@kici-dev/engine 0.1.26 → 0.1.27

package/dist/env/environment-allowlist.js

@@ -74,7 +74,41 @@ const AGENT_REQUIRED_KICI_VARS = [
 *   -> HTTP_PROXY=http://proxy:3128 in the agent process
 */
 const KICI_AGENT_ENV_PREFIX = "KICI_AGENT_ENV_";
+/**
+* Non-`KICI_`-prefixed environment variables that are the agent's / orchestrator's
+* own infrastructure secrets. These are scrubbed from a trusted-env passthrough
+* in addition to the whole `KICI_*` namespace, so even a trusted fleet agent
+* never leaks its control-plane credentials into a workflow step.
+*/
+const TRUSTED_ENV_SCRUB_EXACT = [
+	"DATABASE_URL",
+	"PLATFORM_TOKEN",
+	"WEBHOOK_SECRET",
+	"GITHUB_PRIVATE_KEY"
+];
+/**
+* A variable that must NEVER reach a workflow step even under the trusted-env
+* profile. The agent's entire `KICI_*` namespace (its orchestrator URL, agent
+* token, secret key, bootstrap admin token, scaler internals, identity) is
+* scrubbed, plus the non-`KICI_` infra-secret denylist above. So "trusted"
+* means "host env yes, the agent's KiCI identity no".
+*/
+function isTrustedEnvScrubbed(key) {
+	return key.startsWith("KICI_") || TRUSTED_ENV_SCRUB_EXACT.includes(key);
+}
+/**
+* Build the trusted-env passthrough set: every defined entry of `source` whose
+* key is not scrubbed by `isTrustedEnvScrubbed`. Used by both env-narrowing
+* layers (scaler → agent process, agent → step) when the trusted-env profile is
+* active, so the ambient host env reaches the step minus the agent's own KiCI
+* identity/operational secrets.
+*/
+function buildTrustedPassthroughEnv(source) {
+	const out = {};
+	for (const [key, value] of Object.entries(source)) if (value !== void 0 && !isTrustedEnvScrubbed(key)) out[key] = value;
+	return out;
+}
 //#endregion
-export { AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, KICI_AGENT_ENV_PREFIX, SANDBOX_DEFAULT_VARS };
+export { AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, KICI_AGENT_ENV_PREFIX, SANDBOX_DEFAULT_VARS, TRUSTED_ENV_SCRUB_EXACT, buildTrustedPassthroughEnv, isTrustedEnvScrubbed };
 
 //# sourceMappingURL=environment-allowlist.js.map

package/dist/fanout/materialize.js

@@ -52,8 +52,8 @@ var FanoutError = class FanoutError extends Error {
 * multi-child fan-out. `fanoutIndex` is the child's rank in the order defined by
 * `keyOf` (host: `agentId`; matrix: variant label), independent of emission
 * order — the orchestrator's wave dispatch keys on `fanoutIndex`, so emission
-* order need not be touched (this preserves the local-executor matrix naming
-* order). A single child gets no position (non-fan-out job; `ctx.fanout` stays
+* order need not be touched (this preserves the matrix naming order). A single
+* child gets no position (non-fan-out job; `ctx.fanout` stays
 * undefined). Mutates and returns the same array.
 */
 function assignFanoutPositions(children, keyOf) {

package/dist/index.d.ts

@@ -55,7 +55,7 @@ export { WsRateLimiter } from './ws/rate-limiter.js';
 export type { RateLimiterConfig, RateLimitResult } from './ws/rate-limiter.js';
 export * from './env/environment-allowlist.js';
 export * from './secrets/index.js';
-export * from './environment/index.js';
+export * from './context/index.js';
 export { deriveOsArchLabels, hostLabel, parseHostLabel, HOST_LABEL_PREFIX, agentTypeLabel, scalerLabel, mergeAutoLabels, normalizeRunsOn, KNOWN_ROLES, resolveRoleLabels, validateNoReservedLabels, scalerAgentLabels, isSelfReportedLabel, SELF_REPORTED_LABEL_PREFIXES, CAPABILITY_LABEL_PREFIX, capabilityLabel, SSH_TRANSPORT_CAPABILITY, INIT_LABEL, PRIVILEGED_ROOT_LABEL, } from './labels.js';
 export type { NormalizedRunsOn } from './labels.js';
 export type { AgentRole } from './labels.js';

