@kici-dev/engine 0.1.26 → 0.2.0

package/dist/protocol/messages/execution-status.js

@@ -13,8 +13,8 @@ const STATE_REPLAY_MAX_RUNS = 500;
 const MAX_JOBS_PER_RUN = 1e3;
 /** Max number of `runsOn` / `secretsAccessed` label entries on a job/step. */
 const RUNS_ON_LABELS_MAX = 30;
-/** Max number of bound deployment-environment names on a job. */
-const ENVIRONMENTS_MAX = 30;
+/** Max number of bound context names on a job. */
+const CONTEXTS_MAX = 30;
 /**
 * Status values for execution runs (execution_runs table).
 *
@@ -34,7 +34,15 @@ const ExecutionRunStatus = z.enum([
 	"cancelling",
 	"held"
 ]);
-/** Status values for execution jobs (execution_jobs table + job.status protocol messages). */
+/**
+* Status values for execution jobs (execution_jobs table + job.status protocol messages).
+*
+* `unroutable` = the job's `runsOn` matched no agent for the whole queue
+* window, so it never ran. Distinct from `failed` (a failed job ran and has
+* logs to read; an unroutable one has a fleet/label problem to fix), from
+* `skipped` (a condition deliberately excluded it) and from `timed_out_stale`
+* (capacity existed but never freed up).
+*/
 const ExecutionJobStatus = z.enum([
 	"pending",
 	"queued",
@@ -46,7 +54,8 @@ const ExecutionJobStatus = z.enum([
 	"cancelled",
 	"skipped",
 	"timed_out_stale",
-	"drift_dropped"
+	"drift_dropped",
+	"unroutable"
 ]);
 /**
 * The status values a notification subscription may target at the given level.
@@ -111,19 +120,42 @@ const TimeoutReason = z.enum(["job_timeout", "workflow_timeout"]);
 * Scope is carried separately on `initFailureSchema.scope`:
 *  - `run`-scoped categories fail the whole run before any job runs
 *    (secret_resolution, install_secrets, lock_resolution,
-*    build_coordination).
+*    build_coordination, approval_misconfig, sandbox_denied, trust_policy).
 *  - `job`-scoped categories fail one job and leave siblings alone
-*    (environment_rules, dynamic_eval, no_agent, matrix_expansion).
+*    (context_rules, dynamic_eval, no_agent, matrix_expansion).
 */
 const InitFailureCategory = z.enum([
 	"secret_resolution",
 	"install_secrets",
 	"lock_resolution",
 	"build_coordination",
-	"environment_rules",
+	"context_rules",
 	"dynamic_eval",
 	"no_agent",
-	"matrix_expansion"
+	"matrix_expansion",
+	"approval_misconfig",
+	"sandbox_denied",
+	"trust_policy"
+]);
+/**
+* Why a terminal run failed (only meaningful for failed/cancelled runs):
+*  - never_started     — init failure (no_agent/secret/lock/build); no step ran.
+*  - timed_out         — a job timed out (never dispatched, or agent went silent).
+*  - dead_orchestrator — the Platform failed the run because its orchestrator died.
+*  - step_failure      — a job actually ran and failed.
+*  - cancelled         — the run was cancelled.
+*
+* Derived at run completion from the terminal job statuses, because
+* `timed_out`/`step_failure` both collapse to run-status `failed` — the status
+* alone can't carry it. `never_started` is stamped by the init-failure paths and
+* `dead_orchestrator` is stamped Platform-side by the dead-orchestrator detector.
+*/
+const RunFailureClass = z.enum([
+	"never_started",
+	"timed_out",
+	"dead_orchestrator",
+	"step_failure",
+	"cancelled"
 ]);
 /**
 * `step_type` values for the user-facing cache pseudo-steps that appear in the
@@ -151,6 +183,14 @@ const CacheOutcome = z.enum([
 	"skipped",
 	"error"
 ]);
+/**
+* Failure reason the Platform records on a run it fails because that run's
+* orchestrator disconnected and did not reconnect within the stale threshold.
+* Written by the Platform stale-detector into `execution_runs.failure_reason`
+* and matched by the dashboard to render the "stale / offline" run badge. A
