@kici-dev/engine 0.1.24 → 0.1.25

package/dist/approval/types.d.ts

@@ -21,8 +21,8 @@ export declare const approverClauseSchema: z.ZodUnion<readonly [z.ZodObject<{
 export type ApproverClause = z.infer<typeof approverClauseSchema>;
 /** Granularity of a held element. */
 export declare const HoldScope: z.ZodEnum<{
-    job: "job";
     workflow: "workflow";
+    job: "job";
     step: "step";
 }>;
 export type HoldScope = z.infer<typeof HoldScope>;

package/dist/approval/types.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/approval/types.ts
 /**

package/dist/audit/access-log-policy.js

@@ -1,4 +1,5 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
+import { agentLabelOf } from "../protocol/messages/actor.js";
 import { z } from "zod";
 //#region src/audit/access-log-policy.ts
 /**
@@ -213,7 +214,7 @@ function actorKey(actor) {
 function shouldRecordAccess(action, outcome, actor, requestId, limiter) {
 	if (outcome !== "allowed") return true;
 	if (actor.type === "platform_operator") return true;
-	if (actor.type === "user" && actor.agent) return true;
+	if (agentLabelOf(actor) !== null) return true;
 	const policy = POLICY_BY_ACTION[action];
 	switch (policy.kind) {
 		case "always": return true;

package/dist/audit/activity.d.ts

@@ -115,6 +115,8 @@ export declare const activityFilterSchema: z.ZodObject<{
     targetId: z.ZodOptional<z.ZodString>;
     runId: z.ZodOptional<z.ZodString>;
     q: z.ZodOptional<z.ZodString>;
+    agentLabel: z.ZodOptional<z.ZodString>;
+    agentOnly: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodCodec<z.ZodString, z.ZodBoolean>]>>;
     from: z.ZodOptional<z.ZodString>;
     to: z.ZodOptional<z.ZodString>;
     cursor: z.ZodOptional<z.ZodString>;

package/dist/audit/activity.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { ActorType } from "../protocol/messages/actor.js";
 import { AccessLogOutcome, AccessLogSource } from "../protocol/messages/access-log.js";
 import { z } from "zod";
@@ -97,6 +97,20 @@ const activityFilterSchema = z.object({
 	runId: z.string().optional(),
 	/** Full-text search over access_log.error_message and audit_log.details::text. */
 	q: z.string().optional(),
+	/**
+	* Exact-match filter on the agent provenance label. Only the access_log half
+	* of the federation carries an agent label, so an agent filter restricts the
+	* stream to agent-attributed access-log rows.
+	*/
+	agentLabel: z.string().max(255).optional(),
+	/**
+	* When true, return only agent-attributed rows (access_log `agent_label IS NOT NULL`).
+	* Arrives as a query string (`?agentOnly=false`), so parse it with `z.stringbool()`
+	* — NOT `z.coerce.boolean()`, whose `z.coerce.boolean('false') === true` is a
+	* confirmed footgun. The `z.boolean()` arm keeps a native boolean acceptable for
+	* programmatic callers (mirrors how `limit` tolerates both a number and a string).
+	*/
+	agentOnly: z.union([z.boolean(), z.stringbool()]).optional(),
 	/** ISO timestamp lower bound (inclusive). */
 	from: z.string().optional(),
 	/** ISO timestamp upper bound (exclusive). */

package/dist/audit/retention-policy.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/audit/retention-policy.ts
 /**
 * Warm-retention days per `AccessLogAction`. Exhaustive over the enum so a
@@ -118,7 +118,7 @@ const COMPLIANCE_AUDIT_PREFIXES = [
 	"platform-admin.",
 	"support-read."
 ];
-const COMPLIANCE_AUDIT_EXACT = new Set([
+const COMPLIANCE_AUDIT_EXACT = /* @__PURE__ */ new Set([
 	"archive_chunk",
 	"purge_chunk",
 	"replay_chunk",
@@ -145,7 +145,7 @@ function getAuditLogWarmDays(args) {
 * promotes to 180 days. There is no `actor_type` column on this table, so
 * the platform_operator override does not apply.
 */
-const SAMPLED_RESOLVE_ACTIONS = new Set(["resolve", "resolve_named"]);
+const SAMPLED_RESOLVE_ACTIONS = /* @__PURE__ */ new Set(["resolve", "resolve_named"]);
 function secretAuditLogWarmDays(action) {
 	if (SAMPLED_RESOLVE_ACTIONS.has(action)) return 30;
 	return 365;

package/dist/bundler/index.js

@@ -1,3 +1,3 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { createWorkflowBundleConfig } from "./rolldown-config.js";
 export { createWorkflowBundleConfig };

package/dist/bundler/rolldown-config.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/bundler/rolldown-config.ts
 /**
 * Create a rolldown configuration for workflow bundling.

