@kici-dev/engine 0.1.23 → 0.1.25

package/dist/protocol/messages/dashboard.js

@@ -1,13 +1,16 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { CheckMode, CheckStepOutcome } from "../../check-mode.js";
+import { SourceOrigin } from "../source-origin.js";
+import { AttestationOrigin } from "../../provenance/attestation-origin.js";
 import { actorPrincipalSchema } from "./actor.js";
-import { initFailureSchema } from "./execution-status.js";
-import { DeploymentContainerRuntimeSchema, DeploymentModeSchema } from "./deployment-identity.js";
-import { SourceSubtype } from "./source-registration.js";
+import { StepConcurrencyKind, initFailureSchema } from "./execution-status.js";
+import { agentRunResultSchema } from "./agent-run-result.js";
 import { kiciBundleSchema } from "../../provenance/bundle.js";
 import { dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema } from "./access-log.js";
 import { dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema } from "./run-events.js";
 import { EventLogSource, EventLogStatus, PayloadOmittedReason } from "./event-log.js";
+import { DeploymentContainerRuntimeSchema, DeploymentModeSchema } from "./deployment-identity.js";
+import { SourceSubtype } from "./source-registration.js";
 import { ScalerBackendType } from "../../scaler/scaler-backend-type.js";
 import { ApprovalDecision, HoldScope, approverClauseSchema } from "../../approval/types.js";
 import { NeedsRunOn, OnUnreachableMode } from "../../trigger/types.js";
@@ -23,6 +26,24 @@ const dashboardRunDetailRequestSchema = z.object({
 	actor: actorPrincipalSchema,
 	runId: z.string()
 });
+/**
+* Request the machine-first, provenance-tagged structured run result from the
+* orchestrator (user-plane equivalent of the orchestrator-admin
+* `/runs/:id/structured` endpoint). Reuses the Phase-1 `AgentRunResult` shape.
+*/
+const dashboardRunStructuredRequestSchema = z.object({
+	type: z.literal("dashboard.run.structured"),
+	requestId: z.string(),
+	actor: actorPrincipalSchema,
+	runId: z.string()
+});
+/** Response carrying the provenance-tagged AgentRunResult (null when not found). */
+const dashboardRunStructuredResponseSchema = z.object({
+	type: z.literal("dashboard.run.structured.response"),
+	requestId: z.string(),
+	result: agentRunResultSchema.nullable(),
+	error: z.string().optional()
+});
 /** Request step logs from orchestrator. */
 const dashboardStepLogsRequestSchema = z.object({
 	type: z.literal("dashboard.step.logs"),
@@ -30,7 +51,17 @@ const dashboardStepLogsRequestSchema = z.object({
 	actor: actorPrincipalSchema,
 	runId: z.string(),
 	jobId: z.string(),
-	stepIndex: z.number()
+	stepIndex: z.number(),
+	/**
+	* Optional line-offset cursor (a prior response's `nextCursor`). Absent reads
+	* from the start.
+	*/
+	cursor: z.string().optional(),
+	/**
+	* Optional max lines to return. Absent = unbounded (the human dashboard relies
+	* on this); the MCP layer opts into paging by sending an explicit limit.
+	*/
+	limit: z.number().int().positive().optional()
 });
 /** Step detail within a job response. */
 const dashboardStepDetailSchema = z.object({
@@ -49,7 +80,11 @@ const dashboardStepDetailSchema = z.object({
 	/** Idempotent per-step outcome under a check mode. null/absent for non-check runs. */
 	checkOutcome: CheckStepOutcome.nullable().optional(),
 	/** Human-readable drift summary, present when the step reported drift. */
-	driftSummary: z.string().nullable().optional()
+	driftSummary: z.string().nullable().optional(),
+	/** Step concurrency role; absent/`sequential` for ordinary steps. */
+	concurrencyKind: StepConcurrencyKind.nullable().optional(),
+	/** Parallel-group correlation id shared by a group's children (e.g. `g0`). */
+	groupId: z.string().nullable().optional()
 });
 /** Job detail within a run detail response. */
 const dashboardJobDetailSchema = z.object({
@@ -71,6 +106,19 @@ const dashboardJobDetailSchema = z.object({
 	errorMessage: z.string().nullable(),
 	/** Labels used for agent routing (e.g. ["kici:os:linux", "kici:arch:x64"]). */
 	runsOnLabels: z.array(z.string()).nullable().optional(),
+	/**
+	* Ordered bound deployment-environment names for this job, in merge order
+	* (later environments override earlier on key collisions). A `(dynamic)`
+	* entry marks an element resolved at runtime. null/absent = no binding.