+* shared constant so the writer (Platform) and reader (dashboard) never drift.
+*/
+const DEAD_ORCH_FAILURE_REASON = "Orchestrator disconnected and did not recover";
 /** Structured init-failure signal. Presence on a run/job means "never started". */
 const initFailureSchema = z.object({
 	scope: z.enum(["run", "job"]),
@@ -173,7 +213,15 @@ const TERMINAL_JOB_STATES = /* @__PURE__ */ new Set([
 	ExecutionJobStatus.enum.cancelled,
 	ExecutionJobStatus.enum.skipped,
 	ExecutionJobStatus.enum.timed_out_stale,
-	ExecutionJobStatus.enum.drift_dropped
+	ExecutionJobStatus.enum.drift_dropped,
+	ExecutionJobStatus.enum.unroutable
+]);
+/** Terminal step states that indicate the step is no longer running. */
+const TERMINAL_STEP_STATES = /* @__PURE__ */ new Set([
+	ExecutionStepStatus.enum.success,
+	ExecutionStepStatus.enum.failed,
+	ExecutionStepStatus.enum.skipped,
+	ExecutionStepStatus.enum.cancelled
 ]);
 /** Structured execution status update for Platform metadata tracking. */
 const executionStatusSchema = z.object({
@@ -182,6 +230,13 @@ const executionStatusSchema = z.object({
 	runId: z.string().max(128),
 	workflowName: z.string().max(128),
 	status: ExecutionRunStatus,
+	/**
+	* Routing key of the run's own source. Optional for backward compatibility
+	* with older orchestrators (absent → the Platform falls back to the WS
+	* connection's first routing key). Lets the Platform mirror attribute each
+	* run to its real source even when one orchestrator serves multiple sources.
+	*/
+	routingKey: z.string().max(128).optional(),
 	repoIdentifier: z.string().max(256).optional(),
 	/**
 	* Run-level repo provider (origin host: `github` / `gitlab` / `bitbucket` /
@@ -236,7 +291,9 @@ const executionStatusSchema = z.object({
 	* never executed a single step. Persisted in execution_runs.init_failure
 	* on both orchestrator and Platform sides. Only present when status === 'failed'.
 	*/
-	initFailure: initFailureSchema.optional()
+	initFailure: initFailureSchema.optional(),
+	/** Why a terminal run failed (only present for failed/cancelled runs). */
+	failureClass: RunFailureClass.optional()
 });
 /** Per-step status forwarded from agent to Platform (real-time). */
 const stepStatusForwardSchema = z.object({
@@ -274,8 +331,8 @@ const jobStatusForwardSchema = z.object({
 	orchestratorId: z.string().max(128).nullable().optional(),
 	/** Labels used for agent routing. */
 	runsOnLabels: z.array(z.string().max(128)).max(30).optional(),
-	/** Ordered bound deployment-environment names for this job (multi-env jobs). */
-	environments: z.array(z.string().max(128)).max(30).optional(),
+	/** Ordered bound context names for this job (multi-context jobs). */
+	contexts: z.array(z.string().max(128)).max(30).optional(),
 	/**
 	* Total raw log bytes accumulated across all steps of this job, summed by
 	* the orchestrator from per-step `logBytesStreamed` values reported by the
@@ -288,45 +345,56 @@ const jobStatusForwardSchema = z.object({
 	initFailure: initFailureSchema.optional()
 });
 /** State replay sent on orchestrator reconnection -- full snapshot of active runs and jobs. */
+/**
+* A single run's full mirror-projection shape, as carried in `state.replay`.
+*
+* Carried by the orchestrator-reconnect `state.replay` push and consumed by the
+* Platform's shared `upsertRunMirror` mirror-projection helper. Extracting it as
+* a named schema keeps a single source of truth for any future reconciliation
+* path that projects the same per-run shape.
+*/
+const stateReplayRunSchema = z.object({
+	runId: z.string().max(128),
+	workflowName: z.string().max(128),
+	status: ExecutionRunStatus,
+	routingKey: z.string().max(128).optional(),
+	repoIdentifier: z.string().max(256).optional(),