package/dist/check-mode.js

@@ -1,4 +1,4 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/check-mode.ts
 /**

package/dist/dev-ops/operations.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The developer-operations API contract. One row per workflow-developer-core
+ * operation, declaring which entrypoints expose it — HTTP (the shared REST API
+ * behind both the web UI and the `kici` CLI), MCP (the agent tool surface), and
+ * a curated UI flag. The congruence tests assert each entrypoint's real surface
+ * matches this registry, so a new route / CLI command / MCP tool that drifts
+ * from the contract fails the build.
+ *
+ * Three row states, one honest ledger:
+ *
+ * - **Live everywhere it should be** — `entrypoints.mcp: true` with `mcpTool`
+ *   set. The registered developer MCP tools land here; their booleans mirror the
+ *   actual current surface so every harness passes on landing.
+ * - **Planned MCP tool** — `mcpAppropriate: true` but `entrypoints.mcp: false`,
+ *   `mcpTool: null`. An agent-appropriate op that exists in HTTP/CLI but is not
+ *   yet an MCP tool. The consistency test permits this (`mcp ⟹ mcpAppropriate`,
+ *   not the converse), so the row is a visible, testable to-do.
+ * - **Never an MCP tool** — `mcpAppropriate: false`, `entrypoints.mcp: false`.
+ *   Secret-value writes and destructive deletes: agent safety encoded in data.
+ *
+ * Browser-safe: data + TypeScript types only, no Node imports, so it lives in
+ * the engine barrel importable by the web UI, the CLI, and the Platform.
+ */
+export type DeveloperOpDomain = 'runs' | 'workflows' | 'environments' | 'secrets' | 'held-runs' | 'diagnostics' | 'orchestrators' | 'sources' | 'dlq' | 'attestations' | 'activity' | 'orgs';
+export type DeveloperOpKind = 'read' | 'write';
+/** Which of the three entrypoints a developer op is (or should be) exposed on. */
+export interface DeveloperOpEntrypoints {
+    /** The shared Platform REST API (backs both the web UI and the `kici` CLI). */
+    http: boolean;
+    /** The `kici` CLI command tree. */
+    cli: boolean;
+    /** The developer MCP tool surface. */
+    mcp: boolean;
+    /** Curated: the op has a dashboard affordance (not machine-introspectable). */
+    ui: boolean;
+}
+export interface DeveloperOperation {
+    /** Stable id, e.g. 'runs.list', 'held-runs.approve'. Unique across the table. */
+    id: string;
+    domain: DeveloperOpDomain;
+    kind: DeveloperOpKind;
+    /** Intended entrypoint coverage — the contract the harness enforces. */
+    entrypoints: DeveloperOpEntrypoints;
+    /** False ⇒ never an MCP tool (secret-value write, destructive delete). */
+    mcpAppropriate: boolean;
+    /** MCP tool name when `entrypoints.mcp` is true; null otherwise. */
+    mcpTool: string | null;
+}
+/**
+ * The workflow-developer core. Developer plane only — org-membership-scoped,
+ * agent-attributed; never orchestrator-admin or tenant control-plane territory.
+ */
+export declare const DEVELOPER_OPERATIONS: readonly DeveloperOperation[];
+/** All ops a given entrypoint should expose. */
+export declare function developerOpsForEntrypoint(ep: keyof DeveloperOpEntrypoints): DeveloperOperation[];
+//# sourceMappingURL=operations.d.ts.map