package/dist/index.js

@@ -9,8 +9,8 @@ import { PatKind } from "./protocol/messages/pat-kind.js";
 import { approveRunToolSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, getDiagnosticsToolSchema, getRunToolSchema, getStepLogsToolSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, rejectRunToolSchema, rerunRunToolSchema, triggerRunToolSchema } from "./mcp/tool-schemas.js";
 import { resolveHeldRunId } from "./mcp/held-run-resolve.js";
 import { renderFenced } from "./mcp/fence.js";
-import { CacheOutcome, CacheRunEventType, CacheStepType, ENVIRONMENTS_MAX, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, MAX_JOBS_PER_RUN, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, STATE_REPLAY_MAX_RUNS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplaySchema, statusOptionsForLevel, stepStatusForwardSchema } from "./protocol/messages/execution-status.js";
-import { TrustTierSchema } from "./environment/types.js";
+import { CONTEXTS_MAX, CacheOutcome, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, MAX_JOBS_PER_RUN, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, STATE_REPLAY_MAX_RUNS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplaySchema, statusOptionsForLevel, stepStatusForwardSchema } from "./protocol/messages/execution-status.js";
+import { TrustTierSchema } from "./context/types.js";
 import { AgentFailureCategory, agentJobResultSchema, agentRunListItemSchema, agentRunResultSchema, agentStepLogsSchema, agentStepResultSchema, agentWorkflowSummarySchema, untrusted, wrapUntrusted } from "./protocol/messages/agent-run-result.js";
 import { AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, accessLogFilterSchema, accessLogItemSchema, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema } from "./protocol/messages/access-log.js";
 import { browserJobContextSchema, browserRunEventSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, jobContextMessageSchema, runEventMessageSchema } from "./protocol/messages/run-events.js";
@@ -22,7 +22,7 @@ import { ApprovalDecision, HoldScope, TriggerSource, approvalRequirementSchema,
 import { NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, resolveWhenToRunOn } from "./trigger/types.js";
 import { HostTargetSelector, HostTargetValue, LabelMatcher, compileRegexMatcher, hostSatisfiesTarget, matcherMatches, matcherSatisfiedBy, partitionMatchers } from "./labels-match.js";
 import { HostInventoryEntry, HostPropertyValue, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, coerceHostPropertyValue, parseHostPropertyAssignments } from "./inventory.js";
-import { DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EnvDeleteErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingEntrySchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
+import { ContextDeleteErrorCode, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
 import { ORCH_CAPABILITIES, OrchRole, hasOrchCapability, orchCapabilitiesSchema } from "./protocol/messages/capabilities.js";
 import { authFailureSchema, authRequestSchema, authSuccessSchema } from "./protocol/messages/auth.js";
 import { WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, cacheStatsSchema, executionEventSchema, logChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema } from "./protocol/messages/platform-orchestrator.js";
@@ -55,11 +55,11 @@ import "./provider/index.js";
 import { githubIngressPath, githubWebhookPath } from "./webhook/webhook-url-format.js";
 import { WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_UNAUTHORIZED } from "./ws/close-codes.js";
 import { WsRateLimiter } from "./ws/rate-limiter.js";
-import { AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, KICI_AGENT_ENV_PREFIX, SANDBOX_DEFAULT_VARS } from "./env/environment-allowlist.js";
+import { AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, KICI_AGENT_ENV_PREFIX, SANDBOX_DEFAULT_VARS, TRUSTED_ENV_SCRUB_EXACT, buildTrustedPassthroughEnv, isTrustedEnvScrubbed } from "./env/environment-allowlist.js";
 import "./secrets/index.js";
-import { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix } from "./environment/scope-resolver.js";
-import { EnvGateRejectReason, mergeOrderedMaps } from "./environment/multi-env.js";
-import "./environment/index.js";
+import { matchScopePattern, resolveSecretsForContext, stripScopePrefix } from "./context/scope-resolver.js";
+import { ContextGateRejectReason, mergeOrderedMaps } from "./context/multi-context.js";
+import "./context/index.js";
 import { CAPABILITY_LABEL_PREFIX, HOST_LABEL_PREFIX, INIT_LABEL, KNOWN_ROLES, PRIVILEGED_ROOT_LABEL, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, agentTypeLabel, capabilityLabel, deriveOsArchLabels, hostLabel, isSelfReportedLabel, mergeAutoLabels, normalizeRunsOn, parseHostLabel, resolveRoleLabels, scalerAgentLabels, scalerLabel, validateNoReservedLabels } from "./labels.js";
 import { parseMemoryString, resourceRequestNestedSchema, resourceSpecSchema, validateResourceRequest } from "./scaler/resource-types.js";
 import { RegisterableTriggerType } from "./registration/registerable-trigger-type.js";
@@ -68,4 +68,4 @@ import "./bundler/index.js";
 import { applyIncludeExclude, expandMatrix, expandMultiDimension, expandSingleDimension } from "./matrix/expand.js";
 import { formatExpandedJobName, formatMatrixSuffix } from "./matrix/format.js";
 import { FanoutCause, FanoutError, MAX_FANOUT_JOBS, VariantKind, fanoutEnvelopeFields, hostEnvelopeFields, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields } from "./fanout/materialize.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentFailureCategory, ApprovalDecision, AttestationOrigin, CAPABILITY_LABEL_PREFIX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DEVELOPER_OPERATIONS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, ENVIRONMENTS_MAX, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EnvGateRejectReason, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, INIT_LABEL, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_CAPABILITIES, OnUnreachableMode, OrchRole, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PatKind, PayloadOmittedReason, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RegisterableTriggerType, RunsOnPick, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, ScalerBackendType, ScalerEventType, SourceOrigin, SourceProvider, SourceSubtype, StepApprovalOutcome, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TestRelayType, TimeoutReason, TriggerSource, TrustTierSchema, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentJobResultSchema, agentLabelOf, agentLogChunkSchema, agentMetricsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentRegisterSchema, agentRunListItemSchema, agentRunResultSchema, agentSecretScopeSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, agentWorkflowSummarySchema, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approveRunToolSchema, approverClauseSchema, assertScheduleInputsSatisfiable, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, capabilityLabel, coerceDispatchInputs, coerceHostPropertyValue, compileRegexMatcher, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, developerOpsForEntrypoint, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, envBindingEntrySchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getDiagnosticsToolSchema, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubIngressPath, githubWebhookPath, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isInputSatisfiableFromDefaults, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rejectRunToolSchema, renderFenced, rerunRunToolSchema, resolveHeldRunId, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForEnvironment, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, statusOptionsForLevel, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, transition, triggerRunToolSchema, trustPolicyResponseSchema, trustPolicyUpdateSchema, untrusted, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, wrapUntrusted };
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentFailureCategory, ApprovalDecision, AttestationOrigin, CAPABILITY_LABEL_PREFIX, CONTEXTS_MAX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, ContextDeleteErrorCode, ContextGateRejectReason, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DEVELOPER_OPERATIONS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, INIT_LABEL, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_CAPABILITIES, OnUnreachableMode, OrchRole, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PatKind, PayloadOmittedReason, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RegisterableTriggerType, RunsOnPick, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, ScalerBackendType, ScalerEventType, SourceOrigin, SourceProvider, SourceSubtype, StepApprovalOutcome, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TRUSTED_ENV_SCRUB_EXACT, TestRelayType, TimeoutReason, TriggerSource, TrustTierSchema, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentJobResultSchema, agentLabelOf, agentLogChunkSchema, agentMetricsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentRegisterSchema, agentRunListItemSchema, agentRunResultSchema, agentSecretScopeSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, agentWorkflowSummarySchema, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approveRunToolSchema, approverClauseSchema, assertScheduleInputsSatisfiable, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildTrustedPassthroughEnv, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, capabilityLabel, coerceDispatchInputs, coerceHostPropertyValue, compileRegexMatcher, configAckSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, developerOpsForEntrypoint, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getDiagnosticsToolSchema, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubIngressPath, githubWebhookPath, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isInputSatisfiableFromDefaults, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, isSelfReportedLabel, isTerminal, isTrustedEnvScrubbed, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rejectRunToolSchema, renderFenced, rerunRunToolSchema, resolveHeldRunId, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForContext, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, statusOptionsForLevel, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, transition, triggerRunToolSchema, trustPolicyResponseSchema, trustPolicyUpdateSchema, untrusted, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, wrapUntrusted };

