@kici-dev/engine 0.1.23 → 0.1.25

package/dist/approval/types.d.ts

@@ -21,9 +21,9 @@ export declare const approverClauseSchema: z.ZodUnion<readonly [z.ZodObject<{
 export type ApproverClause = z.infer<typeof approverClauseSchema>;
 /** Granularity of a held element. */
 export declare const HoldScope: z.ZodEnum<{
+    workflow: "workflow";
     job: "job";
     step: "step";
-    workflow: "workflow";
 }>;
 export type HoldScope = z.infer<typeof HoldScope>;
 /** What triggered the hold: an environment policy (mandatory) or SDK code (explicit). */

package/dist/approval/types.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/approval/types.ts
 /**

package/dist/audit/access-log-policy.d.ts

@@ -11,7 +11,10 @@
  * 1. `outcome !== 'allowed'` → always record (denied/error are full-fidelity).
  * 2. `actor.type === 'platform_operator'` → always record (compliance: any
  *    activity by a non-org member must be auditable in full).
- * 3. The per-action `POLICY_BY_ACTION` decision (`always` / `sample` /
+ * 3. agent-attributed actor (`actor.agent` present) → always record. The
+ *    agent-provenance guarantee is that every action an agent takes is fully
+ *    auditable; a sampled subset would break it.
+ * 4. The per-action `POLICY_BY_ACTION` decision (`always` / `sample` /
  *    `rate_limit`).
  *
  * Browser-safe: this module MUST NOT import any Node built-ins (`node:crypto`

package/dist/audit/access-log-policy.js

@@ -1,4 +1,5 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
+import { agentLabelOf } from "../protocol/messages/actor.js";
 import { z } from "zod";
 //#region src/audit/access-log-policy.ts
 /**
@@ -14,7 +15,10 @@ import { z } from "zod";
 * 1. `outcome !== 'allowed'` → always record (denied/error are full-fidelity).
 * 2. `actor.type === 'platform_operator'` → always record (compliance: any
 *    activity by a non-org member must be auditable in full).
-* 3. The per-action `POLICY_BY_ACTION` decision (`always` / `sample` /
+* 3. agent-attributed actor (`actor.agent` present) → always record. The
+*    agent-provenance guarantee is that every action an agent takes is fully
+*    auditable; a sampled subset would break it.
+* 4. The per-action `POLICY_BY_ACTION` decision (`always` / `sample` /
 *    `rate_limit`).
 *
 * Browser-safe: this module MUST NOT import any Node built-ins (`node:crypto`
@@ -38,6 +42,10 @@ const POLICY_BY_ACTION = {
 		kind: "sample",
 		allowedRate: .05
 	},
+	"run.structured.read": {
+		kind: "sample",
+		allowedRate: .05
+	},
 	"runs.list.read": {
 		kind: "sample",
 		allowedRate: .05
@@ -206,6 +214,7 @@ function actorKey(actor) {
 function shouldRecordAccess(action, outcome, actor, requestId, limiter) {
 	if (outcome !== "allowed") return true;
 	if (actor.type === "platform_operator") return true;
+	if (agentLabelOf(actor) !== null) return true;
 	const policy = POLICY_BY_ACTION[action];
 	switch (policy.kind) {
 		case "always": return true;

package/dist/audit/activity.d.ts

@@ -73,10 +73,10 @@ export declare const activityRowSchema: z.ZodObject<{
     details: z.ZodNullable<z.ZodUnknown>;
     requestId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     origin: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        agent: "agent";
         platform_proxy: "platform_proxy";
         admin_http: "admin_http";
         admin_cli: "admin_cli";
-        agent: "agent";
     }>>>;
 }, z.core.$strip>;
 export type ActivityRow = z.infer<typeof activityRowSchema>;
@@ -106,15 +106,17 @@ export declare const activityFilterSchema: z.ZodObject<{
         denied: "denied";
     }>>;
     origin: z.ZodOptional<z.ZodEnum<{
+        agent: "agent";
         platform_proxy: "platform_proxy";
         admin_http: "admin_http";
         admin_cli: "admin_cli";
-        agent: "agent";
     }>>;
     targetType: z.ZodOptional<z.ZodString>;
     targetId: z.ZodOptional<z.ZodString>;
     runId: z.ZodOptional<z.ZodString>;
     q: z.ZodOptional<z.ZodString>;
+    agentLabel: z.ZodOptional<z.ZodString>;
+    agentOnly: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodCodec<z.ZodString, z.ZodBoolean>]>>;
     from: z.ZodOptional<z.ZodString>;
     to: z.ZodOptional<z.ZodString>;
     cursor: z.ZodOptional<z.ZodString>;