package/dist/dev-ops/operations.js

@@ -0,0 +1,135 @@
+import "../rolldown-runtime-ClRpJifh.js";
+//#region src/dev-ops/operations.ts
+/** Build a row, defaulting every unspecified entrypoint to false. */
+function op(id, domain, kind, ep, mcpAppropriate, mcpTool) {
+	return {
+		id,
+		domain,
+		kind,
+		entrypoints: {
+			http: false,
+			cli: false,
+			mcp: false,
+			ui: false,
+			...ep
+		},
+		mcpAppropriate,
+		mcpTool
+	};
+}
+/**
+* The workflow-developer core. Developer plane only — org-membership-scoped,
+* agent-attributed; never orchestrator-admin or tenant control-plane territory.
+*/
+const DEVELOPER_OPERATIONS = [
+	op("runs.list", "runs", "read", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "list_runs"),
+	op("runs.get", "runs", "read", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "get_run"),
+	op("runs.stepLogs", "runs", "read", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "get_step_logs"),
+	op("runs.cancel", "runs", "write", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "cancel_run"),
+	op("runs.cancelByBranch", "runs", "write", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: false
+	}, true, "cancel_runs_by_branch"),
+	op("runs.rerun", "runs", "write", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "rerun_run"),
+	op("workflows.list", "workflows", "read", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "list_workflows"),
+	op("workflows.trigger", "workflows", "write", {
+		http: true,
+		cli: false,
+		mcp: true,
+		ui: true
+	}, true, "trigger_run"),
+	op("secrets.list", "secrets", "read", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "list_secrets"),
+	op("secrets.set", "secrets", "write", {
+		http: true,
+		cli: false,
+		mcp: false,
+		ui: true
+	}, false, null),
+	op("secrets.delete", "secrets", "write", {
+		http: true,
+		cli: false,
+		mcp: false,
+		ui: true
+	}, false, null),
+	op("environments.delete", "environments", "write", {
+		http: true,
+		cli: false,
+		mcp: false,
+		ui: true
+	}, false, null),
+	op("held-runs.approve", "held-runs", "write", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "approve_run"),
+	op("held-runs.reject", "held-runs", "write", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "reject_run"),
+	op("diagnostics.get", "diagnostics", "read", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "get_diagnostics"),
+	op("orchestrators.list", "orchestrators", "read", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "list_orchestrators"),
+	op("orgs.list", "orgs", "read", {
+		http: true,
+		cli: true,
+		mcp: true,
+		ui: true
+	}, true, "list_orgs")
+];
+/** All ops a given entrypoint should expose. */
+function developerOpsForEntrypoint(ep) {
+	return DEVELOPER_OPERATIONS.filter((o) => o.entrypoints[ep]);
+}
+//#endregion
+export { DEVELOPER_OPERATIONS, developerOpsForEntrypoint };
+
+//# sourceMappingURL=operations.js.map

package/dist/env/environment-allowlist.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/env/environment-allowlist.ts
 /**
 * Shared environment allowlist constants for KiCI.

package/dist/environment/host-match.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { matcherMatches } from "../labels-match.js";
 import { assertSafeRegex, toLabelMatcher } from "../labels/compile.js";
 //#region src/environment/host-match.ts

package/dist/environment/index.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { TrustTierSchema } from "./types.js";
 import { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix } from "./scope-resolver.js";
 import { EnvGateRejectReason, mergeOrderedMaps } from "./multi-env.js";

package/dist/environment/multi-env.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/environment/multi-env.ts
 /**

package/dist/environment/scope-resolver.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { hostSpecificity, matchHostPattern } from "./host-match.js";
 import { substituteScopePattern } from "./scope-template.js";
 import picomatch from "picomatch";

package/dist/environment/scope-template.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/environment/scope-template.ts
 /** A substituted value must be a single literal path segment — no `/` or glob. */
 const SAFE_SEGMENT = /^[A-Za-z0-9._-]+$/;

package/dist/environment/types.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/environment/types.ts
 /**

package/dist/fanout/materialize.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { applyIncludeExclude, expandMatrix } from "../matrix/expand.js";
 import { formatExpandedJobName } from "../matrix/format.js";
 //#region src/fanout/materialize.ts
@@ -118,7 +118,7 @@ function materializeResolvedMatrix(lockJob, combos) {
 	assignFanoutPositions(jobs, variantLabelOf);
 	return {
 		jobs,
-		expansionMap: new Map([[lockJob.name, jobs.map((j) => j.expandedName)]])
+		expansionMap: /* @__PURE__ */ new Map([[lockJob.name, jobs.map((j) => j.expandedName)]])
 	};
 }
 /**
@@ -163,7 +163,7 @@ function materializeResolvedHosts(lockJob, agents, maxHosts) {
 	assignFanoutPositions(jobs, (child) => child.pinnedAgentId ?? "");
 	return {
 		jobs,
-		expansionMap: new Map([[lockJob.name, jobs.map((j) => j.expandedName)]])
+		expansionMap: /* @__PURE__ */ new Map([[lockJob.name, jobs.map((j) => j.expandedName)]])
 	};
 }
 /**