+	*/
+	environments: z.array(z.string()).nullable().optional(),
+	/**
+	* Bound environments skipped on a test/local run (non-test or unconfigured).
+	* null/absent when nothing was skipped.
+	*/
+	skippedEnvironments: z.array(z.string()).nullable().optional(),
+	/** User-visible warning naming the skipped test-run environments. null/absent when none. */
+	envWarning: z.string().nullable().optional(),
 	/** Aggregated step outputs (step-keyed map). Present when job completed successfully with outputs. */
 	outputs: z.record(z.string(), z.record(z.string(), z.unknown())).nullable().optional(),
 	/** Secret output key names produced by this job (values are NOT included -- display masked). */
@@ -122,6 +170,8 @@ const dashboardStepLogsResponseSchema = z.object({
 	requestId: z.string(),
 	lines: z.array(z.string()),
 	totalLines: z.number(),
+	/** Next line-offset cursor, or null when the page reached the end. */
+	nextCursor: z.string().nullable().optional(),
 	error: z.string().optional()
 });
 /** Request the build-provenance attestations for a run. */
@@ -132,6 +182,22 @@ const dashboardAttestationsListRequestSchema = z.object({
 	runId: z.string()
 });
 /**
+* Server-side verification verdict for an attestation, computed at ingest.
+* - `verified` — `verifyKiciBundle` succeeded.
+* - `failed` — verification ran and the bundle failed (signature / identity /
+*   build-context / unsupported mode). A provenance-integrity signal.
+* - `unverifiable` — no verdict could be computed (no trust root configured, or
+*   the JWKS / bundle could not be read). NOT a forgery signal.
+* - `pending` — verdict not yet computed (pre-backfill row, or ingest raced the
+*   trust root).
+*/
+const attestationVerifyStatusSchema = z.enum([
+	"verified",
+	"failed",
+	"unverifiable",
+	"pending"
+]);
+/**
 * Single attestation in the list response, with its bundle inlined from object
 * storage so the dashboard verifies it without a second fetch. The bundle is a
 * KiCI Mode-A bundle (`@kici-dev/engine/provenance/bundle`).
@@ -145,7 +211,28 @@ const attestationListItemSchema = z.object({
 	mode: z.string(),
 	mediaType: z.string(),
 	createdAt: z.string(),
-	bundle: kiciBundleSchema
+	bundle: kiciBundleSchema,
+	/**
+	* Owning run id — populated by the single-attestation detail get (for the
+	* "view run" link); omitted by the per-run list (the run is already known).
+	*/
+	runId: z.string().optional(),
+	/** Stored server-side verdict — populated by the detail get (omitted per-run). */
+	verifyStatus: attestationVerifyStatusSchema.optional(),
+	/** First failure reason for the stored verdict, when failed (detail get only). */
+	verifyReason: z.string().nullable().optional(),
+	/**
+	* Source-origin brand: triggered vs kici run remote (local working-tree
+	* overlay). Read from the signed statement's internalParameters.
+	*/
+	sourceOrigin: SourceOrigin.optional(),
+	/** Authoritative origin: the customer's public org id (from the signed statement). */
+	originOrgId: z.string().optional(),
+	/**
+	* Mint-timing origin: live / deferred / offline-backfill. Read from the token
+	* claim or the signed statement's internalParameters; absent defaults to live.
+	*/
+	attestationOrigin: AttestationOrigin.optional()
 });
 /** Response with the run's attestations (correlates to dashboard.attestations.list). */
 const dashboardAttestationsListResponseSchema = z.object({
@@ -155,6 +242,98 @@ const dashboardAttestationsListResponseSchema = z.object({
 	error: z.string().optional()
 });
 /**
+* Metadata-only summary row for the org-wide list. No inlined bundle (keeps the
+* list cheap). `repository` / `workflow` are joined from `execution_runs` when
+* available.