package/dist/metrics/metric-catalog.generated.d.ts

@@ -9,12 +9,14 @@ export declare const MetricNames: {
     readonly KICI_AGENT_LOG_LINES_DROPPED_TOTAL: "kici_agent_log_lines_dropped_total";
     readonly KICI_AGENT_STEP_DURATION_SECONDS: "kici_agent_step_duration_seconds";
     readonly KICI_AGENT_STEPS_TOTAL: "kici_agent_steps_total";
+    readonly KICI_BILLING_EMAIL_SEND_TOTAL: "kici_billing_email_send_total";
     readonly KICI_BUILD_JOBS_TOTAL: "kici_build_jobs_total";
     readonly KICI_CACHE_HITS_TOTAL: "kici_cache_hits_total";
     readonly KICI_CACHE_MISSES_TOTAL: "kici_cache_misses_total";
     readonly KICI_CROSS_SOURCE_ERRORS_TOTAL: "kici_cross_source_errors_total";
     readonly KICI_CROSS_SOURCE_FANOUT_SIZE: "kici_cross_source_fanout_size";
     readonly KICI_DASHBOARD_RELAY_LATENCY_SECONDS: "kici_dashboard_relay_latency_seconds";
+    readonly KICI_DB_COLLATION_DRIFT: "kici_db_collation_drift";
     readonly KICI_MCP_AUTH_REJECTIONS_TOTAL: "kici_mcp_auth_rejections_total";
     readonly KICI_MCP_DB_POOL_CONNECTIONS: "kici_mcp_db_pool_connections";
     readonly KICI_MCP_RATE_LIMITED_TOTAL: "kici_mcp_rate_limited_total";
@@ -24,6 +26,7 @@ export declare const MetricNames: {
     readonly KICI_ORCH_BUILD_DURATION_SECONDS: "kici_orch_build_duration_seconds";
     readonly KICI_ORCH_CONFIG_RELOAD_TOTAL: "kici_orch_config_reload_total";
     readonly KICI_ORCH_CONFIG_VERSION: "kici_orch_config_version";
+    readonly KICI_ORCH_DB_COLLATION_DRIFT: "kici_orch_db_collation_drift";
     readonly KICI_ORCH_DECLARED_HOSTS_UNREACHABLE: "kici_orch_declared_hosts_unreachable";
     readonly KICI_ORCH_DEDUP_HITS_TOTAL: "kici_orch_dedup_hits_total";
     readonly KICI_ORCH_DEP_CACHE_HITS_TOTAL: "kici_orch_dep_cache_hits_total";
@@ -78,8 +81,6 @@ export declare const MetricNames: {
     readonly KICI_PLAN_CAP_EXCEEDED_TOTAL: "kici_plan_cap_exceeded_total";
     readonly KICI_PLAN_USAGE_RATIO: "kici_plan_usage_ratio";
     readonly KICI_PLATFORM_COORDINATOR_POOL_SIZE: "kici_platform_coordinator_pool_size";
-    readonly KICI_PLATFORM_COORDINATOR_PROBE_LATENCY_MS: "kici_platform_coordinator_probe_latency_ms";
-    readonly KICI_PLATFORM_COORDINATOR_PROBE_TIMEOUTS_TOTAL: "kici_platform_coordinator_probe_timeouts_total";
     readonly KICI_PLATFORM_COORDINATOR_STALE_ENTRIES: "kici_platform_coordinator_stale_entries";
     readonly KICI_PLATFORM_COORDINATOR_ZOMBIE_ENTRIES_TOTAL: "kici_platform_coordinator_zombie_entries_total";
     readonly KICI_PLATFORM_CROSS_TENANT_REJECTIONS_TOTAL: "kici_platform_cross_tenant_rejections_total";
@@ -166,12 +167,14 @@ export declare const MetricLabels: {
     readonly KICI_AGENT_LOG_LINES_DROPPED_TOTAL: readonly ["scaler"];
     readonly KICI_AGENT_STEP_DURATION_SECONDS: readonly ["scaler"];
     readonly KICI_AGENT_STEPS_TOTAL: readonly ["status", "scaler"];
+    readonly KICI_BILLING_EMAIL_SEND_TOTAL: readonly ["kind", "status"];
     readonly KICI_BUILD_JOBS_TOTAL: readonly [];
     readonly KICI_CACHE_HITS_TOTAL: readonly ["cache_type"];
     readonly KICI_CACHE_MISSES_TOTAL: readonly ["cache_type"];
     readonly KICI_CROSS_SOURCE_ERRORS_TOTAL: readonly ["reason"];
     readonly KICI_CROSS_SOURCE_FANOUT_SIZE: readonly ["event"];
     readonly KICI_DASHBOARD_RELAY_LATENCY_SECONDS: readonly ["outcome"];
+    readonly KICI_DB_COLLATION_DRIFT: readonly ["database"];
     readonly KICI_MCP_AUTH_REJECTIONS_TOTAL: readonly ["reason"];
     readonly KICI_MCP_DB_POOL_CONNECTIONS: readonly ["state"];
     readonly KICI_MCP_RATE_LIMITED_TOTAL: readonly ["kind"];
@@ -181,6 +184,7 @@ export declare const MetricLabels: {
     readonly KICI_ORCH_BUILD_DURATION_SECONDS: readonly [];
     readonly KICI_ORCH_CONFIG_RELOAD_TOTAL: readonly ["result", "source"];
     readonly KICI_ORCH_CONFIG_VERSION: readonly [];
+    readonly KICI_ORCH_DB_COLLATION_DRIFT: readonly ["database"];
     readonly KICI_ORCH_DECLARED_HOSTS_UNREACHABLE: readonly [];
     readonly KICI_ORCH_DEDUP_HITS_TOTAL: readonly [];
     readonly KICI_ORCH_DEP_CACHE_HITS_TOTAL: readonly [];
@@ -235,8 +239,6 @@ export declare const MetricLabels: {
     readonly KICI_PLAN_CAP_EXCEEDED_TOTAL: readonly ["org_id", "dimension"];
     readonly KICI_PLAN_USAGE_RATIO: readonly ["org_id", "dimension"];
     readonly KICI_PLATFORM_COORDINATOR_POOL_SIZE: readonly ["routingKey"];
-    readonly KICI_PLATFORM_COORDINATOR_PROBE_LATENCY_MS: readonly ["clusterName", "connectionId"];
-    readonly KICI_PLATFORM_COORDINATOR_PROBE_TIMEOUTS_TOTAL: readonly ["clusterName", "connectionId"];
     readonly KICI_PLATFORM_COORDINATOR_STALE_ENTRIES: readonly [];
     readonly KICI_PLATFORM_COORDINATOR_ZOMBIE_ENTRIES_TOTAL: readonly ["clusterName"];
     readonly KICI_PLATFORM_CROSS_TENANT_REJECTIONS_TOTAL: readonly ["reason"];
@@ -322,12 +324,14 @@ export declare const MetricKind: {
     readonly KICI_AGENT_LOG_LINES_DROPPED_TOTAL: "counter";
     readonly KICI_AGENT_STEP_DURATION_SECONDS: "histogram";
     readonly KICI_AGENT_STEPS_TOTAL: "counter";
+    readonly KICI_BILLING_EMAIL_SEND_TOTAL: "counter";
     readonly KICI_BUILD_JOBS_TOTAL: "counter";
     readonly KICI_CACHE_HITS_TOTAL: "counter";
     readonly KICI_CACHE_MISSES_TOTAL: "counter";
     readonly KICI_CROSS_SOURCE_ERRORS_TOTAL: "counter";
     readonly KICI_CROSS_SOURCE_FANOUT_SIZE: "histogram";
     readonly KICI_DASHBOARD_RELAY_LATENCY_SECONDS: "histogram";
+    readonly KICI_DB_COLLATION_DRIFT: "observableGauge";
     readonly KICI_MCP_AUTH_REJECTIONS_TOTAL: "counter";
     readonly KICI_MCP_DB_POOL_CONNECTIONS: "observableGauge";
     readonly KICI_MCP_RATE_LIMITED_TOTAL: "counter";
@@ -337,6 +341,7 @@ export declare const MetricKind: {
     readonly KICI_ORCH_BUILD_DURATION_SECONDS: "histogram";
     readonly KICI_ORCH_CONFIG_RELOAD_TOTAL: "counter";
     readonly KICI_ORCH_CONFIG_VERSION: "observableGauge";
+    readonly KICI_ORCH_DB_COLLATION_DRIFT: "observableGauge";
     readonly KICI_ORCH_DECLARED_HOSTS_UNREACHABLE: "observableGauge";