package/dist/index.d.ts

@@ -9,15 +9,21 @@
  * - WebSocket close codes (unified across all tiers)
  */
 export * from './protocol/version.js';
+export * from './protocol/source-origin.js';
+export * from './provenance/attestation-origin.js';
 export * from './protocol/messages/common.js';
 export * from './protocol/messages/actor.js';
 export * from './protocol/messages/pat-kind.js';
 export * from './mcp/tool-schemas.js';
+export * from './mcp/held-run-resolve.js';
+export * from './mcp/fence.js';
 export * from './protocol/messages/auth.js';
 export * from './protocol/messages/capabilities.js';
 export { webhookRelaySchema, webhookRelayStartSchema, webhookRelayChunkSchema, webhookAckSchema, WebhookRelayResult, WEBHOOK_RELAY_MAX_BODY_BYTES, WEBHOOK_RELAY_CHUNK_SIZE, executionEventSchema, logChunkSchema, peerDiscoverSchema, peerUpdateSchema, cacheStatsSchema, orchMetricsSchema, platformToOrchestratorMessageSchema, orchestratorToPlatformMessageSchema, type WebhookRelay, type WebhookRelayStart, type WebhookRelayChunk, type WebhookAck, type LogChunk, type PeerDiscover, type PeerUpdate, type CacheStats, type OrchMetrics, trustPolicyUpdateSchema, type TrustPolicyUpdate, staleCheckrunCleanupSchema, type StaleCheckrunCleanup, type PlatformToOrchestratorMessage, type OrchestratorToPlatformMessage, } from './protocol/messages/platform-orchestrator.js';
 export * from './protocol/messages/execution-status.js';
 export * from './protocol/messages/agent-run-result.js';
+export * from './protocol/messages/agent-dev-ops.js';
+export * from './dev-ops/operations.js';
 export * from './protocol/messages/deployment-identity.js';
 export * from './protocol/messages/scaler-event.js';
 export * from './protocol/messages/event-log.js';
@@ -42,7 +48,7 @@ export * from './trigger/matcher.js';
 export * from './inputs/index.js';
 export * from './state-machine/index.js';
 export * from './provider/index.js';
-export { githubWebhookPath } from './webhook/webhook-url-format.js';
+export { githubWebhookPath, githubIngressPath } from './webhook/webhook-url-format.js';
 export type { WsLike } from './ws/ws-like.js';
 export * from './ws/close-codes.js';
 export { WsRateLimiter } from './ws/rate-limiter.js';

package/dist/index.js

@@ -1,13 +1,17 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 import { CheckMode, CheckStepOutcome } from "./check-mode.js";
 import { MIN_PROTOCOL_VERSION, PROTOCOL_VERSION } from "./protocol/version.js";
+import { SourceOrigin } from "./protocol/source-origin.js";
+import { AttestationOrigin } from "./provenance/attestation-origin.js";
 import { WS_MAX_PAYLOAD_BYTES, ackSchema, errorSchema, heartbeatSchema, nackSchema } from "./protocol/messages/common.js";
-import { ActorType, actorPrincipalSchema, apiKeyActorSchema, flattenActor, parseActor, platformOperatorActorSchema, serviceAccountActorSchema, stringifyActor, systemActorSchema, userActorSchema } from "./protocol/messages/actor.js";
+import { ActorType, actorPrincipalSchema, agentLabelOf, apiKeyActorSchema, flattenActor, parseActor, platformOperatorActorSchema, serviceAccountActorSchema, stringifyActor, systemActorSchema, userActorSchema } from "./protocol/messages/actor.js";
 import { PatKind } from "./protocol/messages/pat-kind.js";
-import { cancelRunToolSchema, getRunToolSchema, getStepLogsToolSchema, listRunsToolSchema, listWorkflowsToolSchema, rerunRunToolSchema, triggerRunToolSchema } from "./mcp/tool-schemas.js";
-import { CacheOutcome, CacheRunEventType, CacheStepType, ENVIRONMENTS_MAX, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, MAX_JOBS_PER_RUN, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, STATE_REPLAY_MAX_RUNS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema } from "./protocol/messages/execution-status.js";
+import { approveRunToolSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, getDiagnosticsToolSchema, getRunToolSchema, getStepLogsToolSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, rejectRunToolSchema, rerunRunToolSchema, triggerRunToolSchema } from "./mcp/tool-schemas.js";
+import { resolveHeldRunId } from "./mcp/held-run-resolve.js";
+import { renderFenced } from "./mcp/fence.js";
+import { CacheOutcome, CacheRunEventType, CacheStepType, ENVIRONMENTS_MAX, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, MAX_JOBS_PER_RUN, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, STATE_REPLAY_MAX_RUNS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplaySchema, statusOptionsForLevel, stepStatusForwardSchema } from "./protocol/messages/execution-status.js";
 import { TrustTierSchema } from "./environment/types.js";
-import { AgentFailureCategory, agentJobResultSchema, agentRunResultSchema, agentStepLogsSchema, agentStepResultSchema, untrusted, wrapUntrusted } from "./protocol/messages/agent-run-result.js";
+import { AgentFailureCategory, agentJobResultSchema, agentRunListItemSchema, agentRunResultSchema, agentStepLogsSchema, agentStepResultSchema, agentWorkflowSummarySchema, untrusted, wrapUntrusted } from "./protocol/messages/agent-run-result.js";
 import { AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, accessLogFilterSchema, accessLogItemSchema, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema } from "./protocol/messages/access-log.js";
 import { browserJobContextSchema, browserRunEventSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, jobContextMessageSchema, runEventMessageSchema } from "./protocol/messages/run-events.js";
 import { EventLogSource, EventLogStatus, PayloadOmittedReason } from "./protocol/messages/event-log.js";
@@ -18,10 +22,12 @@ import { ApprovalDecision, HoldScope, TriggerSource, approvalRequirementSchema,
 import { NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, resolveWhenToRunOn } from "./trigger/types.js";
 import { HostTargetSelector, HostTargetValue, LabelMatcher, compileRegexMatcher, hostSatisfiesTarget, matcherMatches, matcherSatisfiedBy, partitionMatchers } from "./labels-match.js";
 import { HostInventoryEntry, HostPropertyValue, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, coerceHostPropertyValue, parseHostPropertyAssignments } from "./inventory.js";
-import { DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EnvDeleteErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingEntrySchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
+import { DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EnvDeleteErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingEntrySchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
 import { ORCH_CAPABILITIES, OrchRole, hasOrchCapability, orchCapabilitiesSchema } from "./protocol/messages/capabilities.js";
 import { authFailureSchema, authRequestSchema, authSuccessSchema } from "./protocol/messages/auth.js";
 import { WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, cacheStatsSchema, executionEventSchema, logChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema } from "./protocol/messages/platform-orchestrator.js";
+import { agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentSecretScopeSchema } from "./protocol/messages/agent-dev-ops.js";
+import { DEVELOPER_OPERATIONS, developerOpsForEntrypoint } from "./dev-ops/operations.js";
 import { ScalerEventType } from "./protocol/messages/scaler-event.js";
 import { AccessLogPolicyKind, POLICY_BY_ACTION, fnv1a32, shouldRecordAccess, shouldRecordSecretResolve } from "./audit/access-log-policy.js";
 import { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, accessLogWarmSqlCase, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase } from "./audit/retention-policy.js";
@@ -31,7 +37,7 @@ import { EVENT_LOG_PAYLOAD_CHUNK_BYTES } from "./protocol/event-log-payload.js";
 import { browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, platformToBrowserMessageSchema } from "./protocol/messages/browser.js";
 import { joinRequestSchema, joinResponseSchema } from "./protocol/messages/join.js";
 import { fleetSelectionSchema, jobProgressAckSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema } from "./protocol/messages/peer.js";
-import { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema } from "./protocol/messages/orchestrator-agent.js";
+import { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema } from "./protocol/messages/orchestrator-agent.js";
 import { TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES } from "./trigger/trigger-event-type.js";
 import { createTraceEntry, createWorkflowDecision } from "./trigger/decision-trace.js";
 import { matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchWorkflowTriggers } from "./trigger/matcher.js";
@@ -46,8 +52,8 @@ import "./state-machine/index.js";
 import { LockFileParseError } from "./provider/lock-file-parse-error.js";
 import { CheckRunConclusion } from "./provider/check-run-conclusion.js";
 import "./provider/index.js";
-import { githubWebhookPath } from "./webhook/webhook-url-format.js";
-import { WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED } from "./ws/close-codes.js";
+import { githubIngressPath, githubWebhookPath } from "./webhook/webhook-url-format.js";
+import { WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_UNAUTHORIZED } from "./ws/close-codes.js";
 import { WsRateLimiter } from "./ws/rate-limiter.js";
 import { AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, KICI_AGENT_ENV_PREFIX, SANDBOX_DEFAULT_VARS } from "./env/environment-allowlist.js";
 import "./secrets/index.js";
@@ -62,4 +68,4 @@ import "./bundler/index.js";
 import { applyIncludeExclude, expandMatrix, expandMultiDimension, expandSingleDimension } from "./matrix/expand.js";
 import { formatExpandedJobName, formatMatrixSuffix } from "./matrix/format.js";
 import { FanoutCause, FanoutError, MAX_FANOUT_JOBS, VariantKind, fanoutEnvelopeFields, hostEnvelopeFields, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields } from "./fanout/materialize.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentFailureCategory, ApprovalDecision, CAPABILITY_LABEL_PREFIX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, ENVIRONMENTS_MAX, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EnvGateRejectReason, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, INIT_LABEL, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_CAPABILITIES, OnUnreachableMode, OrchRole, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PatKind, PayloadOmittedReason, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RegisterableTriggerType, RunsOnPick, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, StepApprovalOutcome, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TestRelayType, TimeoutReason, TriggerSource, TrustTierSchema, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentJobResultSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentRunResultSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approverClauseSchema, assertScheduleInputsSatisfiable, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, capabilityLabel, coerceDispatchInputs, coerceHostPropertyValue, compileRegexMatcher, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, envBindingEntrySchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubWebhookPath, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isInputSatisfiableFromDefaults, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, listRunsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rerunRunToolSchema, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForEnvironment, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, transition, triggerRunToolSchema, trustPolicyResponseSchema, trustPolicyUpdateSchema, untrusted, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, wrapUntrusted };
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentFailureCategory, ApprovalDecision, AttestationOrigin, CAPABILITY_LABEL_PREFIX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DEVELOPER_OPERATIONS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, ENVIRONMENTS_MAX, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EnvGateRejectReason, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, INIT_LABEL, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_CAPABILITIES, OnUnreachableMode, OrchRole, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PatKind, PayloadOmittedReason, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RegisterableTriggerType, RunsOnPick, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, ScalerBackendType, ScalerEventType, SourceOrigin, SourceProvider, SourceSubtype, StepApprovalOutcome, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TestRelayType, TimeoutReason, TriggerSource, TrustTierSchema, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentJobResultSchema, agentLabelOf, agentLogChunkSchema, agentMetricsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentRegisterSchema, agentRunListItemSchema, agentRunResultSchema, agentSecretScopeSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, agentWorkflowSummarySchema, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approveRunToolSchema, approverClauseSchema, assertScheduleInputsSatisfiable, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, capabilityLabel, coerceDispatchInputs, coerceHostPropertyValue, compileRegexMatcher, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, developerOpsForEntrypoint, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, envBindingEntrySchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getDiagnosticsToolSchema, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubIngressPath, githubWebhookPath, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isInputSatisfiableFromDefaults, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rejectRunToolSchema, renderFenced, rerunRunToolSchema, resolveHeldRunId, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForEnvironment, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, statusOptionsForLevel, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, transition, triggerRunToolSchema, trustPolicyResponseSchema, trustPolicyUpdateSchema, untrusted, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, wrapUntrusted };