+*/
+const attestationListSummarySchema = z.object({
+	id: z.string(),
+	runId: z.string(),
+	jobId: z.string(),
+	jobName: z.string().nullable(),
+	subjectName: z.string(),
+	subjectDigest: z.string(),
+	mode: z.string(),
+	mediaType: z.string(),
+	createdAt: z.string(),
+	verifyStatus: attestationVerifyStatusSchema,
+	verifyReason: z.string().nullable(),
+	repository: z.string().nullable(),
+	workflow: z.string().nullable(),
+	/**
+	* Source-origin brand: triggered vs kici run remote (local working-tree
+	* overlay). Derived from the run's local_working_tree flag.
+	*/
+	sourceOrigin: SourceOrigin.optional(),
+	/** Mint-timing origin: live / deferred / offline-backfill. */
+	attestationOrigin: AttestationOrigin.optional(),
+	/**
+	* True for a row still in the deferred-attestation outbox (not yet minted):
+	* `verifyStatus: 'pending'`, no bundle. The page offers a retry action.
+	*/
+	pending: z.boolean().optional()
+});
+/** Filters for the org-wide attestations list. */
+const attestationListFiltersSchema = z.object({
+	digest: z.string().optional(),
+	name: z.string().optional(),
+	status: attestationVerifyStatusSchema.optional(),
+	repository: z.string().optional(),
+	workflow: z.string().optional(),
+	job: z.string().optional(),
+	createdAfter: z.string().optional(),
+	createdBefore: z.string().optional()
+});
+/** Request the org-wide, paginated, filtered list of attestations. */
+const dashboardAttestationsListAllRequestSchema = z.object({
+	type: z.literal("dashboard.attestations.list.all"),
+	requestId: z.string(),
+	actor: actorPrincipalSchema,
+	page: z.number().int().positive(),
+	sort: z.string().optional(),
+	filters: attestationListFiltersSchema.default({})
+});
+/** Response with one page of org-wide attestation summaries. */
+const dashboardAttestationsListAllResponseSchema = z.object({
+	type: z.literal("dashboard.attestations.list.all.response"),
+	requestId: z.string(),
+	attestations: z.array(attestationListSummarySchema),
+	page: z.number().int(),
+	pageSize: z.number().int(),
+	total: z.number().int(),
+	error: z.string().optional()
+});
+/** Request a single attestation by id (detail page; inlines the one bundle). */
+const dashboardAttestationGetRequestSchema = z.object({
+	type: z.literal("dashboard.attestation.get"),
+	requestId: z.string(),
+	actor: actorPrincipalSchema,
+	attestationId: z.string()
+});
+/** Response with one attestation (the existing item shape with bundle), or null. */
+const dashboardAttestationGetResponseSchema = z.object({
+	type: z.literal("dashboard.attestation.get.response"),
+	requestId: z.string(),
+	attestation: attestationListItemSchema.nullable(),
+	error: z.string().optional()
+});
+/** Request an on-demand drain of the deferred-attestation outbox (optionally one run). */
+const dashboardAttestationRetryRequestSchema = z.object({
+	type: z.literal("dashboard.attestation.retry"),
+	requestId: z.string(),
+	actor: actorPrincipalSchema,
+	/** Scope to a single run; omitted drains every pending attestation. */
+	runId: z.string().optional()
+});
+/** Response with the drain counts. */
+const dashboardAttestationRetryResponseSchema = z.object({
+	type: z.literal("dashboard.attestation.retry.response"),
+	requestId: z.string(),
+	minted: z.number().int(),
+	stillPending: z.number().int(),
+	error: z.string().optional()
+});
+/**
 * Run-summary projection from the orchestrator's execution_runs table.
 *
 * The required fields (`runId` / `routingKey` / `status`) are always present.