     readonly KICI_ORCH_DEDUP_HITS_TOTAL: "counter";
     readonly KICI_ORCH_DEP_CACHE_HITS_TOTAL: "counter";
@@ -391,8 +396,6 @@ export declare const MetricKind: {
     readonly KICI_PLAN_CAP_EXCEEDED_TOTAL: "counter";
     readonly KICI_PLAN_USAGE_RATIO: "observableGauge";
     readonly KICI_PLATFORM_COORDINATOR_POOL_SIZE: "observableGauge";
-    readonly KICI_PLATFORM_COORDINATOR_PROBE_LATENCY_MS: "histogram";
-    readonly KICI_PLATFORM_COORDINATOR_PROBE_TIMEOUTS_TOTAL: "counter";
     readonly KICI_PLATFORM_COORDINATOR_STALE_ENTRIES: "observableGauge";
     readonly KICI_PLATFORM_COORDINATOR_ZOMBIE_ENTRIES_TOTAL: "counter";
     readonly KICI_PLATFORM_CROSS_TENANT_REJECTIONS_TOTAL: "counter";
@@ -478,12 +481,14 @@ export declare const MetricDescription: {
     readonly KICI_AGENT_LOG_LINES_DROPPED_TOTAL: "Total log lines dropped due to backpressure";
     readonly KICI_AGENT_STEP_DURATION_SECONDS: "Step execution duration in seconds";
     readonly KICI_AGENT_STEPS_TOTAL: "Total number of completed steps";
+    readonly KICI_BILLING_EMAIL_SEND_TOTAL: "Billing emails sent, by kind and status";
     readonly KICI_BUILD_JOBS_TOTAL: "Total build jobs dispatched";
     readonly KICI_CACHE_HITS_TOTAL: "Total cache hits by type";
     readonly KICI_CACHE_MISSES_TOTAL: "Total cache misses by type";
     readonly KICI_CROSS_SOURCE_ERRORS_TOTAL: "Errors encountered during cross-source webhook dispatch";
     readonly KICI_CROSS_SOURCE_FANOUT_SIZE: "Number of webhook-trigger registrations matched when an inbound generic webhook fans out across sources in the same org";
     readonly KICI_DASHBOARD_RELAY_LATENCY_SECONDS: "Round-trip latency of a cross-instance dashboard relay request";
+    readonly KICI_DB_COLLATION_DRIFT: "1 when the database stamped collation version differs from the running libc (text indexes may silently miss present rows); 0 when consistent.";
     readonly KICI_MCP_AUTH_REJECTIONS_TOTAL: "Developer-MCP requests rejected by the agent-credential gate";
     readonly KICI_MCP_DB_POOL_CONNECTIONS: "MCP-dedicated Postgres pool connection counts";
     readonly KICI_MCP_RATE_LIMITED_TOTAL: "Developer-MCP requests rejected by the per-credential rate limiter";
@@ -493,6 +498,7 @@ export declare const MetricDescription: {
     readonly KICI_ORCH_BUILD_DURATION_SECONDS: "Duration of build agent operations in seconds";
     readonly KICI_ORCH_CONFIG_RELOAD_TOTAL: "Total number of config reload operations";
     readonly KICI_ORCH_CONFIG_VERSION: "Current shared config version number";
+    readonly KICI_ORCH_DB_COLLATION_DRIFT: "1 when the orchestrator DB stamped collation version differs from the running libc (text indexes may silently miss present rows); 0 when consistent.";
     readonly KICI_ORCH_DECLARED_HOSTS_UNREACHABLE: "Number of declared (static) roster hosts currently unreachable";
     readonly KICI_ORCH_DEDUP_HITS_TOTAL: "Total number of deduplication cache hits";
     readonly KICI_ORCH_DEP_CACHE_HITS_TOTAL: "Total number of dep cache hits";
@@ -547,8 +553,6 @@ export declare const MetricDescription: {
     readonly KICI_PLAN_CAP_EXCEEDED_TOTAL: "Total times an org hit a plan cap (per dimension)";
     readonly KICI_PLAN_USAGE_RATIO: "Per-org per-dimension usage ratio (current / cap)";
     readonly KICI_PLATFORM_COORDINATOR_POOL_SIZE: "Coordinator pool size per routing key";
-    readonly KICI_PLATFORM_COORDINATOR_PROBE_LATENCY_MS: "Active coordinator liveness-probe round-trip latency in ms";
-    readonly KICI_PLATFORM_COORDINATOR_PROBE_TIMEOUTS_TOTAL: "Active coordinator liveness-probe timeouts";
     readonly KICI_PLATFORM_COORDINATOR_STALE_ENTRIES: "Stale (non-OPEN socket) coordinator entries in the pool per routing key";
     readonly KICI_PLATFORM_COORDINATOR_ZOMBIE_ENTRIES_TOTAL: "Zombie (non-OPEN) coordinator entries encountered during relay selection";
     readonly KICI_PLATFORM_CROSS_TENANT_REJECTIONS_TOTAL: "Total cross-tenant WS messages rejected by the Platform (security invariant). Labels: reason.";
@@ -641,12 +645,14 @@ export declare const MetricService: {
     readonly KICI_AGENT_LOG_LINES_DROPPED_TOTAL: "agent";
     readonly KICI_AGENT_STEP_DURATION_SECONDS: "agent";
     readonly KICI_AGENT_STEPS_TOTAL: "agent";
+    readonly KICI_BILLING_EMAIL_SEND_TOTAL: "platform";
     readonly KICI_BUILD_JOBS_TOTAL: "platform";
     readonly KICI_CACHE_HITS_TOTAL: "platform";
     readonly KICI_CACHE_MISSES_TOTAL: "platform";
     readonly KICI_CROSS_SOURCE_ERRORS_TOTAL: "orchestrator";
     readonly KICI_CROSS_SOURCE_FANOUT_SIZE: "orchestrator";
     readonly KICI_DASHBOARD_RELAY_LATENCY_SECONDS: "platform";
+    readonly KICI_DB_COLLATION_DRIFT: "platform";
     readonly KICI_MCP_AUTH_REJECTIONS_TOTAL: "platform";
     readonly KICI_MCP_DB_POOL_CONNECTIONS: "platform";
     readonly KICI_MCP_RATE_LIMITED_TOTAL: "platform";
@@ -656,6 +662,7 @@ export declare const MetricService: {
     readonly KICI_ORCH_BUILD_DURATION_SECONDS: "orchestrator";
     readonly KICI_ORCH_CONFIG_RELOAD_TOTAL: "orchestrator";
     readonly KICI_ORCH_CONFIG_VERSION: "orchestrator";
+    readonly KICI_ORCH_DB_COLLATION_DRIFT: "orchestrator";
     readonly KICI_ORCH_DECLARED_HOSTS_UNREACHABLE: "orchestrator";
     readonly KICI_ORCH_DEDUP_HITS_TOTAL: "orchestrator";
     readonly KICI_ORCH_DEP_CACHE_HITS_TOTAL: "orchestrator";
@@ -710,8 +717,6 @@ export declare const MetricService: {
     readonly KICI_PLAN_CAP_EXCEEDED_TOTAL: "platform";
     readonly KICI_PLAN_USAGE_RATIO: "platform";
     readonly KICI_PLATFORM_COORDINATOR_POOL_SIZE: "platform";
-    readonly KICI_PLATFORM_COORDINATOR_PROBE_LATENCY_MS: "platform";
-    readonly KICI_PLATFORM_COORDINATOR_PROBE_TIMEOUTS_TOTAL: "platform";
     readonly KICI_PLATFORM_COORDINATOR_STALE_ENTRIES: "platform";
     readonly KICI_PLATFORM_COORDINATOR_ZOMBIE_ENTRIES_TOTAL: "platform";
     readonly KICI_PLATFORM_CROSS_TENANT_REJECTIONS_TOTAL: "platform";

package/dist/metrics/metric-catalog.generated.js

@@ -11,12 +11,14 @@ const MetricNames = {
 	KICI_AGENT_LOG_LINES_DROPPED_TOTAL: "kici_agent_log_lines_dropped_total",
 	KICI_AGENT_STEP_DURATION_SECONDS: "kici_agent_step_duration_seconds",
 	KICI_AGENT_STEPS_TOTAL: "kici_agent_steps_total",
+	KICI_BILLING_EMAIL_SEND_TOTAL: "kici_billing_email_send_total",
 	KICI_BUILD_JOBS_TOTAL: "kici_build_jobs_total",
 	KICI_CACHE_HITS_TOTAL: "kici_cache_hits_total",
 	KICI_CACHE_MISSES_TOTAL: "kici_cache_misses_total",
 	KICI_CROSS_SOURCE_ERRORS_TOTAL: "kici_cross_source_errors_total",
 	KICI_CROSS_SOURCE_FANOUT_SIZE: "kici_cross_source_fanout_size",
 	KICI_DASHBOARD_RELAY_LATENCY_SECONDS: "kici_dashboard_relay_latency_seconds",
+	KICI_DB_COLLATION_DRIFT: "kici_db_collation_drift",
 	KICI_MCP_AUTH_REJECTIONS_TOTAL: "kici_mcp_auth_rejections_total",
 	KICI_MCP_DB_POOL_CONNECTIONS: "kici_mcp_db_pool_connections",
 	KICI_MCP_RATE_LIMITED_TOTAL: "kici_mcp_rate_limited_total",
@@ -26,6 +28,7 @@ const MetricNames = {
 	KICI_ORCH_BUILD_DURATION_SECONDS: "kici_orch_build_duration_seconds",
 	KICI_ORCH_CONFIG_RELOAD_TOTAL: "kici_orch_config_reload_total",
 	KICI_ORCH_CONFIG_VERSION: "kici_orch_config_version",
+	KICI_ORCH_DB_COLLATION_DRIFT: "kici_orch_db_collation_drift",
 	KICI_ORCH_DECLARED_HOSTS_UNREACHABLE: "kici_orch_declared_hosts_unreachable",
 	KICI_ORCH_DEDUP_HITS_TOTAL: "kici_orch_dedup_hits_total",
 	KICI_ORCH_DEP_CACHE_HITS_TOTAL: "kici_orch_dep_cache_hits_total",
@@ -80,8 +83,6 @@ const MetricNames = {
 	KICI_PLAN_CAP_EXCEEDED_TOTAL: "kici_plan_cap_exceeded_total",
 	KICI_PLAN_USAGE_RATIO: "kici_plan_usage_ratio",
 	KICI_PLATFORM_COORDINATOR_POOL_SIZE: "kici_platform_coordinator_pool_size",
-	KICI_PLATFORM_COORDINATOR_PROBE_LATENCY_MS: "kici_platform_coordinator_probe_latency_ms",
-	KICI_PLATFORM_COORDINATOR_PROBE_TIMEOUTS_TOTAL: "kici_platform_coordinator_probe_timeouts_total",
 	KICI_PLATFORM_COORDINATOR_STALE_ENTRIES: "kici_platform_coordinator_stale_entries",
 	KICI_PLATFORM_COORDINATOR_ZOMBIE_ENTRIES_TOTAL: "kici_platform_coordinator_zombie_entries_total",
 	KICI_PLATFORM_CROSS_TENANT_REJECTIONS_TOTAL: "kici_platform_cross_tenant_rejections_total",
@@ -167,12 +168,14 @@ const MetricLabels = {
 	KICI_AGENT_LOG_LINES_DROPPED_TOTAL: ["scaler"],
 	KICI_AGENT_STEP_DURATION_SECONDS: ["scaler"],
 	KICI_AGENT_STEPS_TOTAL: ["status", "scaler"],
+	KICI_BILLING_EMAIL_SEND_TOTAL: ["kind", "status"],
 	KICI_BUILD_JOBS_TOTAL: [],
 	KICI_CACHE_HITS_TOTAL: ["cache_type"],
 	KICI_CACHE_MISSES_TOTAL: ["cache_type"],
 	KICI_CROSS_SOURCE_ERRORS_TOTAL: ["reason"],
 	KICI_CROSS_SOURCE_FANOUT_SIZE: ["event"],
 	KICI_DASHBOARD_RELAY_LATENCY_SECONDS: ["outcome"],
+	KICI_DB_COLLATION_DRIFT: ["database"],
 	KICI_MCP_AUTH_REJECTIONS_TOTAL: ["reason"],
 	KICI_MCP_DB_POOL_CONNECTIONS: ["state"],
 	KICI_MCP_RATE_LIMITED_TOTAL: ["kind"],
@@ -182,6 +185,7 @@ const MetricLabels = {
 	KICI_ORCH_BUILD_DURATION_SECONDS: [],
 	KICI_ORCH_CONFIG_RELOAD_TOTAL: ["result", "source"],
 	KICI_ORCH_CONFIG_VERSION: [],
+	KICI_ORCH_DB_COLLATION_DRIFT: ["database"],
 	KICI_ORCH_DECLARED_HOSTS_UNREACHABLE: [],
 	KICI_ORCH_DEDUP_HITS_TOTAL: [],
 	KICI_ORCH_DEP_CACHE_HITS_TOTAL: [],
@@ -248,8 +252,6 @@ const MetricLabels = {
 	KICI_PLAN_CAP_EXCEEDED_TOTAL: ["org_id", "dimension"],
 	KICI_PLAN_USAGE_RATIO: ["org_id", "dimension"],
 	KICI_PLATFORM_COORDINATOR_POOL_SIZE: ["routingKey"],
-	KICI_PLATFORM_COORDINATOR_PROBE_LATENCY_MS: ["clusterName", "connectionId"],
-	KICI_PLATFORM_COORDINATOR_PROBE_TIMEOUTS_TOTAL: ["clusterName", "connectionId"],
 	KICI_PLATFORM_COORDINATOR_STALE_ENTRIES: [],
