@kici-dev/engine 0.1.24 → 0.1.26

package/dist/protocol/messages/dashboard.js

@@ -1,5 +1,7 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { CheckMode, CheckStepOutcome } from "../../check-mode.js";
+import { SourceOrigin } from "../source-origin.js";
+import { AttestationOrigin } from "../../provenance/attestation-origin.js";
 import { actorPrincipalSchema } from "./actor.js";
 import { StepConcurrencyKind, initFailureSchema } from "./execution-status.js";
 import { agentRunResultSchema } from "./agent-run-result.js";
@@ -49,7 +51,17 @@ const dashboardStepLogsRequestSchema = z.object({
 	actor: actorPrincipalSchema,
 	runId: z.string(),
 	jobId: z.string(),
-	stepIndex: z.number()
+	stepIndex: z.number(),
+	/**
+	* Optional line-offset cursor (a prior response's `nextCursor`). Absent reads
+	* from the start.
+	*/
+	cursor: z.string().optional(),
+	/**
+	* Optional max lines to return. Absent = unbounded (the human dashboard relies
+	* on this); the MCP layer opts into paging by sending an explicit limit.
+	*/
+	limit: z.number().int().positive().optional()
 });
 /** Step detail within a job response. */
 const dashboardStepDetailSchema = z.object({
@@ -100,6 +112,13 @@ const dashboardJobDetailSchema = z.object({
 	* entry marks an element resolved at runtime. null/absent = no binding.
 	*/
 	environments: z.array(z.string()).nullable().optional(),
+	/**
+	* Bound environments skipped on a test/local run (non-test or unconfigured).
+	* null/absent when nothing was skipped.
+	*/
+	skippedEnvironments: z.array(z.string()).nullable().optional(),
+	/** User-visible warning naming the skipped test-run environments. null/absent when none. */
+	envWarning: z.string().nullable().optional(),
 	/** Aggregated step outputs (step-keyed map). Present when job completed successfully with outputs. */
 	outputs: z.record(z.string(), z.record(z.string(), z.unknown())).nullable().optional(),
 	/** Secret output key names produced by this job (values are NOT included -- display masked). */
@@ -151,6 +170,8 @@ const dashboardStepLogsResponseSchema = z.object({
 	requestId: z.string(),
 	lines: z.array(z.string()),
 	totalLines: z.number(),
+	/** Next line-offset cursor, or null when the page reached the end. */
+	nextCursor: z.string().nullable().optional(),
 	error: z.string().optional()
 });
 /** Request the build-provenance attestations for a run. */
@@ -199,7 +220,19 @@ const attestationListItemSchema = z.object({
 	/** Stored server-side verdict — populated by the detail get (omitted per-run). */
 	verifyStatus: attestationVerifyStatusSchema.optional(),
 	/** First failure reason for the stored verdict, when failed (detail get only). */
-	verifyReason: z.string().nullable().optional()
+	verifyReason: z.string().nullable().optional(),
+	/**
+	* Source-origin brand: triggered vs kici run remote (local working-tree
+	* overlay). Read from the signed statement's internalParameters.
+	*/
+	sourceOrigin: SourceOrigin.optional(),
+	/** Authoritative origin: the customer's public org id (from the signed statement). */
+	originOrgId: z.string().optional(),
+	/**
+	* Mint-timing origin: live / deferred / offline-backfill. Read from the token
+	* claim or the signed statement's internalParameters; absent defaults to live.
+	*/
+	attestationOrigin: AttestationOrigin.optional()
 });
 /** Response with the run's attestations (correlates to dashboard.attestations.list). */
 const dashboardAttestationsListResponseSchema = z.object({
@@ -226,7 +259,19 @@ const attestationListSummarySchema = z.object({
 	verifyStatus: attestationVerifyStatusSchema,
 	verifyReason: z.string().nullable(),
 	repository: z.string().nullable(),
-	workflow: z.string().nullable()
+	workflow: z.string().nullable(),
+	/**
+	* Source-origin brand: triggered vs kici run remote (local working-tree
+	* overlay). Derived from the run's local_working_tree flag.
+	*/
+	sourceOrigin: SourceOrigin.optional(),