@@ -175,13 +354,17 @@ const dashboardRunSummarySchema = z.object({
 	triggerEvent: z.string().optional(),
 	commitMessage: z.string().optional(),
 	jobCount: z.number().optional(),
+	/** Distinct bound deployment-environment names across the run's jobs (first-seen order). */
+	environments: z.array(z.string()).optional(),
 	startedAt: z.string().optional(),
 	completedAt: z.string().optional(),
 	durationMs: z.number().optional(),
 	parentRunId: z.string().optional(),
 	originalRunId: z.string().optional(),
 	triggeredBy: z.string().optional(),
+	triggeredByAgentLabel: z.string().nullable().optional(),
 	cancelledBy: z.string().optional(),
+	cancelledByAgentLabel: z.string().nullable().optional(),
 	failureReason: z.string().optional(),
 	hadCompileJob: z.boolean().optional(),
 	compileJobId: z.string().optional(),
@@ -291,7 +474,9 @@ const manualScheduleRequestSchema = z.object({
 	type: z.literal("run.manual_schedule.request"),
 	requestId: z.string(),
 	actor: actorPrincipalSchema,
-	registrationId: z.string()
+	registrationId: z.string(),
+	/** Agent provenance label when triggered through an agent credential. */
+	triggeredByAgentLabel: z.string().nullable().optional()
 });
 /** Response to a manual schedule trigger request. */
 const manualScheduleResponseSchema = z.object({
@@ -935,12 +1120,12 @@ const envSecretScopeDeleteResponseSchema = z.object({
 	requestId: z.string(),
 	error: z.string().optional()
 });
-/** Fetch runs that targeted a specific environment. */
+/** Fetch runs that targeted a specific environment, keyed by environment id. */
 const envHistoryRequestSchema = z.object({
 	type: z.literal("dashboard.environments.history"),
 	requestId: z.string(),
 	actor: actorPrincipalSchema,
-	environmentName: z.string(),
+	environmentId: z.string(),
 	limit: z.number().optional(),
 	offset: z.number().optional()
 });
@@ -976,7 +1161,17 @@ const heldRunsListRequestSchema = z.object({
 	actor: actorPrincipalSchema,
 	status: HeldRunStatus.optional(),
 	queueType: HeldRunQueueType.optional(),
-	runId: z.string().optional()
+	runId: z.string().optional(),
+	/**
+	* Target org the read must be scoped to, carried per-request by the Platform
+	* (the validated `:orgId` path param). The orchestrator honors this over its
+	* static connection-level org so a Platform-first `kici run remote` org —
+	* anchored only by `remote_sources` — sees its own held runs even when the
+	* orchestrator's connection also serves a webhook source for a different org.
+	* Absent on the legacy customer-dashboard path, where the connection org is
+	* already the request org.
+	*/
+	orgId: z.string().optional()
 });
 const heldRunsListResponseSchema = z.object({
 	type: z.literal("dashboard.held-runs.list.response"),
@@ -1028,7 +1223,15 @@ const heldRunApproveRequestSchema = z.object({
 	* is still enforced (this only changes the audit action to
 	* `held_run.auto_approve`); it is never a bypass.
 	*/
-	autoApprove: z.boolean().optional()
+	autoApprove: z.boolean().optional(),
+	/**
+	* Target org the decision must be scoped to, carried per-request by the
+	* Platform (the validated `:orgId` path param). Honored over the static
+	* connection-level org so a remote run's hold — recorded under the run's own
+	* `remote_sources` org — is resolvable even when the orchestrator's
+	* connection also serves a webhook source for a different org.
+	*/
+	orgId: z.string().optional()
 });
 const heldRunApproveResponseSchema = z.object({
 	type: z.literal("dashboard.held-runs.approve.response"),
@@ -1041,7 +1244,15 @@ const heldRunRejectRequestSchema = z.object({
 	requestId: z.string(),
 	actor: actorPrincipalSchema,
 	heldRunId: z.string(),
-	reason: z.string().optional()
+	reason: z.string().optional(),
+	/**
+	* Target org the decision must be scoped to, carried per-request by the
+	* Platform (the validated `:orgId` path param). Honored over the static
+	* connection-level org so a remote run's hold — recorded under the run's own
+	* `remote_sources` org — is resolvable even when the orchestrator's
+	* connection also serves a webhook source for a different org.