package/dist/audit/activity.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { ActorType } from "../protocol/messages/actor.js";
 import { AccessLogOutcome, AccessLogSource } from "../protocol/messages/access-log.js";
 import { z } from "zod";
@@ -97,6 +97,20 @@ const activityFilterSchema = z.object({
 	runId: z.string().optional(),
 	/** Full-text search over access_log.error_message and audit_log.details::text. */
 	q: z.string().optional(),
+	/**
+	* Exact-match filter on the agent provenance label. Only the access_log half
+	* of the federation carries an agent label, so an agent filter restricts the
+	* stream to agent-attributed access-log rows.
+	*/
+	agentLabel: z.string().max(255).optional(),
+	/**
+	* When true, return only agent-attributed rows (access_log `agent_label IS NOT NULL`).
+	* Arrives as a query string (`?agentOnly=false`), so parse it with `z.stringbool()`
+	* — NOT `z.coerce.boolean()`, whose `z.coerce.boolean('false') === true` is a
+	* confirmed footgun. The `z.boolean()` arm keeps a native boolean acceptable for
+	* programmatic callers (mirrors how `limit` tolerates both a number and a string).
+	*/
+	agentOnly: z.union([z.boolean(), z.stringbool()]).optional(),
 	/** ISO timestamp lower bound (inclusive). */
 	from: z.string().optional(),
 	/** ISO timestamp upper bound (exclusive). */

package/dist/audit/retention-policy.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/audit/retention-policy.ts
 /**
 * Warm-retention days per `AccessLogAction`. Exhaustive over the enum so a
@@ -13,6 +13,7 @@ import "../chunk-BTugEXQM.js";
 */
 const ACCESS_LOG_WARM_DAYS = {
 	"run.detail.read": 30,
+	"run.structured.read": 30,
 	"runs.list.read": 30,
 	"runs.filters.read": 30,
 	"sources.list.read": 30,
@@ -117,7 +118,7 @@ const COMPLIANCE_AUDIT_PREFIXES = [
 	"platform-admin.",
 	"support-read."
 ];
-const COMPLIANCE_AUDIT_EXACT = new Set([
+const COMPLIANCE_AUDIT_EXACT = /* @__PURE__ */ new Set([
 	"archive_chunk",
 	"purge_chunk",
 	"replay_chunk",
@@ -144,7 +145,7 @@ function getAuditLogWarmDays(args) {
 * promotes to 180 days. There is no `actor_type` column on this table, so
 * the platform_operator override does not apply.
 */
-const SAMPLED_RESOLVE_ACTIONS = new Set(["resolve", "resolve_named"]);
+const SAMPLED_RESOLVE_ACTIONS = /* @__PURE__ */ new Set(["resolve", "resolve_named"]);
 function secretAuditLogWarmDays(action) {
 	if (SAMPLED_RESOLVE_ACTIONS.has(action)) return 30;
 	return 365;
@@ -257,6 +258,7 @@ function secretAuditLogWarmSqlCase() {
 */
 const ACCESS_LOG_COLD_DAYS = {
 	"run.detail.read": 180,
+	"run.structured.read": 180,
 	"runs.list.read": 180,
 	"runs.filters.read": 180,
 	"sources.list.read": 180,

package/dist/bundler/index.js

@@ -1,3 +1,3 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { createWorkflowBundleConfig } from "./rolldown-config.js";
 export { createWorkflowBundleConfig };

package/dist/bundler/rolldown-config.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/bundler/rolldown-config.ts
 /**
 * Create a rolldown configuration for workflow bundling.

