1).describe("The run id to cancel."),
+	force: z.boolean().optional().describe("Force-cancel (SIGKILL, skip cleanup hooks).")
+};
+const rerunRunToolSchema = {
+	orgId: orgIdArg,
+	runId: z.string().min(1).describe("The run id to re-run.")
+};
+const triggerRunToolSchema = {
+	orgId: orgIdArg,
+	registrationId: z.string().min(1).describe("The workflow registration id to trigger.")
+};
+//#endregion
+export { cancelRunToolSchema, getRunToolSchema, getStepLogsToolSchema, listRunsToolSchema, listWorkflowsToolSchema, rerunRunToolSchema, triggerRunToolSchema };
+
+//# sourceMappingURL=tool-schemas.js.map

package/dist/metrics/metric-catalog.generated.d.ts

@@ -86,13 +86,17 @@ export declare const MetricNames: {
     readonly KICI_PLATFORM_LOG_LINES_FORWARDED_TOTAL: "kici_platform_log_lines_forwarded_total";
     readonly KICI_PLATFORM_METRICS_QUERY_RATE_LIMITED_TOTAL: "kici_platform_metrics_query_rate_limited_total";
     readonly KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: "kici_platform_mimir_relay_errors_total";
+    readonly KICI_PLATFORM_NOTIFICATIONS_DELIVERED_TOTAL: "kici_platform_notifications_delivered_total";
+    readonly KICI_PLATFORM_NOTIFICATIONS_SUPPRESSED_TOTAL: "kici_platform_notifications_suppressed_total";
     readonly KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: "kici_platform_orch_metrics_filtered_total";
     readonly KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: "kici_platform_orphan_connections_swept_total";
     readonly KICI_PLATFORM_PG_POOL_CLIENT_ERRORS_TOTAL: "kici_platform_pg_pool_client_errors_total";
+    readonly KICI_PLATFORM_PLAN_CAP_CHECK_ERRORS_TOTAL: "kici_platform_plan_cap_check_errors_total";
     readonly KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: "kici_platform_stale_orchestrators_total";
     readonly KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: "kici_platform_stale_platform_connections_evicted_total";
     readonly KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: "kici_platform_stale_runs_failed_total";
     readonly KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "kici_platform_step_status_forwards_total";
+    readonly KICI_PLATFORM_WS_ORG_RATE_LIMITED_TOTAL: "kici_platform_ws_org_rate_limited_total";
     readonly KICI_REGISTRATIONS_TOTAL: "kici_registrations_total";
     readonly KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "kici_universal_git_registration_errors_total";
     readonly KICI_USER_REGISTRATION_NOTIFY_TOTAL: "kici_user_registration_notify_total";
@@ -222,13 +226,17 @@ export declare const MetricLabels: {
     readonly KICI_PLATFORM_LOG_LINES_FORWARDED_TOTAL: readonly [];
     readonly KICI_PLATFORM_METRICS_QUERY_RATE_LIMITED_TOTAL: readonly ["org_id"];
     readonly KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: readonly ["reason"];
+    readonly KICI_PLATFORM_NOTIFICATIONS_DELIVERED_TOTAL: readonly ["channel_type", "result"];
+    readonly KICI_PLATFORM_NOTIFICATIONS_SUPPRESSED_TOTAL: readonly ["org_id"];
     readonly KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: readonly ["reason", "metric"];
     readonly KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: readonly [];
     readonly KICI_PLATFORM_PG_POOL_CLIENT_ERRORS_TOTAL: readonly ["source"];
+    readonly KICI_PLATFORM_PLAN_CAP_CHECK_ERRORS_TOTAL: readonly ["org_id"];
     readonly KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: readonly [];
     readonly KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: readonly ["org_id"];
     readonly KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: readonly [];
     readonly KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: readonly ["state"];
+    readonly KICI_PLATFORM_WS_ORG_RATE_LIMITED_TOTAL: readonly ["org_id"];
     readonly KICI_REGISTRATIONS_TOTAL: readonly [];
     readonly KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: readonly ["reason"];
     readonly KICI_USER_REGISTRATION_NOTIFY_TOTAL: readonly ["result"];
@@ -357,13 +365,17 @@ export declare const MetricKind: {
     readonly KICI_PLATFORM_LOG_LINES_FORWARDED_TOTAL: "counter";
     readonly KICI_PLATFORM_METRICS_QUERY_RATE_LIMITED_TOTAL: "counter";
     readonly KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: "counter";
+    readonly KICI_PLATFORM_NOTIFICATIONS_DELIVERED_TOTAL: "counter";
+    readonly KICI_PLATFORM_NOTIFICATIONS_SUPPRESSED_TOTAL: "counter";
     readonly KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: "counter";