 	KICI_PLATFORM_COORDINATOR_ZOMBIE_ENTRIES_TOTAL: ["clusterName"],
 	KICI_PLATFORM_CROSS_TENANT_REJECTIONS_TOTAL: ["reason"],
@@ -339,12 +341,14 @@ const MetricKind = {
 	KICI_AGENT_LOG_LINES_DROPPED_TOTAL: "counter",
 	KICI_AGENT_STEP_DURATION_SECONDS: "histogram",
 	KICI_AGENT_STEPS_TOTAL: "counter",
+	KICI_BILLING_EMAIL_SEND_TOTAL: "counter",
 	KICI_BUILD_JOBS_TOTAL: "counter",
 	KICI_CACHE_HITS_TOTAL: "counter",
 	KICI_CACHE_MISSES_TOTAL: "counter",
 	KICI_CROSS_SOURCE_ERRORS_TOTAL: "counter",
 	KICI_CROSS_SOURCE_FANOUT_SIZE: "histogram",
 	KICI_DASHBOARD_RELAY_LATENCY_SECONDS: "histogram",
+	KICI_DB_COLLATION_DRIFT: "observableGauge",
 	KICI_MCP_AUTH_REJECTIONS_TOTAL: "counter",
 	KICI_MCP_DB_POOL_CONNECTIONS: "observableGauge",
 	KICI_MCP_RATE_LIMITED_TOTAL: "counter",
@@ -354,6 +358,7 @@ const MetricKind = {
 	KICI_ORCH_BUILD_DURATION_SECONDS: "histogram",
 	KICI_ORCH_CONFIG_RELOAD_TOTAL: "counter",
 	KICI_ORCH_CONFIG_VERSION: "observableGauge",
+	KICI_ORCH_DB_COLLATION_DRIFT: "observableGauge",
 	KICI_ORCH_DECLARED_HOSTS_UNREACHABLE: "observableGauge",
 	KICI_ORCH_DEDUP_HITS_TOTAL: "counter",
 	KICI_ORCH_DEP_CACHE_HITS_TOTAL: "counter",
@@ -408,8 +413,6 @@ const MetricKind = {
 	KICI_PLAN_CAP_EXCEEDED_TOTAL: "counter",
 	KICI_PLAN_USAGE_RATIO: "observableGauge",
 	KICI_PLATFORM_COORDINATOR_POOL_SIZE: "observableGauge",
-	KICI_PLATFORM_COORDINATOR_PROBE_LATENCY_MS: "histogram",
-	KICI_PLATFORM_COORDINATOR_PROBE_TIMEOUTS_TOTAL: "counter",
 	KICI_PLATFORM_COORDINATOR_STALE_ENTRIES: "observableGauge",
 	KICI_PLATFORM_COORDINATOR_ZOMBIE_ENTRIES_TOTAL: "counter",
 	KICI_PLATFORM_CROSS_TENANT_REJECTIONS_TOTAL: "counter",
@@ -495,12 +498,14 @@ const MetricDescription = {
 	KICI_AGENT_LOG_LINES_DROPPED_TOTAL: "Total log lines dropped due to backpressure",
 	KICI_AGENT_STEP_DURATION_SECONDS: "Step execution duration in seconds",
 	KICI_AGENT_STEPS_TOTAL: "Total number of completed steps",
+	KICI_BILLING_EMAIL_SEND_TOTAL: "Billing emails sent, by kind and status",
 	KICI_BUILD_JOBS_TOTAL: "Total build jobs dispatched",
 	KICI_CACHE_HITS_TOTAL: "Total cache hits by type",
 	KICI_CACHE_MISSES_TOTAL: "Total cache misses by type",
 	KICI_CROSS_SOURCE_ERRORS_TOTAL: "Errors encountered during cross-source webhook dispatch",
 	KICI_CROSS_SOURCE_FANOUT_SIZE: "Number of webhook-trigger registrations matched when an inbound generic webhook fans out across sources in the same org",
 	KICI_DASHBOARD_RELAY_LATENCY_SECONDS: "Round-trip latency of a cross-instance dashboard relay request",
+	KICI_DB_COLLATION_DRIFT: "1 when the database stamped collation version differs from the running libc (text indexes may silently miss present rows); 0 when consistent.",
 	KICI_MCP_AUTH_REJECTIONS_TOTAL: "Developer-MCP requests rejected by the agent-credential gate",
 	KICI_MCP_DB_POOL_CONNECTIONS: "MCP-dedicated Postgres pool connection counts",
 	KICI_MCP_RATE_LIMITED_TOTAL: "Developer-MCP requests rejected by the per-credential rate limiter",
@@ -510,6 +515,7 @@ const MetricDescription = {
 	KICI_ORCH_BUILD_DURATION_SECONDS: "Duration of build agent operations in seconds",
 	KICI_ORCH_CONFIG_RELOAD_TOTAL: "Total number of config reload operations",
 	KICI_ORCH_CONFIG_VERSION: "Current shared config version number",
+	KICI_ORCH_DB_COLLATION_DRIFT: "1 when the orchestrator DB stamped collation version differs from the running libc (text indexes may silently miss present rows); 0 when consistent.",
 	KICI_ORCH_DECLARED_HOSTS_UNREACHABLE: "Number of declared (static) roster hosts currently unreachable",
 	KICI_ORCH_DEDUP_HITS_TOTAL: "Total number of deduplication cache hits",
 	KICI_ORCH_DEP_CACHE_HITS_TOTAL: "Total number of dep cache hits",