+	*/
+	orgId: z.string().optional()
 });
 const heldRunRejectResponseSchema = z.object({
 	type: z.literal("dashboard.held-runs.reject.response"),
@@ -1585,6 +1796,8 @@ const testRelayTriggerResponseSchema = z.object({
 	status: z.enum(["accepted", "rejected"]).optional(),
 	reason: z.string().optional(),
 	jobIds: z.array(z.string()).optional(),
+	/** User-visible warnings on acceptance (e.g. skipped non-test bound environments). */
+	warnings: z.array(z.string()).optional(),
 	error: z.string().optional()
 });
 /** Request a snapshot of a run's status. */
@@ -1645,8 +1858,12 @@ const testRelayCancelResponseSchema = z.object({
 /** Dashboard messages flowing from Platform to Orchestrator. */
 const dashboardPlatformToOrchSchema = z.discriminatedUnion("type", [
 	dashboardRunDetailRequestSchema,
+	dashboardRunStructuredRequestSchema,
 	dashboardStepLogsRequestSchema,
 	dashboardAttestationsListRequestSchema,
+	dashboardAttestationsListAllRequestSchema,
+	dashboardAttestationGetRequestSchema,
+	dashboardAttestationRetryRequestSchema,
 	dashboardRunsListRequestSchema,
 	dashboardRunsFiltersRequestSchema,
 	dashboardSourcesListRequestSchema,
@@ -1715,8 +1932,12 @@ const dashboardPlatformToOrchSchema = z.discriminatedUnion("type", [
 /** Dashboard messages flowing from Orchestrator to Platform. */
 const dashboardOrchToPlatformSchema = z.discriminatedUnion("type", [
 	dashboardRunDetailResponseSchema,
+	dashboardRunStructuredResponseSchema,
 	dashboardStepLogsResponseSchema,
 	dashboardAttestationsListResponseSchema,
+	dashboardAttestationsListAllResponseSchema,
+	dashboardAttestationGetResponseSchema,
+	dashboardAttestationRetryResponseSchema,
 	dashboardRunsListResponseSchema,
 	dashboardRunsFiltersResponseSchema,
 	dashboardSourcesListResponseSchema,
@@ -1799,7 +2020,9 @@ const dashboardRunDetailApiResponseSchema = z.object({
 /** REST API response for step logs. */
 const dashboardStepLogsApiResponseSchema = z.object({
 	lines: z.array(z.string()),
-	totalLines: z.number()
+	totalLines: z.number(),
+	/** Next line-offset cursor, or null when the page reached the end. */
+	nextCursor: z.string().nullable().optional()
 });
 /**
 * REST API response for the run attestations list. The orchestrator-relayed
@@ -1846,12 +2069,27 @@ const runListItemSchema = z.object({
 	parentRunId: z.string().nullable(),
 	originalRunId: z.string().nullable(),
 	triggeredBy: z.string().nullable(),
+	triggeredByAgentLabel: z.string().nullable().optional(),
 	triggeredByUser: runListPrincipalUserSchema.nullable(),
 	cancelledBy: z.string().nullable(),
+	cancelledByAgentLabel: z.string().nullable().optional(),
 	cancelledByUser: runListPrincipalUserSchema.nullable(),
 	failureReason: z.string().optional(),
 	hadCompileJob: z.boolean(),
 	compileJobId: z.string().nullable(),
+	/**
+	* Distinct bound deployment-environment names across the run's jobs
+	* (first-seen order). Drives the run-list environment chips; empty/absent
+	* when no job binds an environment.
+	*/
+	environments: z.array(z.string()).optional(),
+	/**
+	* Run-level repo provider (origin host) — distinct from `source.provider`
+	* which is derived from the routing key. Drives provider-aware repo links.
+	*/
+	repoProvider: z.string().nullable(),
+	/** True when the run executed a developer's local working tree (`kici run remote`). */
+	localWorkingTree: z.boolean(),
 	source: runListSourceSchema.nullable()
 });
 /** Paginated run list response envelope. */
@@ -2030,7 +2268,23 @@ const orgMemberSchema = z.object({
 });
 /** Response for org members list endpoint. */
 const memberListResponseSchema = z.object({ members: z.array(orgMemberSchema) });
+/**
+* Every dashboard request type the local build understands, derived from the
+* discriminated union so it can never drift. A component advertises this set to
+* describe ITSELF; gating decisions always compare against the REMOTE's
+* advertised set, never this local one.