+	sha: z.string().max(128).optional(),
+	ref: z.string().max(128).optional(),
+	triggerEvent: z.string().max(128).optional(),
+	commitMessage: z.string().max(STATUS_FREE_TEXT_MAX).optional(),
+	jobCount: z.number(),
+	startedAt: z.number(),
+	completedAt: z.number().optional(),
+	durationMs: z.number().optional(),
+	parentRunId: z.string().max(128).nullable().optional(),
+	originalRunId: z.string().max(128).nullable().optional(),
+	triggeredBy: z.string().max(128).nullable().optional(),
+	triggeredByAgentLabel: z.string().max(128).nullable().optional(),
+	/** Human-readable reason why the run failed (only present for failed runs). */
+	failureReason: z.string().max(STATUS_FREE_TEXT_MAX).optional(),
+	/** Why the run failed (`RunFailureClass`); only present for failed/cancelled runs. */
+	failureClass: RunFailureClass.optional(),
+	jobs: z.array(z.object({
+		jobId: z.string().max(128),
+		jobName: z.string().max(128),
+		status: z.string().max(128),
+		startedAt: z.number().optional(),
+		completedAt: z.number().optional(),
+		durationMs: z.number().optional(),
+		errorMessage: z.string().max(STATUS_FREE_TEXT_MAX).nullable().optional(),
+		agentId: z.string().max(128).nullable().optional(),
+		runsOnLabels: z.array(z.string().max(128)).max(30).optional(),
+		contexts: z.array(z.string().max(128)).max(30).optional()
+	})).max(MAX_JOBS_PER_RUN)
+});
 const stateReplaySchema = z.object({
 	type: z.literal("state.replay"),
 	messageId: z.string().max(128),
-	runs: z.array(z.object({
-		runId: z.string().max(128),
-		workflowName: z.string().max(128),
-		status: ExecutionRunStatus,
-		routingKey: z.string().max(128).optional(),
-		repoIdentifier: z.string().max(256).optional(),
-		sha: z.string().max(128).optional(),
-		ref: z.string().max(128).optional(),
-		triggerEvent: z.string().max(128).optional(),
-		commitMessage: z.string().max(STATUS_FREE_TEXT_MAX).optional(),
-		jobCount: z.number(),
-		startedAt: z.number(),
-		completedAt: z.number().optional(),
-		durationMs: z.number().optional(),
-		parentRunId: z.string().max(128).nullable().optional(),
-		originalRunId: z.string().max(128).nullable().optional(),
-		triggeredBy: z.string().max(128).nullable().optional(),
-		triggeredByAgentLabel: z.string().max(128).nullable().optional(),
-		/** Human-readable reason why the run failed (only present for failed runs). */
-		failureReason: z.string().max(STATUS_FREE_TEXT_MAX).optional(),
-		jobs: z.array(z.object({
-			jobId: z.string().max(128),
-			jobName: z.string().max(128),
-			status: z.string().max(128),
-			startedAt: z.number().optional(),
-			completedAt: z.number().optional(),
-			durationMs: z.number().optional(),
-			errorMessage: z.string().max(STATUS_FREE_TEXT_MAX).nullable().optional(),
-			agentId: z.string().max(128).nullable().optional(),
-			runsOnLabels: z.array(z.string().max(128)).max(30).optional(),
-			environments: z.array(z.string().max(128)).max(30).optional()
-		})).max(MAX_JOBS_PER_RUN)
-	})).max(500),
+	runs: z.array(stateReplayRunSchema).max(500),
 	timestamp: z.number()
 });
 //#endregion
-export { CacheOutcome, CacheRunEventType, CacheStepType, ENVIRONMENTS_MAX, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, MAX_JOBS_PER_RUN, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, STATE_REPLAY_MAX_RUNS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplaySchema, statusOptionsForLevel, stepStatusForwardSchema };
+export { CONTEXTS_MAX, CacheOutcome, CacheRunEventType, CacheStepType, DEAD_ORCH_FAILURE_REASON, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, MAX_JOBS_PER_RUN, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RunFailureClass, STATE_REPLAY_MAX_RUNS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepStatusForwardSchema };
 