     readonly KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: "counter";
     readonly KICI_PLATFORM_PG_POOL_CLIENT_ERRORS_TOTAL: "counter";
+    readonly KICI_PLATFORM_PLAN_CAP_CHECK_ERRORS_TOTAL: "counter";
     readonly KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: "counter";
     readonly KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: "counter";
     readonly KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: "counter";
     readonly KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "counter";
+    readonly KICI_PLATFORM_WS_ORG_RATE_LIMITED_TOTAL: "counter";
     readonly KICI_REGISTRATIONS_TOTAL: "counter";
     readonly KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "counter";
     readonly KICI_USER_REGISTRATION_NOTIFY_TOTAL: "counter";
@@ -492,13 +504,17 @@ export declare const MetricDescription: {
     readonly KICI_PLATFORM_LOG_LINES_FORWARDED_TOTAL: "Total log lines forwarded from orchestrators";
     readonly KICI_PLATFORM_METRICS_QUERY_RATE_LIMITED_TOTAL: "Total dashboard metric-query requests rate-limited (429).";
     readonly KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: "Total Mimir push-relay errors (Platform-embedded metrics). Labels: reason.";
+    readonly KICI_PLATFORM_NOTIFICATIONS_DELIVERED_TOTAL: "Notification delivery attempts that reached a terminal outcome";
+    readonly KICI_PLATFORM_NOTIFICATIONS_SUPPRESSED_TOTAL: "Run-terminal notifications suppressed by the per-org notification quota";
     readonly KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: "Orchestrator-pushed metric data points dropped or rewritten by the catalog allow-list. Labels: reason, metric.";
     readonly KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: "Total orphan connections swept from platform_connections";
     readonly KICI_PLATFORM_PG_POOL_CLIENT_ERRORS_TOTAL: "Total pg connection errors absorbed without a process restart";
+    readonly KICI_PLATFORM_PLAN_CAP_CHECK_ERRORS_TOTAL: "WS connection rejected because the plan-limit check errored (fail-closed)";
     readonly KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: "Total orchestrators detected as permanently disconnected";
     readonly KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: "platform_connections rows evicted by source.register DB dedup (same-instance reconnect path)";
     readonly KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: "Total execution runs failed due to orchestrator staleness";
     readonly KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "Total step status forwards received";
+    readonly KICI_PLATFORM_WS_ORG_RATE_LIMITED_TOTAL: "Inbound orchestrator messages dropped by the per-org aggregate WS rate limit";
     readonly KICI_REGISTRATIONS_TOTAL: "Total user registrations (new personal orgs created on first login)";
     readonly KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "Errors encountered while registering universal-git provider bundles";
     readonly KICI_USER_REGISTRATION_NOTIFY_TOTAL: "New-user Telegram notifications by result (sent|failed)";
@@ -634,13 +650,17 @@ export declare const MetricService: {
     readonly KICI_PLATFORM_LOG_LINES_FORWARDED_TOTAL: "platform";
     readonly KICI_PLATFORM_METRICS_QUERY_RATE_LIMITED_TOTAL: "platform";
     readonly KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: "platform";
+    readonly KICI_PLATFORM_NOTIFICATIONS_DELIVERED_TOTAL: "platform";
+    readonly KICI_PLATFORM_NOTIFICATIONS_SUPPRESSED_TOTAL: "platform";
     readonly KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: "platform";
     readonly KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: "platform";
     readonly KICI_PLATFORM_PG_POOL_CLIENT_ERRORS_TOTAL: "platform";
+    readonly KICI_PLATFORM_PLAN_CAP_CHECK_ERRORS_TOTAL: "platform";
     readonly KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: "platform";
     readonly KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: "platform";
     readonly KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: "platform";
     readonly KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "platform";
+    readonly KICI_PLATFORM_WS_ORG_RATE_LIMITED_TOTAL: "platform";
     readonly KICI_REGISTRATIONS_TOTAL: "platform";
     readonly KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "orchestrator";
     readonly KICI_USER_REGISTRATION_NOTIFY_TOTAL: "platform";