@@ -564,8 +570,6 @@ const MetricDescription = {
 	KICI_PLAN_CAP_EXCEEDED_TOTAL: "Total times an org hit a plan cap (per dimension)",
 	KICI_PLAN_USAGE_RATIO: "Per-org per-dimension usage ratio (current / cap)",
 	KICI_PLATFORM_COORDINATOR_POOL_SIZE: "Coordinator pool size per routing key",
-	KICI_PLATFORM_COORDINATOR_PROBE_LATENCY_MS: "Active coordinator liveness-probe round-trip latency in ms",
-	KICI_PLATFORM_COORDINATOR_PROBE_TIMEOUTS_TOTAL: "Active coordinator liveness-probe timeouts",
 	KICI_PLATFORM_COORDINATOR_STALE_ENTRIES: "Stale (non-OPEN socket) coordinator entries in the pool per routing key",
 	KICI_PLATFORM_COORDINATOR_ZOMBIE_ENTRIES_TOTAL: "Zombie (non-OPEN) coordinator entries encountered during relay selection",
 	KICI_PLATFORM_CROSS_TENANT_REJECTIONS_TOTAL: "Total cross-tenant WS messages rejected by the Platform (security invariant). Labels: reason.",
@@ -658,12 +662,14 @@ const MetricService = {
 	KICI_AGENT_LOG_LINES_DROPPED_TOTAL: "agent",
 	KICI_AGENT_STEP_DURATION_SECONDS: "agent",
 	KICI_AGENT_STEPS_TOTAL: "agent",
+	KICI_BILLING_EMAIL_SEND_TOTAL: "platform",
 	KICI_BUILD_JOBS_TOTAL: "platform",
 	KICI_CACHE_HITS_TOTAL: "platform",
 	KICI_CACHE_MISSES_TOTAL: "platform",
 	KICI_CROSS_SOURCE_ERRORS_TOTAL: "orchestrator",
 	KICI_CROSS_SOURCE_FANOUT_SIZE: "orchestrator",
 	KICI_DASHBOARD_RELAY_LATENCY_SECONDS: "platform",
+	KICI_DB_COLLATION_DRIFT: "platform",
 	KICI_MCP_AUTH_REJECTIONS_TOTAL: "platform",
 	KICI_MCP_DB_POOL_CONNECTIONS: "platform",
 	KICI_MCP_RATE_LIMITED_TOTAL: "platform",
@@ -673,6 +679,7 @@ const MetricService = {
 	KICI_ORCH_BUILD_DURATION_SECONDS: "orchestrator",
 	KICI_ORCH_CONFIG_RELOAD_TOTAL: "orchestrator",
 	KICI_ORCH_CONFIG_VERSION: "orchestrator",
+	KICI_ORCH_DB_COLLATION_DRIFT: "orchestrator",
 	KICI_ORCH_DECLARED_HOSTS_UNREACHABLE: "orchestrator",
 	KICI_ORCH_DEDUP_HITS_TOTAL: "orchestrator",
 	KICI_ORCH_DEP_CACHE_HITS_TOTAL: "orchestrator",
@@ -727,8 +734,6 @@ const MetricService = {
 	KICI_PLAN_CAP_EXCEEDED_TOTAL: "platform",
 	KICI_PLAN_USAGE_RATIO: "platform",
 	KICI_PLATFORM_COORDINATOR_POOL_SIZE: "platform",
-	KICI_PLATFORM_COORDINATOR_PROBE_LATENCY_MS: "platform",
-	KICI_PLATFORM_COORDINATOR_PROBE_TIMEOUTS_TOTAL: "platform",
 	KICI_PLATFORM_COORDINATOR_STALE_ENTRIES: "platform",
 	KICI_PLATFORM_COORDINATOR_ZOMBIE_ENTRIES_TOTAL: "platform",
 	KICI_PLATFORM_CROSS_TENANT_REJECTIONS_TOTAL: "platform",
@@ -815,12 +820,14 @@ const ALL_METRIC_NAMES = [
 	"kici_agent_log_lines_dropped_total",
 	"kici_agent_step_duration_seconds",
 	"kici_agent_steps_total",
+	"kici_billing_email_send_total",
 	"kici_build_jobs_total",
 	"kici_cache_hits_total",
 	"kici_cache_misses_total",
 	"kici_cross_source_errors_total",
 	"kici_cross_source_fanout_size",
 	"kici_dashboard_relay_latency_seconds",
+	"kici_db_collation_drift",
 	"kici_mcp_auth_rejections_total",
 	"kici_mcp_db_pool_connections",
 	"kici_mcp_rate_limited_total",
@@ -830,6 +837,7 @@ const ALL_METRIC_NAMES = [
 	"kici_orch_build_duration_seconds",
 	"kici_orch_config_reload_total",
 	"kici_orch_config_version",
+	"kici_orch_db_collation_drift",
 	"kici_orch_declared_hosts_unreachable",
 	"kici_orch_dedup_hits_total",
 	"kici_orch_dep_cache_hits_total",
@@ -884,8 +892,6 @@ const ALL_METRIC_NAMES = [
 	"kici_plan_cap_exceeded_total",
 	"kici_plan_usage_ratio",
 	"kici_platform_coordinator_pool_size",
-	"kici_platform_coordinator_probe_latency_ms",
-	"kici_platform_coordinator_probe_timeouts_total",
 	"kici_platform_coordinator_stale_entries",
 	"kici_platform_coordinator_zombie_entries_total",
 	"kici_platform_cross_tenant_rejections_total",