 //# sourceMappingURL=execution-status.js.map

package/dist/protocol/messages/heartbeat-health.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Heartbeat-freshness policy for Platform connection and agent health.
+ *
+ * Two distinct policies live here, and their numbers differ on purpose.
+ *
+ * **Rendering policy** — badge freshness, computed from `last_heartbeat_at` on
+ * a DB row, by any instance. Advisory: nothing routes on a badge, so it can
+ * afford a tight bound. Two independent heartbeat domains consult it — Platform
+ * connection health (platform_connections) and agent liveness in the
+ * dashboard's infrastructure tree — so the two badges cannot drift apart.
+ * Browser-safe so the dashboard renders against the same numbers the server
+ * computes with.
+ *
+ * **Teardown policy** — applied by the owning instance to its own live sockets.
+ * Wider than the rendering bounds because the `platform_connections.status`
+ * write it drives gates every `status = 'connected'` reader — among them the
+ * plan-limit connection count, the cross-instance relay lookup, the dashboard
+ * proxy's owning-instance lookup, and the stale-orchestrator detector. Marking
+ * a live socket unhealthy too eagerly removes it from routing while it is still
+ * serving.
+ *
+ * The two policies also cover different lifetimes. An instance that closes a
+ * socket at HEARTBEAT_CLOSE_MS deletes its row in the same step, so the `stale`
+ * (HEARTBEAT_DEGRADED_MS) and `orphaned` (HEARTBEAT_STALE_THRESHOLD_SECONDS)
+ * levels describe rows that delete never ran for — the ones the orphan sweeper
+ * reaps. That is why the sweeper cutoff sits at twice HEARTBEAT_CLOSE_MS: a
+ * clean close always beats the sweep to the row.
+ *
+ * Neither policy has an unclassified case, which is what makes them safe to
+ * keep separate: the rendering policy maps a missing `last_heartbeat_at` to
+ * `orphaned` (worst-case, no heartbeat evidence at all), and the teardown
+ * policy never encounters one because the registry stamps `lastHeartbeatAt` at
+ * registration. Any future attempt to collapse the two must preserve that — an
+ * unknown treated as healthy hides a dead peer, and one treated as unhealthy
+ * sheds a live one.
+ *
+ * Consumers:
+ *  - platform ws/connection-health.ts       — the four-level status computation
+ *  - platform ws/heartbeat.ts               — the teardown policy
+ *  - platform queue/jobs/orphan-sweeper.ts  — periodic DELETE of orphan rows
+ *  - platform ws/registry.ts                — plan-limit count excludes stale rows
+ *  - platform dashboard/routes/admin.ts     — GET /admin/connections filter enum
+ *  - platform dev-ops/developer-ops.ts      — the diagnostics badge + orphan count
+ *  - dashboard utils/diagnostics-helpers.ts — agent heartbeat badge colour
+ */
+import { z } from 'zod';
+/** A heartbeat younger than this is fully healthy. */
+export declare const HEARTBEAT_FRESH_MS = 60000;
+/** Between fresh and this, the peer is degraded but not yet presumed gone. */
+export declare const HEARTBEAT_DEGRADED_MS = 300000;
+/**
+ * A row is considered stale (the owning orchestrator process is no longer
+ * publishing heartbeats) when `last_heartbeat_at` is older than this. Past it,
+ * the connection is orphaned and the sweeper is entitled to delete the row.
+ *
+ * The Platform's same-instance DB eviction on reconnect
+ * (`ws/handler.ts#handleSourceRegistration`) shares this rationale: the DELETE
+ * itself is unconditional on staleness, but the reason it is needed at all is
+ * this same staleness window.
+ */
+export declare const HEARTBEAT_STALE_THRESHOLD_SECONDS = 360;
+/**
+ * Silence after which the owning instance writes
+ * `platform_connections.status = 'unhealthy'`. Wider than HEARTBEAT_FRESH_MS
+ * because that write gates relay routing, not rendering.
+ */
+export declare const HEARTBEAT_UNHEALTHY_MARK_MS = 90000;
+/**
+ * Silence after which the owning instance closes the socket with
+ * WS_CLOSE_HEARTBEAT_TIMEOUT (4004) and drops it from the registry — which
+ * deletes the platform_connections row too. A row outlives its socket only when
+ * that delete never ran; the orphan sweeper reaps those.
+ */
+export declare const HEARTBEAT_CLOSE_MS = 180000;
+/** The four-level connection health vocabulary, worst-last. */
+export declare const connectionHealthStatusSchema: z.ZodEnum<{
+    connected: "connected";
+    orphaned: "orphaned";
+    stale: "stale";
+    unhealthy: "unhealthy";
+}>;
+export type ConnectionHealthStatus = z.infer<typeof connectionHealthStatusSchema>;
+//# sourceMappingURL=heartbeat-health.d.ts.map