package/dist/check-mode.js

@@ -1,4 +1,4 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/check-mode.ts
 /**

package/dist/dev-ops/operations.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The developer-operations API contract. One row per workflow-developer-core
+ * operation, declaring which entrypoints expose it — HTTP (the shared REST API
+ * behind both the web UI and the `kici` CLI), MCP (the agent tool surface), and
+ * a curated UI flag. The congruence tests assert each entrypoint's real surface
+ * matches this registry, so a new route / CLI command / MCP tool that drifts
+ * from the contract fails the build.
+ *
+ * Three row states, one honest ledger:
+ *
+ * - **Live everywhere it should be** — `entrypoints.mcp: true` with `mcpTool`
+ *   set. The registered developer MCP tools land here; their booleans mirror the
+ *   actual current surface so every harness passes on landing.
+ * - **Planned MCP tool** — `mcpAppropriate: true` but `entrypoints.mcp: false`,
+ *   `mcpTool: null`. An agent-appropriate op that exists in HTTP/CLI but is not
+ *   yet an MCP tool. The consistency test permits this (`mcp ⟹ mcpAppropriate`,
+ *   not the converse), so the row is a visible, testable to-do.
+ * - **Never an MCP tool** — `mcpAppropriate: false`, `entrypoints.mcp: false`.
+ *   Secret-value writes and destructive deletes: agent safety encoded in data.
+ *
+ * Browser-safe: data + TypeScript types only, no Node imports, so it lives in
+ * the engine barrel importable by the web UI, the CLI, and the Platform.
+ */
+export type DeveloperOpDomain = 'runs' | 'workflows' | 'environments' | 'secrets' | 'held-runs' | 'diagnostics' | 'orchestrators' | 'sources' | 'dlq' | 'attestations' | 'activity' | 'orgs';
+export type DeveloperOpKind = 'read' | 'write';
+/** Which of the three entrypoints a developer op is (or should be) exposed on. */
+export interface DeveloperOpEntrypoints {
+    /** The shared Platform REST API (backs both the web UI and the `kici` CLI). */
+    http: boolean;
+    /** The `kici` CLI command tree. */
+    cli: boolean;
+    /** The developer MCP tool surface. */
+    mcp: boolean;
+    /** Curated: the op has a dashboard affordance (not machine-introspectable). */
+    ui: boolean;
+}
+export interface DeveloperOperation {
+    /** Stable id, e.g. 'runs.list', 'held-runs.approve'. Unique across the table. */
+    id: string;
+    domain: DeveloperOpDomain;
+    kind: DeveloperOpKind;
+    /** Intended entrypoint coverage — the contract the harness enforces. */
+    entrypoints: DeveloperOpEntrypoints;
+    /** False ⇒ never an MCP tool (secret-value write, destructive delete). */
+    mcpAppropriate: boolean;
+    /** MCP tool name when `entrypoints.mcp` is true; null otherwise. */
+    mcpTool: string | null;
+}
+/**
+ * The workflow-developer core. Developer plane only — org-membership-scoped,
+ * agent-attributed; never orchestrator-admin or tenant control-plane territory.
+ */
+export declare const DEVELOPER_OPERATIONS: readonly DeveloperOperation[];
+/** All ops a given entrypoint should expose. */
+export declare function developerOpsForEntrypoint(ep: keyof DeveloperOpEntrypoints): DeveloperOperation[];
+//# sourceMappingURL=operations.d.ts.map

package/dist/dev-ops/operations.js

@@ -0,0 +1,135 @@
+import "../rolldown-runtime-ClRpJifh.js";
+//#region src/dev-ops/operations.ts
+/** Build a row, defaulting every unspecified entrypoint to false. */
+function op(id, domain, kind, ep, mcpAppropriate, mcpTool) {
+	return {
+		id,
+		domain,
+		kind,
+		entrypoints: {
+			http: false,
+			cli: false,
+			mcp: false,
+			ui: false,
+			...ep
+		},
+		mcpAppropriate,
+		mcpTool
+	};
+}
+/**
+* The workflow-developer core. Developer plane only — org-membership-scoped,
+* agent-attributed; never orchestrator-admin or tenant control-plane territory.
+*/
+const DEVELOPER_OPERATIONS = [
+	op("runs.list", "runs", "read", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "list_runs"),
+	op("runs.get", "runs", "read", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "get_run"),
+	op("runs.stepLogs", "runs", "read", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "get_step_logs"),
+	op("runs.cancel", "runs", "write", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "cancel_run"),
+	op("runs.cancelByBranch", "runs", "write", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: false
+	}, true, "cancel_runs_by_branch"),
+	op("runs.rerun", "runs", "write", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "rerun_run"),
+	op("workflows.list", "workflows", "read", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "list_workflows"),
+	op("workflows.trigger", "workflows", "write", {
+		http: true,
+		cli: false,
+		mcp: true,
+		ui: true
+	}, true, "trigger_run"),
+	op("secrets.list", "secrets", "read", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "list_secrets"),
+	op("secrets.set", "secrets", "write", {
+		http: true,
+		cli: false,
+		mcp: false,
+		ui: true
+	}, false, null),
+	op("secrets.delete", "secrets", "write", {
+		http: true,
+		cli: false,
+		mcp: false,
+		ui: true
+	}, false, null),
+	op("environments.delete", "environments", "write", {
+		http: true,
+		cli: false,
+		mcp: false,
+		ui: true
+	}, false, null),
+	op("held-runs.approve", "held-runs", "write", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "approve_run"),
+	op("held-runs.reject", "held-runs", "write", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "reject_run"),
+	op("diagnostics.get", "diagnostics", "read", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "get_diagnostics"),
+	op("orchestrators.list", "orchestrators", "read", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "list_orchestrators"),
+	op("orgs.list", "orgs", "read", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "list_orgs")
+];
+/** All ops a given entrypoint should expose. */
+function developerOpsForEntrypoint(ep) {
+	return DEVELOPER_OPERATIONS.filter((o) => o.entrypoints[ep]);
+}
+//#endregion
+export { DEVELOPER_OPERATIONS, developerOpsForEntrypoint };
+
+//# sourceMappingURL=operations.js.map

package/dist/env/environment-allowlist.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/env/environment-allowlist.ts
 /**
 * Shared environment allowlist constants for KiCI.

package/dist/environment/host-match.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { matcherMatches } from "../labels-match.js";
 import { assertSafeRegex, toLabelMatcher } from "../labels/compile.js";
 //#region src/environment/host-match.ts

package/dist/environment/index.d.ts

@@ -1,4 +1,6 @@
 export type { Environment, EnvironmentBinding, EnvironmentVariable, EnvironmentSourceOverride, ScopedSecret, HeldRun, ProtectionGateResult, TrustTier, } from './types.js';
+export { TrustTierSchema } from './types.js';
 export { resolveSecretsForEnvironment, matchScopePattern, stripScopePrefix, } from './scope-resolver.js';
 export type { HostFacts } from './host-match.js';
+export { mergeOrderedMaps, EnvGateRejectReason } from './multi-env.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/environment/index.js

@@ -1,3 +1,5 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
+import { TrustTierSchema } from "./types.js";
 import { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix } from "./scope-resolver.js";
-export { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix };
+import { EnvGateRejectReason, mergeOrderedMaps } from "./multi-env.js";
+export { EnvGateRejectReason, TrustTierSchema, matchScopePattern, mergeOrderedMaps, resolveSecretsForEnvironment, stripScopePrefix };