package/dist/protocol/dashboard-api-errors.d.ts

@@ -0,0 +1,12 @@
+import { z } from 'zod';
+/**
+ * Structured `error` codes the Platform dashboard API returns in a JSON body,
+ * which the dashboard SPA special-cases when rendering. Shared so the emit
+ * sites (Platform) and the match site (dashboard) never drift on the literal.
+ */
+export declare const DashboardApiErrorCode: z.ZodEnum<{
+    orchestrator_not_found: "orchestrator_not_found";
+    session_max_age_exceeded: "session_max_age_exceeded";
+}>;
+export type DashboardApiErrorCode = z.infer<typeof DashboardApiErrorCode>;
+//# sourceMappingURL=dashboard-api-errors.d.ts.map

package/dist/protocol/dashboard-api-errors.js

@@ -0,0 +1,13 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { z } from "zod";
+//#region src/protocol/dashboard-api-errors.ts
+/**
+* Structured `error` codes the Platform dashboard API returns in a JSON body,
+* which the dashboard SPA special-cases when rendering. Shared so the emit
+* sites (Platform) and the match site (dashboard) never drift on the literal.
+*/
+const DashboardApiErrorCode = z.enum(["orchestrator_not_found", "session_max_age_exceeded"]);
+//#endregion
+export { DashboardApiErrorCode };
+
+//# sourceMappingURL=dashboard-api-errors.js.map