+	/** Mint-timing origin: live / deferred / offline-backfill. */
+	attestationOrigin: AttestationOrigin.optional(),
+	/**
+	* True for a row still in the deferred-attestation outbox (not yet minted):
+	* `verifyStatus: 'pending'`, no bundle. The page offers a retry action.
+	*/
+	pending: z.boolean().optional()
 });
 /** Filters for the org-wide attestations list. */
 const attestationListFiltersSchema = z.object({
@@ -272,6 +317,22 @@ const dashboardAttestationGetResponseSchema = z.object({
 	attestation: attestationListItemSchema.nullable(),
 	error: z.string().optional()
 });
+/** Request an on-demand drain of the deferred-attestation outbox (optionally one run). */
+const dashboardAttestationRetryRequestSchema = z.object({
+	type: z.literal("dashboard.attestation.retry"),
+	requestId: z.string(),
+	actor: actorPrincipalSchema,
+	/** Scope to a single run; omitted drains every pending attestation. */
+	runId: z.string().optional()
+});
+/** Response with the drain counts. */
+const dashboardAttestationRetryResponseSchema = z.object({
+	type: z.literal("dashboard.attestation.retry.response"),
+	requestId: z.string(),
+	minted: z.number().int(),
+	stillPending: z.number().int(),
+	error: z.string().optional()
+});
 /**
 * Run-summary projection from the orchestrator's execution_runs table.
 *
@@ -301,7 +362,9 @@ const dashboardRunSummarySchema = z.object({
 	parentRunId: z.string().optional(),
 	originalRunId: z.string().optional(),
 	triggeredBy: z.string().optional(),
+	triggeredByAgentLabel: z.string().nullable().optional(),
 	cancelledBy: z.string().optional(),
+	cancelledByAgentLabel: z.string().nullable().optional(),
 	failureReason: z.string().optional(),
 	hadCompileJob: z.boolean().optional(),
 	compileJobId: z.string().optional(),
@@ -411,7 +474,9 @@ const manualScheduleRequestSchema = z.object({
 	type: z.literal("run.manual_schedule.request"),
 	requestId: z.string(),
 	actor: actorPrincipalSchema,
-	registrationId: z.string()
+	registrationId: z.string(),
+	/** Agent provenance label when triggered through an agent credential. */
+	triggeredByAgentLabel: z.string().nullable().optional()
 });
 /** Response to a manual schedule trigger request. */
 const manualScheduleResponseSchema = z.object({
@@ -1055,12 +1120,12 @@ const envSecretScopeDeleteResponseSchema = z.object({
 	requestId: z.string(),
 	error: z.string().optional()
 });
-/** Fetch runs that targeted a specific environment. */
+/** Fetch runs that targeted a specific environment, keyed by environment id. */
 const envHistoryRequestSchema = z.object({
 	type: z.literal("dashboard.environments.history"),
 	requestId: z.string(),
 	actor: actorPrincipalSchema,
-	environmentName: z.string(),
+	environmentId: z.string(),
 	limit: z.number().optional(),
 	offset: z.number().optional()
 });
@@ -1096,7 +1161,17 @@ const heldRunsListRequestSchema = z.object({
 	actor: actorPrincipalSchema,
 	status: HeldRunStatus.optional(),
 	queueType: HeldRunQueueType.optional(),
-	runId: z.string().optional()
+	runId: z.string().optional(),
+	/**
+	* Target org the read must be scoped to, carried per-request by the Platform
+	* (the validated `:orgId` path param). The orchestrator honors this over its
+	* static connection-level org so a Platform-first `kici run remote` org —
+	* anchored only by `remote_sources` — sees its own held runs even when the
+	* orchestrator's connection also serves a webhook source for a different org.
+	* Absent on the legacy customer-dashboard path, where the connection org is
+	* already the request org.
+	*/
+	orgId: z.string().optional()
 });
 const heldRunsListResponseSchema = z.object({
 	type: z.literal("dashboard.held-runs.list.response"),
@@ -1148,7 +1223,15 @@ const heldRunApproveRequestSchema = z.object({
 	* is still enforced (this only changes the audit action to
 	* `held_run.auto_approve`); it is never a bypass.
 	*/
-	autoApprove: z.boolean().optional()
+	autoApprove: z.boolean().optional(),
+	/**
+	* Target org the decision must be scoped to, carried per-request by the
+	* Platform (the validated `:orgId` path param). Honored over the static
+	* connection-level org so a remote run's hold — recorded under the run's own
+	* `remote_sources` org — is resolvable even when the orchestrator's
+	* connection also serves a webhook source for a different org.
+	*/
+	orgId: z.string().optional()
 });
 const heldRunApproveResponseSchema = z.object({
 	type: z.literal("dashboard.held-runs.approve.response"),
@@ -1161,7 +1244,15 @@ const heldRunRejectRequestSchema = z.object({
 	requestId: z.string(),
 	actor: actorPrincipalSchema,
 	heldRunId: z.string(),
-	reason: z.string().optional()
+	reason: z.string().optional(),
+	/**
+	* Target org the decision must be scoped to, carried per-request by the
+	* Platform (the validated `:orgId` path param). Honored over the static
+	* connection-level org so a remote run's hold — recorded under the run's own
+	* `remote_sources` org — is resolvable even when the orchestrator's
+	* connection also serves a webhook source for a different org.
+	*/
+	orgId: z.string().optional()
 });
 const heldRunRejectResponseSchema = z.object({
 	type: z.literal("dashboard.held-runs.reject.response"),
@@ -1705,6 +1796,8 @@ const testRelayTriggerResponseSchema = z.object({
 	status: z.enum(["accepted", "rejected"]).optional(),
 	reason: z.string().optional(),
 	jobIds: z.array(z.string()).optional(),
+	/** User-visible warnings on acceptance (e.g. skipped non-test bound environments). */
+	warnings: z.array(z.string()).optional(),
 	error: z.string().optional()
 });
 /** Request a snapshot of a run's status. */
@@ -1770,6 +1863,7 @@ const dashboardPlatformToOrchSchema = z.discriminatedUnion("type", [
 	dashboardAttestationsListRequestSchema,
 	dashboardAttestationsListAllRequestSchema,
 	dashboardAttestationGetRequestSchema,
+	dashboardAttestationRetryRequestSchema,
 	dashboardRunsListRequestSchema,
 	dashboardRunsFiltersRequestSchema,
 	dashboardSourcesListRequestSchema,
@@ -1843,6 +1937,7 @@ const dashboardOrchToPlatformSchema = z.discriminatedUnion("type", [
 	dashboardAttestationsListResponseSchema,
 	dashboardAttestationsListAllResponseSchema,
 	dashboardAttestationGetResponseSchema,
+	dashboardAttestationRetryResponseSchema,
 	dashboardRunsListResponseSchema,
 	dashboardRunsFiltersResponseSchema,
 	dashboardSourcesListResponseSchema,
@@ -1925,7 +2020,9 @@ const dashboardRunDetailApiResponseSchema = z.object({
 /** REST API response for step logs. */
 const dashboardStepLogsApiResponseSchema = z.object({
 	lines: z.array(z.string()),
-	totalLines: z.number()
+	totalLines: z.number(),
+	/** Next line-offset cursor, or null when the page reached the end. */
+	nextCursor: z.string().nullable().optional()
 });
 /**
 * REST API response for the run attestations list. The orchestrator-relayed
@@ -1972,8 +2069,10 @@ const runListItemSchema = z.object({
 	parentRunId: z.string().nullable(),
 	originalRunId: z.string().nullable(),
 	triggeredBy: z.string().nullable(),
+	triggeredByAgentLabel: z.string().nullable().optional(),
 	triggeredByUser: runListPrincipalUserSchema.nullable(),
 	cancelledBy: z.string().nullable(),
+	cancelledByAgentLabel: z.string().nullable().optional(),
 	cancelledByUser: runListPrincipalUserSchema.nullable(),
 	failureReason: z.string().optional(),
 	hadCompileJob: z.boolean(),
@@ -2186,6 +2285,6 @@ const DashboardResponseErrorCode = z.enum([
 	"internal_error"
 ]);
 //#endregion
-export { DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EnvDeleteErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingEntrySchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema };
+export { DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EnvDeleteErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingEntrySchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema };
 
 //# sourceMappingURL=dashboard.js.map

package/dist/protocol/messages/deployment-identity.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/protocol/messages/deployment-identity.ts
 /** How the orchestrator process itself was deployed (not how it runs agents). */

package/dist/protocol/messages/event-log.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/protocol/messages/event-log.ts
 /**

package/dist/protocol/messages/execution-status.d.ts

@@ -48,6 +48,16 @@ export declare const ExecutionJobStatus: z.ZodEnum<{
     drift_dropped: "drift_dropped";
 }>;
 export type ExecutionJobStatus = z.infer<typeof ExecutionJobStatus>;
+/**
+ * The status values a notification subscription may target at the given level.
+ *
+ * A run-level subscription matches against an `ExecutionRunStatus`; a job-level
+ * subscription matches against an `ExecutionJobStatus` (which carries job-only
+ * terminal states like `timed_out_stale` / `drift_dropped` / `skipped`). Both
+ * the Platform validation and the dashboard editor derive their allowed set
+ * from this single helper so server validation and UI options cannot diverge.
+ */
+export declare function statusOptionsForLevel(level: 'run' | 'job'): readonly string[];
 /**
  * Status values for execution steps (execution_steps table + step.status protocol messages).
  *
@@ -158,8 +168,8 @@ export type CacheOutcome = z.infer<typeof CacheOutcome>;
 /** Structured init-failure signal. Presence on a run/job means "never started". */
 export declare const initFailureSchema: z.ZodObject<{
     scope: z.ZodEnum<{
-        run: "run";
         job: "job";
+        run: "run";
     }>;
     category: z.ZodEnum<{
         secret_resolution: "secret_resolution";
@@ -209,6 +219,7 @@ export declare const executionStatusSchema: z.ZodObject<{
     parentRunId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     originalRunId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     triggeredBy: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    triggeredByAgentLabel: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     triggerActorProvider: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     triggerActorUsername: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     triggerActorUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -216,8 +227,8 @@ export declare const executionStatusSchema: z.ZodObject<{
     logBytes: z.ZodOptional<z.ZodNumber>;
     initFailure: z.ZodOptional<z.ZodObject<{
         scope: z.ZodEnum<{
-            run: "run";
             job: "job";
+            run: "run";
         }>;
         category: z.ZodEnum<{
             secret_resolution: "secret_resolution";
@@ -293,8 +304,8 @@ export declare const jobStatusForwardSchema: z.ZodObject<{
     timestamp: z.ZodNumber;
     initFailure: z.ZodOptional<z.ZodObject<{
         scope: z.ZodEnum<{
-            run: "run";
             job: "job";
+            run: "run";
         }>;
         category: z.ZodEnum<{
             secret_resolution: "secret_resolution";
@@ -339,6 +350,7 @@ export declare const stateReplaySchema: z.ZodObject<{
         parentRunId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         originalRunId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         triggeredBy: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        triggeredByAgentLabel: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         failureReason: z.ZodOptional<z.ZodString>;
         jobs: z.ZodArray<z.ZodObject<{
             jobId: z.ZodString;

package/dist/protocol/messages/execution-status.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/protocol/messages/execution-status.ts
 /** Max length for ids and short identifier fields (runId, jobId, sha, ref, …). */
@@ -49,6 +49,18 @@ const ExecutionJobStatus = z.enum([
 	"drift_dropped"
 ]);
 /**
+* The status values a notification subscription may target at the given level.
+*
+* A run-level subscription matches against an `ExecutionRunStatus`; a job-level
+* subscription matches against an `ExecutionJobStatus` (which carries job-only
+* terminal states like `timed_out_stale` / `drift_dropped` / `skipped`). Both
+* the Platform validation and the dashboard editor derive their allowed set
+* from this single helper so server validation and UI options cannot diverge.
+*/
+function statusOptionsForLevel(level) {
+	return level === "job" ? ExecutionJobStatus.options : ExecutionRunStatus.options;
+}
+/**
 * Status values for execution steps (execution_steps table + step.status protocol messages).
 *
 *  - `pending`   — a parallel-group child queued behind `maxParallel`, not yet launched.
@@ -149,13 +161,13 @@ const initFailureSchema = z.object({
 	jobName: z.string().max(128).optional()
 });
 /** Terminal run states that indicate the run has completed. */
-const TERMINAL_RUN_STATES = new Set([
+const TERMINAL_RUN_STATES = /* @__PURE__ */ new Set([
 	ExecutionRunStatus.enum.success,
 	ExecutionRunStatus.enum.failed,
 	ExecutionRunStatus.enum.cancelled
 ]);
 /** Terminal job states that indicate the job is no longer running. */
-const TERMINAL_JOB_STATES = new Set([
+const TERMINAL_JOB_STATES = /* @__PURE__ */ new Set([
 	ExecutionJobStatus.enum.success,
 	ExecutionJobStatus.enum.failed,
 	ExecutionJobStatus.enum.cancelled,
@@ -197,6 +209,8 @@ const executionStatusSchema = z.object({
 	originalRunId: z.string().max(128).nullable().optional(),
 	/** User identity that triggered this re-run (null/undefined for webhook-triggered). */
 	triggeredBy: z.string().max(128).nullable().optional(),
+	/** Agent provenance label when the run was triggered through an agent credential. */
+	triggeredByAgentLabel: z.string().max(128).nullable().optional(),
 	/**
 	* Triggering-actor identity captured from the provider event (the pusher / PR
 	* author), distinct from `triggeredBy` (the KiCI re-run user). Provider
@@ -294,6 +308,7 @@ const stateReplaySchema = z.object({
 		parentRunId: z.string().max(128).nullable().optional(),
 		originalRunId: z.string().max(128).nullable().optional(),
 		triggeredBy: z.string().max(128).nullable().optional(),
+		triggeredByAgentLabel: z.string().max(128).nullable().optional(),
 		/** Human-readable reason why the run failed (only present for failed runs). */
 		failureReason: z.string().max(STATUS_FREE_TEXT_MAX).optional(),
 		jobs: z.array(z.object({
@@ -312,6 +327,6 @@ const stateReplaySchema = z.object({
 	timestamp: z.number()
 });
 //#endregion
-export { CacheOutcome, CacheRunEventType, CacheStepType, ENVIRONMENTS_MAX, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, MAX_JOBS_PER_RUN, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, STATE_REPLAY_MAX_RUNS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema };
+export { CacheOutcome, CacheRunEventType, CacheStepType, ENVIRONMENTS_MAX, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, MAX_JOBS_PER_RUN, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, STATE_REPLAY_MAX_RUNS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplaySchema, statusOptionsForLevel, stepStatusForwardSchema };
 
 //# sourceMappingURL=execution-status.js.map

package/dist/protocol/messages/join.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/protocol/messages/join.ts
 /** Join request sent by a new orchestrator (via Platform relay or direct peer). */

package/dist/protocol/messages/log-pull.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/protocol/messages/log-pull.ts
 /** Request historical logs for a completed or running execution. */

package/dist/protocol/messages/oidc-mint.d.ts

@@ -0,0 +1,51 @@
+import { z } from 'zod';
+/**
+ * Error discriminator for a failed provenance mint, carried on
+ * `oidc.mint.response.error.code`. Mirrors the three orchestrator-side error
+ * classes that consume it:
+ *   rejected    -> run/job missing or job terminal (MintRejectedError)
+ *   unavailable -> the Platform signer/issuer is not configured (MintUnavailableError)
+ *   failed      -> any other Platform-side failure (MintRelayError)
+ */
+export declare const OidcMintErrorCode: z.ZodEnum<{
+    failed: "failed";
+    rejected: "rejected";
+    unavailable: "unavailable";
+}>;
+export type OidcMintErrorCode = z.infer<typeof OidcMintErrorCode>;
+/** orchestrator -> Platform: request a short-lived OIDC ID token for a job. */
+export declare const oidcMintRequestSchema: z.ZodObject<{
+    type: z.ZodLiteral<"oidc.mint.request">;
+    requestId: z.ZodString;
+    orchestratorId: z.ZodString;
+    runId: z.ZodString;
+    jobId: z.ZodString;
+    audience: z.ZodString;
+    deferred: z.ZodOptional<z.ZodLiteral<true>>;
+    statementHash: z.ZodOptional<z.ZodString>;
+    origin: z.ZodOptional<z.ZodEnum<{
+        deferred: "deferred";
+        "offline-backfill": "offline-backfill";
+    }>>;
+}, z.core.$strip>;
+export type OidcMintRequest = z.infer<typeof oidcMintRequestSchema>;
+/** Platform -> orchestrator: the minted token or a typed error (exactly one). */
+export declare const oidcMintResponseSchema: z.ZodObject<{
+    type: z.ZodLiteral<"oidc.mint.response">;
+    requestId: z.ZodString;
+    result: z.ZodOptional<z.ZodObject<{
+        token: z.ZodString;
+        expiresIn: z.ZodNumber;
+        jti: z.ZodString;
+    }, z.core.$strip>>;
+    error: z.ZodOptional<z.ZodObject<{
+        code: z.ZodEnum<{
+            failed: "failed";
+            rejected: "rejected";
+            unavailable: "unavailable";
+        }>;
+        message: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type OidcMintResponse = z.infer<typeof oidcMintResponseSchema>;
+//# sourceMappingURL=oidc-mint.d.ts.map

package/dist/protocol/messages/oidc-mint.js

@@ -0,0 +1,55 @@
+import "../../rolldown-runtime-ClRpJifh.js";
+import { AttestationOrigin } from "../../provenance/attestation-origin.js";
+import { z } from "zod";
+//#region src/protocol/messages/oidc-mint.ts
+/**
+* Error discriminator for a failed provenance mint, carried on
+* `oidc.mint.response.error.code`. Mirrors the three orchestrator-side error
+* classes that consume it:
+*   rejected    -> run/job missing or job terminal (MintRejectedError)
+*   unavailable -> the Platform signer/issuer is not configured (MintUnavailableError)
+*   failed      -> any other Platform-side failure (MintRelayError)
+*/
+const OidcMintErrorCode = z.enum([
+	"rejected",
+	"unavailable",
+	"failed"
+]);
+/** orchestrator -> Platform: request a short-lived OIDC ID token for a job. */
+const oidcMintRequestSchema = z.object({
+	type: z.literal("oidc.mint.request"),
+	requestId: z.string().min(1),
+	orchestratorId: z.string().min(1),
+	runId: z.string().min(1),
+	jobId: z.string().min(1),
+	audience: z.string().min(1).max(255),
+	/**
+	* Deferred fulfilment (attest-later): when true, the mint knowingly targets a
+	* completed job and binds `statementHash` + `origin` into the token. Absent
+	* for the live agent path. `orgId` is never on the wire — the Platform derives
+	* it from the authenticated connection.
+	*/
+	deferred: z.literal(true).optional(),
+	/** SHA-256 of the frozen DSSE statement the deferred token binds to. */
+	statementHash: z.string().optional(),
+	/** Mint-timing origin for a deferred fulfilment (never `live` here). */
+	origin: AttestationOrigin.extract(["deferred", "offline-backfill"]).optional()
+});
+/** Platform -> orchestrator: the minted token or a typed error (exactly one). */
+const oidcMintResponseSchema = z.object({
+	type: z.literal("oidc.mint.response"),
+	requestId: z.string().min(1),
+	result: z.object({
+		token: z.string().min(1),
+		expiresIn: z.number().int().positive(),
+		jti: z.string().min(1)
+	}).optional(),
+	error: z.object({
+		code: OidcMintErrorCode,
+		message: z.string()
+	}).optional()
+}).refine((m) => m.result === void 0 !== (m.error === void 0), { message: "oidc.mint.response must carry exactly one of result | error" });
+//#endregion
+export { OidcMintErrorCode, oidcMintRequestSchema, oidcMintResponseSchema };
+
+//# sourceMappingURL=oidc-mint.js.map

package/dist/protocol/messages/oidc-token-relay.d.ts

@@ -18,14 +18,41 @@ export declare const oidcTokenRequestParamsSchema: z.ZodObject<{
     audience: z.ZodString;
 }, z.core.$strip>;
 export type OidcTokenRequestParams = z.infer<typeof oidcTokenRequestParamsSchema>;
+export { OidcMintErrorCode } from './oidc-mint.js';
+export type { OidcMintErrorCode as OidcMintErrorCodeType } from './oidc-mint.js';
+/** A successfully minted ID token bound to a job. */
+export declare const oidcMintedTokenSchema: z.ZodObject<{
+    token: z.ZodString;
+    expiresIn: z.ZodNumber;
+    jti: z.ZodString;
+}, z.core.$strip>;
+export type OidcMintedToken = z.infer<typeof oidcMintedTokenSchema>;
 /**
- * Result the orchestrator returns to the agent: the minted short-lived JWT
- * plus its lifetime and identifier.
+ * Result the orchestrator returns to the agent: either the minted short-lived
+ * JWT, or — when the mint failed transiently (`unavailable`/`failed`, never
+ * `rejected`) — a `deferred` signal so the agent freezes the statement and
+ * reports it for later fulfilment. A permanent `rejected` is thrown, never
+ * returned, so it is not part of this union.
  */
-export declare const oidcTokenResultSchema: z.ZodObject<{
+export declare const oidcTokenResultSchema: z.ZodUnion<readonly [z.ZodObject<{
     token: z.ZodString;
     expiresIn: z.ZodNumber;
     jti: z.ZodString;
-}, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    deferred: z.ZodLiteral<true>;
+    code: z.ZodEnum<{
+        failed: "failed";
+        unavailable: "unavailable";
+    }>;
+}, z.core.$strip>]>;
 export type OidcTokenResult = z.infer<typeof oidcTokenResultSchema>;
+/** Extra fields a deferred *fulfilment* mint carries (orchestrator -> Platform). */
+export declare const deferredMintParamsSchema: z.ZodObject<{
+    statementHash: z.ZodString;
+    origin: z.ZodEnum<{
+        deferred: "deferred";
+        "offline-backfill": "offline-backfill";
+    }>;
+}, z.core.$strip>;
+export type DeferredMintParams = z.infer<typeof deferredMintParamsSchema>;
 //# sourceMappingURL=oidc-token-relay.d.ts.map

package/dist/protocol/messages/oidc-token-relay.js

@@ -1,4 +1,6 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
+import { AttestationOrigin } from "../../provenance/attestation-origin.js";
+import { OidcMintErrorCode } from "./oidc-mint.js";
 import { z } from "zod";
 //#region src/protocol/messages/oidc-token-relay.ts
 /**
@@ -19,16 +21,29 @@ const oidcTokenRequestParamsSchema = z.object({
 	jobId: z.string().min(1),
 	audience: z.string().min(1).max(255)
 });
-/**
-* Result the orchestrator returns to the agent: the minted short-lived JWT
-* plus its lifetime and identifier.
-*/
-const oidcTokenResultSchema = z.object({
+/** A successfully minted ID token bound to a job. */
+const oidcMintedTokenSchema = z.object({
 	token: z.string(),
 	expiresIn: z.number().int().positive(),
 	jti: z.string()
 });
+/**
+* Result the orchestrator returns to the agent: either the minted short-lived
+* JWT, or — when the mint failed transiently (`unavailable`/`failed`, never
+* `rejected`) — a `deferred` signal so the agent freezes the statement and
+* reports it for later fulfilment. A permanent `rejected` is thrown, never
+* returned, so it is not part of this union.
+*/
+const oidcTokenResultSchema = z.union([oidcMintedTokenSchema, z.object({
+	deferred: z.literal(true),
+	code: z.enum(["unavailable", "failed"])
+})]);
+/** Extra fields a deferred *fulfilment* mint carries (orchestrator -> Platform). */
+const deferredMintParamsSchema = z.object({
+	statementHash: z.string(),
+	origin: AttestationOrigin.extract(["deferred", "offline-backfill"])
+});
 //#endregion
-export { OIDC_TOKEN_REQUEST_METHOD, oidcTokenRequestParamsSchema, oidcTokenResultSchema };
+export { OIDC_TOKEN_REQUEST_METHOD, OidcMintErrorCode, deferredMintParamsSchema, oidcMintedTokenSchema, oidcTokenRequestParamsSchema, oidcTokenResultSchema };
 
 //# sourceMappingURL=oidc-token-relay.js.map