package/dist/environment/multi-env.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Multi-environment merge helpers shared across the orchestrator dispatch path.
+ *
+ * A job may bind several deployment environments in order; their resolved
+ * secrets/variables are folded last-wins (a later environment's key overrides an
+ * earlier one) and their protection gates combine all-must-pass. This module is
+ * browser-safe (pure functions + a Zod enum, no Node built-ins) so it can be
+ * exported from the engine environment barrel.
+ */
+import { z } from 'zod';
+/**
+ * Reason a single bound environment rejects a run under all-must-pass
+ * aggregation. Used to name which environment and which rule blocked dispatch.
+ */
+export declare const EnvGateRejectReason: z.ZodEnum<{
+    branch_restricted: "branch_restricted";
+    trigger_filtered: "trigger_filtered";
+    repo_unmatched: "repo_unmatched";
+    trust_too_low: "trust_too_low";
+    env_disabled: "env_disabled";
+    env_not_found: "env_not_found";
+}>;
+export type EnvGateRejectReason = z.infer<typeof EnvGateRejectReason>;
+/**
+ * Fold an ordered list of per-environment resolved maps into one. Later entries
+ * override earlier keys (last-wins), matching the documented merge order for
+ * `environments: [...]`.
+ */
+export declare function mergeOrderedMaps(maps: ReadonlyArray<Record<string, string>>): Record<string, string>;
+//# sourceMappingURL=multi-env.d.ts.map

package/dist/environment/multi-env.js

@@ -0,0 +1,38 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { z } from "zod";
+//#region src/environment/multi-env.ts
+/**
+* Multi-environment merge helpers shared across the orchestrator dispatch path.
+*
+* A job may bind several deployment environments in order; their resolved
+* secrets/variables are folded last-wins (a later environment's key overrides an
+* earlier one) and their protection gates combine all-must-pass. This module is
+* browser-safe (pure functions + a Zod enum, no Node built-ins) so it can be
+* exported from the engine environment barrel.
+*/
+/**
+* Reason a single bound environment rejects a run under all-must-pass
+* aggregation. Used to name which environment and which rule blocked dispatch.
+*/
+const EnvGateRejectReason = z.enum([
+	"branch_restricted",
+	"trigger_filtered",
+	"repo_unmatched",
+	"trust_too_low",
+	"env_disabled",
+	"env_not_found"
+]);
+/**
+* Fold an ordered list of per-environment resolved maps into one. Later entries
+* override earlier keys (last-wins), matching the documented merge order for
+* `environments: [...]`.
+*/
+function mergeOrderedMaps(maps) {
+	const out = {};
+	for (const m of maps) Object.assign(out, m);
+	return out;
+}
+//#endregion
+export { EnvGateRejectReason, mergeOrderedMaps };
+
+//# sourceMappingURL=multi-env.js.map

package/dist/environment/scope-resolver.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { hostSpecificity, matchHostPattern } from "./host-match.js";
 import { substituteScopePattern } from "./scope-template.js";
 import picomatch from "picomatch";

package/dist/environment/scope-template.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/environment/scope-template.ts
 /** A substituted value must be a single literal path segment — no `/` or glob. */
 const SAFE_SEGMENT = /^[A-Za-z0-9._-]+$/;

package/dist/environment/types.d.ts

@@ -4,6 +4,7 @@
  * Environments are org-level entities that group secrets, variables,
  * and protection rules for deployment targets (dev, staging, production).
  */
+import { z } from 'zod';
 import type { ApproverClause } from '../approval/types.js';
 /** Environment entity — org-level deployment target with protection rules. */
 export interface Environment {
@@ -79,8 +80,13 @@ export interface EnvironmentSourceOverride {
     createdAt: string;
     updatedAt: string;
 }
-/** Trust tier for contributor-based CI execution gating. */
-export type TrustTier = 'trusted' | 'known' | 'unknown';
+/** Trust tier for contributor-based CI execution gating (single source of truth). */
+export declare const TrustTierSchema: z.ZodEnum<{
+    unknown: "unknown";
+    known: "known";
+    trusted: "trusted";
+}>;
+export type TrustTier = z.infer<typeof TrustTierSchema>;
 /** Held run record for protection gate enforcement. */
 export interface HeldRun {
     id: string;

package/dist/environment/types.js

@@ -1,2 +1,19 @@
-import "../chunk-BTugEXQM.js";
-export {};
+import "../rolldown-runtime-ClRpJifh.js";
+import { z } from "zod";
+//#region src/environment/types.ts
+/**
+* Environment types for KiCI's deployment environment model.
+*
+* Environments are org-level entities that group secrets, variables,
+* and protection rules for deployment targets (dev, staging, production).
+*/
+/** Trust tier for contributor-based CI execution gating (single source of truth). */
+const TrustTierSchema = z.enum([
+	"trusted",
+	"known",
+	"unknown"
+]);
+//#endregion
+export { TrustTierSchema };
+
+//# sourceMappingURL=types.js.map

package/dist/fanout/materialize.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { applyIncludeExclude, expandMatrix } from "../matrix/expand.js";
 import { formatExpandedJobName } from "../matrix/format.js";
 //#region src/fanout/materialize.ts
@@ -118,7 +118,7 @@ function materializeResolvedMatrix(lockJob, combos) {
 	assignFanoutPositions(jobs, variantLabelOf);
 	return {
 		jobs,
-		expansionMap: new Map([[lockJob.name, jobs.map((j) => j.expandedName)]])
+		expansionMap: /* @__PURE__ */ new Map([[lockJob.name, jobs.map((j) => j.expandedName)]])
 	};
 }
 /**
@@ -163,7 +163,7 @@ function materializeResolvedHosts(lockJob, agents, maxHosts) {
 	assignFanoutPositions(jobs, (child) => child.pinnedAgentId ?? "");
 	return {
 		jobs,
-		expansionMap: new Map([[lockJob.name, jobs.map((j) => j.expandedName)]])
+		expansionMap: /* @__PURE__ */ new Map([[lockJob.name, jobs.map((j) => j.expandedName)]])
 	};
 }
 /**

package/dist/index.d.ts

@@ -9,12 +9,21 @@
  * - WebSocket close codes (unified across all tiers)
  */
 export * from './protocol/version.js';
+export * from './protocol/source-origin.js';
+export * from './provenance/attestation-origin.js';
 export * from './protocol/messages/common.js';
 export * from './protocol/messages/actor.js';
+export * from './protocol/messages/pat-kind.js';
+export * from './mcp/tool-schemas.js';
+export * from './mcp/held-run-resolve.js';
+export * from './mcp/fence.js';
 export * from './protocol/messages/auth.js';
 export * from './protocol/messages/capabilities.js';
 export { webhookRelaySchema, webhookRelayStartSchema, webhookRelayChunkSchema, webhookAckSchema, WebhookRelayResult, WEBHOOK_RELAY_MAX_BODY_BYTES, WEBHOOK_RELAY_CHUNK_SIZE, executionEventSchema, logChunkSchema, peerDiscoverSchema, peerUpdateSchema, cacheStatsSchema, orchMetricsSchema, platformToOrchestratorMessageSchema, orchestratorToPlatformMessageSchema, type WebhookRelay, type WebhookRelayStart, type WebhookRelayChunk, type WebhookAck, type LogChunk, type PeerDiscover, type PeerUpdate, type CacheStats, type OrchMetrics, trustPolicyUpdateSchema, type TrustPolicyUpdate, staleCheckrunCleanupSchema, type StaleCheckrunCleanup, type PlatformToOrchestratorMessage, type OrchestratorToPlatformMessage, } from './protocol/messages/platform-orchestrator.js';
 export * from './protocol/messages/execution-status.js';
+export * from './protocol/messages/agent-run-result.js';
+export * from './protocol/messages/agent-dev-ops.js';
+export * from './dev-ops/operations.js';
 export * from './protocol/messages/deployment-identity.js';
 export * from './protocol/messages/scaler-event.js';
 export * from './protocol/messages/event-log.js';
@@ -39,7 +48,7 @@ export * from './trigger/matcher.js';
 export * from './inputs/index.js';
 export * from './state-machine/index.js';
 export * from './provider/index.js';
-export { githubWebhookPath } from './webhook/webhook-url-format.js';
+export { githubWebhookPath, githubIngressPath } from './webhook/webhook-url-format.js';
 export type { WsLike } from './ws/ws-like.js';
 export * from './ws/close-codes.js';
 export { WsRateLimiter } from './ws/rate-limiter.js';