package/dist/inputs/build.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/inputs/build.ts
 /** Build the base (unwrapped) coercing schema for a descriptor. */

package/dist/inputs/coerce.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { buildZodObjectFromMap } from "./build.js";
 //#region src/inputs/coerce.ts
 /** Structured rejection for invalid dispatch inputs (CLI + dashboard rendering). */

package/dist/inputs/descriptor.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/inputs/descriptor.ts
 /** The closed set of input value types persisted in the lockfile. */

package/dist/inputs/extract.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/inputs/extract.ts
 /** Thrown when a declared dispatch input falls outside the closed Zod subset. */
 var UnsupportedDispatchInputError = class extends Error {

package/dist/inputs/index.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { DispatchInputType, InputDescriptor, InputsDescriptorMapSchema } from "./descriptor.js";
 import { UnsupportedDispatchInputError, extractInputDescriptor, extractInputsDescriptorMap } from "./extract.js";
 import { buildZodFromDescriptor, buildZodObjectFromMap } from "./build.js";

package/dist/inputs/schedule.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { coerceDispatchInputs } from "./coerce.js";
 //#region src/inputs/schedule.ts
 /**

package/dist/inventory.js

@@ -1,4 +1,4 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 import { LabelMatcher } from "./labels-match.js";
 import { z } from "zod";
 //#region src/inventory.ts

package/dist/labels/compile.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import picomatch from "picomatch";
 import safeRegex from "safe-regex";
 //#region src/labels/compile.ts