package/dist/protocol/messages/heartbeat-health.js

@@ -0,0 +1,87 @@
+import "../../rolldown-runtime-ClRpJifh.js";
+import { z } from "zod";
+//#region src/protocol/messages/heartbeat-health.ts
+/**
+* Heartbeat-freshness policy for Platform connection and agent health.
+*
+* Two distinct policies live here, and their numbers differ on purpose.
+*
+* **Rendering policy** — badge freshness, computed from `last_heartbeat_at` on
+* a DB row, by any instance. Advisory: nothing routes on a badge, so it can
+* afford a tight bound. Two independent heartbeat domains consult it — Platform
+* connection health (platform_connections) and agent liveness in the
+* dashboard's infrastructure tree — so the two badges cannot drift apart.
+* Browser-safe so the dashboard renders against the same numbers the server
+* computes with.
+*
+* **Teardown policy** — applied by the owning instance to its own live sockets.
+* Wider than the rendering bounds because the `platform_connections.status`
+* write it drives gates every `status = 'connected'` reader — among them the
+* plan-limit connection count, the cross-instance relay lookup, the dashboard
+* proxy's owning-instance lookup, and the stale-orchestrator detector. Marking
+* a live socket unhealthy too eagerly removes it from routing while it is still
+* serving.
+*
+* The two policies also cover different lifetimes. An instance that closes a
+* socket at HEARTBEAT_CLOSE_MS deletes its row in the same step, so the `stale`
+* (HEARTBEAT_DEGRADED_MS) and `orphaned` (HEARTBEAT_STALE_THRESHOLD_SECONDS)
+* levels describe rows that delete never ran for — the ones the orphan sweeper
+* reaps. That is why the sweeper cutoff sits at twice HEARTBEAT_CLOSE_MS: a
+* clean close always beats the sweep to the row.
+*
+* Neither policy has an unclassified case, which is what makes them safe to
+* keep separate: the rendering policy maps a missing `last_heartbeat_at` to
+* `orphaned` (worst-case, no heartbeat evidence at all), and the teardown
+* policy never encounters one because the registry stamps `lastHeartbeatAt` at
+* registration. Any future attempt to collapse the two must preserve that — an
+* unknown treated as healthy hides a dead peer, and one treated as unhealthy
+* sheds a live one.
+*
+* Consumers:
+*  - platform ws/connection-health.ts       — the four-level status computation
+*  - platform ws/heartbeat.ts               — the teardown policy
+*  - platform queue/jobs/orphan-sweeper.ts  — periodic DELETE of orphan rows
+*  - platform ws/registry.ts                — plan-limit count excludes stale rows
+*  - platform dashboard/routes/admin.ts     — GET /admin/connections filter enum
+*  - platform dev-ops/developer-ops.ts      — the diagnostics badge + orphan count
+*  - dashboard utils/diagnostics-helpers.ts — agent heartbeat badge colour
+*/
+/** A heartbeat younger than this is fully healthy. */
+const HEARTBEAT_FRESH_MS = 6e4;
+/** Between fresh and this, the peer is degraded but not yet presumed gone. */
+const HEARTBEAT_DEGRADED_MS = 3e5;
+/**
+* A row is considered stale (the owning orchestrator process is no longer
+* publishing heartbeats) when `last_heartbeat_at` is older than this. Past it,
+* the connection is orphaned and the sweeper is entitled to delete the row.
+*
+* The Platform's same-instance DB eviction on reconnect
+* (`ws/handler.ts#handleSourceRegistration`) shares this rationale: the DELETE
+* itself is unconditional on staleness, but the reason it is needed at all is
+* this same staleness window.
+*/
+const HEARTBEAT_STALE_THRESHOLD_SECONDS = 360;
+/**
+* Silence after which the owning instance writes
+* `platform_connections.status = 'unhealthy'`. Wider than HEARTBEAT_FRESH_MS
+* because that write gates relay routing, not rendering.
+*/
+const HEARTBEAT_UNHEALTHY_MARK_MS = 9e4;
+/**
+* Silence after which the owning instance closes the socket with
+* WS_CLOSE_HEARTBEAT_TIMEOUT (4004) and drops it from the registry — which
+* deletes the platform_connections row too. A row outlives its socket only when
+* that delete never ran; the orphan sweeper reaps those.
+*/
+const HEARTBEAT_CLOSE_MS = 18e4;
+/** The four-level connection health vocabulary, worst-last. */
+const connectionHealthStatusSchema = z.enum([
+	"connected",
+	"unhealthy",
+	"stale",
+	"orphaned"
+]);
+//#endregion
+export { HEARTBEAT_CLOSE_MS, HEARTBEAT_DEGRADED_MS, HEARTBEAT_FRESH_MS, HEARTBEAT_STALE_THRESHOLD_SECONDS, HEARTBEAT_UNHEALTHY_MARK_MS, connectionHealthStatusSchema };
+
+//# sourceMappingURL=heartbeat-health.js.map