+*/
+const DASHBOARD_REQUEST_TYPES = dashboardPlatformToOrchSchema.options.map((o) => o.shape.type.value);
+/** Membership-test form of {@link DASHBOARD_REQUEST_TYPES}. */
+const DASHBOARD_REQUEST_TYPE_SET = new Set(DASHBOARD_REQUEST_TYPES);
+/** Structured error code on a dashboard `*.response` frame's `code` field. */
+const DashboardResponseErrorCode = z.enum([
+	"unsupported_request_type",
+	"invalid_payload",
+	"unsupported_message_type",
+	"internal_error"
+]);
 //#endregion
-export { EnvDeleteErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListItemSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingEntrySchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema };
+export { DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EnvDeleteErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingEntrySchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema };
 
 //# sourceMappingURL=dashboard.js.map

package/dist/protocol/messages/deployment-identity.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/protocol/messages/deployment-identity.ts
 /** How the orchestrator process itself was deployed (not how it runs agents). */

package/dist/protocol/messages/event-log.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/protocol/messages/event-log.ts
 /**

package/dist/protocol/messages/execution-status.d.ts

@@ -1,4 +1,18 @@
 import { z } from 'zod';
+/** Max length for ids and short identifier fields (runId, jobId, sha, ref, …). */
+export declare const STATUS_ID_MAX = 128;
+/** Max length for the repo identifier (`owner/repo` can be long). */
+export declare const REPO_IDENTIFIER_MAX = 256;
+/** Max length for free-text fields (commit message, failure/error reason). */
+export declare const STATUS_FREE_TEXT_MAX = 2000;
+/** Max number of runs in a single `state.replay` snapshot. */
+export declare const STATE_REPLAY_MAX_RUNS = 500;
+/** Max number of jobs attached to a single run in a `state.replay` snapshot. */
+export declare const MAX_JOBS_PER_RUN = 1000;
+/** Max number of `runsOn` / `secretsAccessed` label entries on a job/step. */
+export declare const RUNS_ON_LABELS_MAX = 30;
+/** Max number of bound deployment-environment names on a job. */
+export declare const ENVIRONMENTS_MAX = 30;
 /**
  * Status values for execution runs (execution_runs table).
  *
@@ -34,14 +48,46 @@ export declare const ExecutionJobStatus: z.ZodEnum<{
     drift_dropped: "drift_dropped";
 }>;
 export type ExecutionJobStatus = z.infer<typeof ExecutionJobStatus>;
-/** Status values for execution steps (execution_steps table + step.status protocol messages). */
+/**
+ * The status values a notification subscription may target at the given level.
+ *
+ * A run-level subscription matches against an `ExecutionRunStatus`; a job-level
+ * subscription matches against an `ExecutionJobStatus` (which carries job-only
+ * terminal states like `timed_out_stale` / `drift_dropped` / `skipped`). Both
+ * the Platform validation and the dashboard editor derive their allowed set
+ * from this single helper so server validation and UI options cannot diverge.
+ */
+export declare function statusOptionsForLevel(level: 'run' | 'job'): readonly string[];
+/**
+ * Status values for execution steps (execution_steps table + step.status protocol messages).
+ *
+ *  - `pending`   — a parallel-group child queued behind `maxParallel`, not yet launched.
+ *  - `cancelled` — a parallel-group sibling aborted by fail-fast (NOT a failure).
+ */
 export declare const ExecutionStepStatus: z.ZodEnum<{
     skipped: "skipped";
     success: "success";
+    pending: "pending";
     running: "running";
     failed: "failed";
+    cancelled: "cancelled";
 }>;
 export type ExecutionStepStatus = z.infer<typeof ExecutionStepStatus>;
+/**
+ * How a step participates in a job's step concurrency model.
+ *
+ *  - `sequential`     — an ordinary step in the flat step sequence.
+ *  - `parallel-child` — a child of a `parallel()` group, running concurrently
+ *                       with its siblings, each its own observable step.
+ *  - `parallel-group` — the structural group wrapper (no flat step index); used
+ *                       only for the dashboard band aggregate, not persisted per step.
+ */
+export declare const StepConcurrencyKind: z.ZodEnum<{
+    sequential: "sequential";
+    "parallel-child": "parallel-child";
+    "parallel-group": "parallel-group";
+}>;
+export type StepConcurrencyKind = z.infer<typeof StepConcurrencyKind>;
 /**
  * Distinct reasons a run/job ended because a configured wall-clock timeout
  * was exceeded. Surfaced in the failure/cancel reason so the dashboard can
@@ -122,8 +168,8 @@ export type CacheOutcome = z.infer<typeof CacheOutcome>;
 /** Structured init-failure signal. Presence on a run/job means "never started". */
 export declare const initFailureSchema: z.ZodObject<{
     scope: z.ZodEnum<{
-        run: "run";
         job: "job";
+        run: "run";
     }>;
     category: z.ZodEnum<{
         secret_resolution: "secret_resolution";
@@ -159,6 +205,8 @@ export declare const executionStatusSchema: z.ZodObject<{
         held: "held";
     }>;
     repoIdentifier: z.ZodOptional<z.ZodString>;
+    repoProvider: z.ZodOptional<z.ZodString>;
+    localWorkingTree: z.ZodOptional<z.ZodBoolean>;
     sha: z.ZodOptional<z.ZodString>;
     ref: z.ZodOptional<z.ZodString>;
     triggerEvent: z.ZodOptional<z.ZodString>;
@@ -171,12 +219,16 @@ export declare const executionStatusSchema: z.ZodObject<{
     parentRunId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     originalRunId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     triggeredBy: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    triggeredByAgentLabel: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    triggerActorProvider: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    triggerActorUsername: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    triggerActorUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     failureReason: z.ZodOptional<z.ZodString>;
     logBytes: z.ZodOptional<z.ZodNumber>;
     initFailure: z.ZodOptional<z.ZodObject<{
         scope: z.ZodEnum<{
-            run: "run";
             job: "job";
+            run: "run";
         }>;
         category: z.ZodEnum<{
             secret_resolution: "secret_resolution";
@@ -204,12 +256,20 @@ export declare const stepStatusForwardSchema: z.ZodObject<{
     state: z.ZodEnum<{
         skipped: "skipped";
         success: "success";
+        pending: "pending";
         running: "running";
         failed: "failed";
+        cancelled: "cancelled";
     }>;
     timestamp: z.ZodNumber;
     data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     secretsAccessed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    concurrencyKind: z.ZodOptional<z.ZodEnum<{
+        sequential: "sequential";
+        "parallel-child": "parallel-child";
+        "parallel-group": "parallel-group";
+    }>>;
+    groupId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /** Per-job status forwarded from orchestrator to Platform (real-time). */
 export declare const jobStatusForwardSchema: z.ZodObject<{
@@ -239,12 +299,13 @@ export declare const jobStatusForwardSchema: z.ZodObject<{
     agentId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     orchestratorId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     runsOnLabels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    environments: z.ZodOptional<z.ZodArray<z.ZodString>>;
     logBytes: z.ZodOptional<z.ZodNumber>;
     timestamp: z.ZodNumber;
     initFailure: z.ZodOptional<z.ZodObject<{
         scope: z.ZodEnum<{
-            run: "run";
             job: "job";
+            run: "run";
         }>;
         category: z.ZodEnum<{
             secret_resolution: "secret_resolution";
@@ -289,6 +350,7 @@ export declare const stateReplaySchema: z.ZodObject<{
         parentRunId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         originalRunId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         triggeredBy: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        triggeredByAgentLabel: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         failureReason: z.ZodOptional<z.ZodString>;
         jobs: z.ZodArray<z.ZodObject<{
             jobId: z.ZodString;
@@ -300,6 +362,7 @@ export declare const stateReplaySchema: z.ZodObject<{
             errorMessage: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             agentId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             runsOnLabels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            environments: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
     timestamp: z.ZodNumber;