package/dist/protocol/messages/log-stream.d.ts

@@ -0,0 +1,18 @@
+import { z } from 'zod';
+/**
+ * Which of a subprocess's two output streams a run-log line came from.
+ *
+ * Carried per log chunk rather than per line: chunks are delivered in order and
+ * the agent closes the pending chunk whenever the kind flips, so stdout/stderr
+ * interleaving is preserved without a per-line field.
+ *
+ * Lives in its own module because three protocol planes reference it — the
+ * agent→orchestrator chunk, the orchestrator→Platform relay, and the
+ * Platform→browser fan-out — and a shared leaf keeps those files acyclic.
+ */
+export declare const LogStream: z.ZodEnum<{
+    stderr: "stderr";
+    stdout: "stdout";
+}>;
+export type LogStream = z.infer<typeof LogStream>;
+//# sourceMappingURL=log-stream.d.ts.map

package/dist/protocol/messages/log-stream.js

@@ -0,0 +1,19 @@
+import "../../rolldown-runtime-ClRpJifh.js";
+import { z } from "zod";
+//#region src/protocol/messages/log-stream.ts
+/**
+* Which of a subprocess's two output streams a run-log line came from.
+*
+* Carried per log chunk rather than per line: chunks are delivered in order and
+* the agent closes the pending chunk whenever the kind flips, so stdout/stderr
+* interleaving is preserved without a per-line field.
+*
+* Lives in its own module because three protocol planes reference it — the
+* agent→orchestrator chunk, the orchestrator→Platform relay, and the
+* Platform→browser fan-out — and a shared leaf keeps those files acyclic.
+*/
+const LogStream = z.enum(["stdout", "stderr"]);
+//#endregion
+export { LogStream };
+
+//# sourceMappingURL=log-stream.js.map

package/dist/protocol/messages/oidc-mint.d.ts

@@ -1,4 +1,11 @@
 import { z } from 'zod';
+/**
+ * @deprecated The `oidc.mint.*` RPC pair (Platform-rooted identity mint) is
+ * hard-deprecated in favor of orchestrator-owned signing. It is kept
+ * wire-compatible for the mixed-version rollout window and removed at v1.0; a
+ * fresh orchestrator with its own signer never sends it. See
+ * docs/user/deprecations.md.
+ */
 /**
  * Error discriminator for a failed provenance mint, carried on
  * `oidc.mint.response.error.code`. Mirrors the three orchestrator-side error

package/dist/protocol/messages/oidc-mint.js

@@ -3,6 +3,13 @@ import { AttestationOrigin } from "../../provenance/attestation-origin.js";
 import { z } from "zod";
 //#region src/protocol/messages/oidc-mint.ts
 /**
+* @deprecated The `oidc.mint.*` RPC pair (Platform-rooted identity mint) is
+* hard-deprecated in favor of orchestrator-owned signing. It is kept
+* wire-compatible for the mixed-version rollout window and removed at v1.0; a
+* fresh orchestrator with its own signer never sends it. See
+* docs/user/deprecations.md.
+*/
+/**
 * Error discriminator for a failed provenance mint, carried on
 * `oidc.mint.response.error.code`. Mirrors the three orchestrator-side error
 * classes that consume it: