@kici-dev/engine 0.1.27 → 0.3.0

package/dist/protocol/messages/platform-orchestrator.d.ts

@@ -1,22 +1,54 @@
 import { z } from 'zod';
+/**
+ * Org trust policy — Platform-owned tenant policy pushed to the orchestrator.
+ * The orchestrator caches and enforces it; it never owns it. Named separately
+ * from the enclosing message so the orchestrator's evaluator and cache can type
+ * against the policy alone.
+ */
+/**
+ * Documented default hours a security hold stays open.
+ *
+ * The single owner of the value: the fail-closed policy, the orchestrator's
+ * stored-policy default, and the hold-sizing fallback all read it, so the
+ * number cannot drift between the two packages that enforce it.
+ */
+export declare const DEFAULT_APPROVAL_EXPIRY_HOURS = 72;
+export declare const trustPolicySchema: z.ZodObject<{
+    forkPolicy: z.ZodEnum<{
+        allow: "allow";
+        hold: "hold";
+        reject: "reject";
+    }>;
+    unknownContributorPolicy: z.ZodEnum<{
+        hold: "hold";
+        reject: "reject";
+    }>;
+    workflowChangePolicy: z.ZodEnum<{
+        allow: "allow";
+        hold: "hold";
+        reject: "reject";
+    }>;
+    approvalExpiryHours: z.ZodNumber;
+}, z.core.$strip>;
+export type TrustPolicy = z.infer<typeof trustPolicySchema>;
 /** Trust policy update pushed from Platform to orchestrator when policy or identity links change. */
 export declare const trustPolicyUpdateSchema: z.ZodObject<{
     type: z.ZodLiteral<"trust_policy.update">;
     orgId: z.ZodString;
     policy: z.ZodObject<{
         forkPolicy: z.ZodEnum<{
+            allow: "allow";
             hold: "hold";
             reject: "reject";
-            allow: "allow";
         }>;
         unknownContributorPolicy: z.ZodEnum<{
             hold: "hold";
             reject: "reject";
         }>;
         workflowChangePolicy: z.ZodEnum<{
+            allow: "allow";
             hold: "hold";
             reject: "reject";
-            allow: "allow";
         }>;
         approvalExpiryHours: z.ZodNumber;
     }, z.core.$strip>;
@@ -27,10 +59,10 @@ export declare const trustPolicyUpdateSchema: z.ZodObject<{
         providerUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, z.core.$strip>>;
     memberCiTrustLevels: z.ZodRecord<z.ZodString, z.ZodEnum<{
+        admin: "admin";
         none: "none";
         read: "read";
         write: "write";
-        admin: "admin";
     }>>;
     teamMemberships: z.ZodDefault<z.ZodArray<z.ZodObject<{
         teamName: z.ZodString;
@@ -80,12 +112,18 @@ export declare const webhookRelaySchema: z.ZodObject<{
  *   is malformed (e.g. invalid JSON in generic_webhook_sources.verification_config) or
  *   the chunked stream itself was malformed (out-of-order, oversize, base64 decode fail,
  *   missing chunks at finalization, TTL expiry). Maps to HTTP 500.
+ * - `shed_retry_later`: the orchestrator's ingest admission controller is
+ *   saturated and shed this delivery (event-loop overload or per-org/global
+ *   cap). Maps to HTTP 429 + Retry-After — a terminal, RETRYABLE result: the
+ *   caller redelivers, the delivery is not lost, and Platform does NOT fail
+ *   over to a pool peer (peers share the same overloaded orchestrator DB).
  */
 export declare const WebhookRelayResult: z.ZodEnum<{
     accepted: "accepted";
+    rejected_misconfigured: "rejected_misconfigured";
     rejected_signature: "rejected_signature";
     rejected_unknown_source: "rejected_unknown_source";
-    rejected_misconfigured: "rejected_misconfigured";
+    shed_retry_later: "shed_retry_later";
 }>;
 export type WebhookRelayResult = z.infer<typeof WebhookRelayResult>;
 /**
@@ -181,6 +219,23 @@ export declare const staleCheckrunCleanupSchema: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type StaleCheckrunCleanup = z.infer<typeof staleCheckrunCleanupSchema>;
+/**
+ * Platform capability advertisement, sent once by the Platform after the
+ * orchestrator authenticates. The orchestrator caches it per connection and
+ * pre-flight-checks its own feature-gated sends against it, so a self-hosted
+ * orchestrator running ahead of the hosted Platform surfaces a diagnosable
+ * capability gap instead of firing a frame the Platform would silently drop.
+ * Payload is `platformCapabilitiesSchema` (`.passthrough()`, absent =
+ * unsupported).
+ */
+export declare const platformCapabilitiesMessageSchema: z.ZodObject<{
+    type: z.ZodLiteral<"platform.capabilities">;
+    capabilities: z.ZodObject<{
+        orchMetrics: z.ZodOptional<z.ZodBoolean>;
+        oidcMint: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>;
+}, z.core.$strip>;
+export type PlatformCapabilitiesMessage = z.infer<typeof platformCapabilitiesMessageSchema>;
 /**
  * Periodic OTel metrics push from orchestrator to Platform for centralized observability.
  *
@@ -203,8 +258,8 @@ export declare const orchMetricsSchema: z.ZodObject<{
         name: z.ZodString;
         type: z.ZodEnum<{
             counter: "counter";
-            histogram: "histogram";
             gauge: "gauge";
+            histogram: "histogram";
             upDownCounter: "upDownCounter";
         }>;
         value: z.ZodOptional<z.ZodNumber>;
@@ -233,9 +288,10 @@ export declare const webhookAckSchema: z.ZodObject<{
     deliveryId: z.ZodString;
     result: z.ZodOptional<z.ZodEnum<{
         accepted: "accepted";
+        rejected_misconfigured: "rejected_misconfigured";
         rejected_signature: "rejected_signature";
         rejected_unknown_source: "rejected_unknown_source";
-        rejected_misconfigured: "rejected_misconfigured";
+        shed_retry_later: "shed_retry_later";
     }>>;
     reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>;
@@ -245,10 +301,10 @@ export declare const executionEventSchema: z.ZodObject<{
     messageId: z.ZodString;
     runId: z.ZodString;
     event: z.ZodEnum<{
-        started: "started";
-        job_dispatched: "job_dispatched";
-        job_completed: "job_completed";
         finished: "finished";
+        job_completed: "job_completed";
+        job_dispatched: "job_dispatched";
+        started: "started";
     }>;
     data: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     timestamp: z.ZodNumber;
@@ -262,13 +318,59 @@ export declare const logChunkSchema: z.ZodObject<{
     stepIndex: z.ZodNumber;
     lines: z.ZodArray<z.ZodString>;
     timestamp: z.ZodNumber;
+    stream: z.ZodOptional<z.ZodEnum<{
+        stderr: "stderr";
+        stdout: "stdout";
+    }>>;
+}, z.core.$strip>;
+/**
+ * Phase of an orchestration/provisioning log line. Mirrors the phases the
+ * orchestrator writes into its per-job orchestration/provisioning JSONL files
+ * and that the dashboard splits the run-detail orch-log viewer by. `unknown`
+ * is the fallback for a line whose stored phase is missing/unrecognized.
+ */
+export declare const OrchLogPhase: z.ZodEnum<{
+    dispatch: "dispatch";
+    provisioning: "provisioning";
+    setup: "setup";
+    teardown: "teardown";
+    unknown: "unknown";
+}>;
+export type OrchLogPhase = z.infer<typeof OrchLogPhase>;
+/**
+ * Live orchestration/provisioning log line(s) pushed orchestrator -> Platform.
+ *
+ * Emitted at the orchestrator's `writeOrchLog` / provisioning-write tap points
+ * (in addition to persisting to LogStorage, which stays the authoritative
+ * backfill source). Platform fans this out to browser subscribers keyed by
+ * `(runId, jobId)` as an `orch-log.lines` message. `lines` carries the raw
+ * message strings for this phase; `ts` is the write timestamp (ms).
+ *
+ * Best-effort: a push failure never breaks dispatch (fire-and-forget at the
+ * write site). Not correlated/acked, so — unlike step `log.chunk` — it is not
+ * fast-pathed and carries no `messageId`.
+ */
+export declare const orchLogChunkSchema: z.ZodObject<{
+    type: z.ZodLiteral<"orch-log.chunk">;
+    runId: z.ZodString;
+    jobId: z.ZodString;
+    phase: z.ZodEnum<{
+        dispatch: "dispatch";
+        provisioning: "provisioning";
+        setup: "setup";
+        teardown: "teardown";
+        unknown: "unknown";
+    }>;
+    lines: z.ZodArray<z.ZodString>;
+    ts: z.ZodNumber;
 }, z.core.$strip>;
+export type OrchLogChunk = z.infer<typeof orchLogChunkSchema>;
 /** Cache lookup statistics forwarded from orchestrator to Platform for centralized metrics. */
 export declare const cacheStatsSchema: z.ZodObject<{
     type: z.ZodLiteral<"cache.stats">;
     cacheType: z.ZodEnum<{
-        source: "source";
         dep: "dep";
+        source: "source";
     }>;
     hit: z.ZodBoolean;
 }, z.core.$strip>;
@@ -289,36 +391,48 @@ export declare const orchCapabilitiesUpdateSchema: z.ZodObject<{
             coordinator: "coordinator";
             worker: "worker";
         }>>;
-        dashboardWrites: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
-            "secrets.set": "secrets.set";
-            "secrets.delete": "secrets.delete";
-            "secrets.scope.create": "secrets.scope.create";
-            "secrets.scope.rename": "secrets.scope.rename";
-            "secrets.scope.delete": "secrets.scope.delete";
-            "variables.set": "variables.set";
-            "variables.delete": "variables.delete";
-            "contexts.create": "contexts.create";
-            "contexts.update": "contexts.update";
-            "contexts.test_access.set": "contexts.test_access.set";
-            "contexts.delete": "contexts.delete";
-            "contexts.bindings.set": "contexts.bindings.set";
-            "contexts.source_overrides.set": "contexts.source_overrides.set";
-            "contexts.source_overrides.delete": "contexts.source_overrides.delete";
-            "held_runs.approve": "held_runs.approve";
-            "held_runs.reject": "held_runs.reject";
-            "event_dlq.retry": "event_dlq.retry";
-            "event_dlq.discard": "event_dlq.discard";
+        dashboardWrites: z.ZodOptional<z.ZodPipe<z.ZodRecord<z.ZodEnum<{
             "attestations.retry": "attestations.retry";
-            "registration.disable": "registration.disable";
-            "registration.delete": "registration.delete";
-            "global_workflows.update": "global_workflows.update";
             "backends.sync": "backends.sync";
             "backends.sync_one": "backends.sync_one";
             "backends.test": "backends.test";
+            "contexts.bindings.set": "contexts.bindings.set";
+            "contexts.create": "contexts.create";
+            "contexts.delete": "contexts.delete";
+            "contexts.source_overrides.delete": "contexts.source_overrides.delete";
+            "contexts.source_overrides.set": "contexts.source_overrides.set";
+            "contexts.test_access.set": "contexts.test_access.set";
+            "contexts.update": "contexts.update";
+            "event_dlq.discard": "event_dlq.discard";
+            "event_dlq.retry": "event_dlq.retry";
             "fleet.host.declare": "fleet.host.declare";
             "fleet.host.remove": "fleet.host.remove";
-        }> & z.core.$partial, z.ZodBoolean>>;
+            "global_workflows.update": "global_workflows.update";
+            "held_runs.approve": "held_runs.approve";
+            "held_runs.reject": "held_runs.reject";
+            "registration.delete": "registration.delete";
+            "registration.disable": "registration.disable";
+            "secrets.delete": "secrets.delete";
+            "secrets.scope.create": "secrets.scope.create";
+            "secrets.scope.delete": "secrets.scope.delete";
+            "secrets.scope.rename": "secrets.scope.rename";
+            "secrets.set": "secrets.set";
+            "variables.delete": "variables.delete";
+            "variables.set": "variables.set";
+        }> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodEnum<{
+            disabled: "disabled";
+            encrypted: "encrypted";
+            permissive: "permissive";
+        }>]>>, z.ZodTransform<Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive">>, Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive" | boolean>>>>>;
         supportedDashboardRequests: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        dashboardEncryptionKey: z.ZodOptional<z.ZodObject<{
+            kty: z.ZodLiteral<"OKP">;
+            crv: z.ZodLiteral<"X25519">;
+            x: z.ZodString;
+            kid: z.ZodString;
+            use: z.ZodOptional<z.ZodLiteral<"enc">>;
+        }, z.core.$loose>>;
+        dashboardVerifiedIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, z.core.$loose>;
 }, z.core.$strip>;
 export type OrchCapabilitiesUpdate = z.infer<typeof orchCapabilitiesUpdateSchema>;
@@ -358,18 +472,18 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     orgId: z.ZodString;
     policy: z.ZodObject<{
         forkPolicy: z.ZodEnum<{
+            allow: "allow";
             hold: "hold";
             reject: "reject";
-            allow: "allow";
         }>;
         unknownContributorPolicy: z.ZodEnum<{
             hold: "hold";
             reject: "reject";
         }>;
         workflowChangePolicy: z.ZodEnum<{
+            allow: "allow";
             hold: "hold";
             reject: "reject";
-            allow: "allow";
         }>;
         approvalExpiryHours: z.ZodNumber;
     }, z.core.$strip>;
@@ -380,10 +494,10 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         providerUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, z.core.$strip>>;
     memberCiTrustLevels: z.ZodRecord<z.ZodString, z.ZodEnum<{
+        admin: "admin";
         none: "none";
         read: "read";
         write: "write";
-        admin: "admin";
     }>>;
     teamMemberships: z.ZodDefault<z.ZodArray<z.ZodObject<{
         teamName: z.ZodString;
@@ -466,6 +580,17 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         }>;
         message: z.ZodString;
     }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"platform.capabilities">;
+    capabilities: z.ZodObject<{
+        orchMetrics: z.ZodOptional<z.ZodBoolean>;
+        oidcMint: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"nack">;
+    messageId: z.ZodOptional<z.ZodString>;
+    receivedType: z.ZodOptional<z.ZodString>;
+    reason: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.run.detail">;
     requestId: z.ZodString;
@@ -526,6 +651,36 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         component: z.ZodString;
     }, z.core.$strip>], "type">;
     runId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.run.state">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+        agent: z.ZodOptional<z.ZodObject<{
+            patId: z.ZodString;
+            label: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+        agent: z.ZodOptional<z.ZodObject<{
+            label: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.step.logs">;
     requestId: z.ZodString;
@@ -625,10 +780,10 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         digest: z.ZodOptional<z.ZodString>;
         name: z.ZodOptional<z.ZodString>;
         status: z.ZodOptional<z.ZodEnum<{
-            pending: "pending";
             failed: "failed";
-            verified: "verified";
+            pending: "pending";
             unverifiable: "unverifiable";
+            verified: "verified";
         }>>;
         repository: z.ZodOptional<z.ZodString>;
         workflow: z.ZodOptional<z.ZodString>;
@@ -696,6 +851,36 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         component: z.ZodString;
     }, z.core.$strip>], "type">;
     runId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.artifacts.list">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+        agent: z.ZodOptional<z.ZodObject<{
+            patId: z.ZodString;
+            label: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+        agent: z.ZodOptional<z.ZodObject<{
+            label: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.runs.list">;
     requestId: z.ZodString;
@@ -1040,8 +1225,8 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     branchRestrictions: z.ZodOptional<z.ZodArray<z.ZodString>>;
     concurrencyLimit: z.ZodOptional<z.ZodNumber>;
     concurrencyStrategy: z.ZodOptional<z.ZodEnum<{
-        queue: "queue";
         "cancel-pending": "cancel-pending";
+        queue: "queue";
     }>>;
     requiredReviewers: z.ZodOptional<z.ZodNumber>;
     waitTimerSeconds: z.ZodOptional<z.ZodNumber>;
@@ -1087,8 +1272,8 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         branchRestrictions: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
         concurrencyLimit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
         concurrencyStrategy: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
-            queue: "queue";
             "cancel-pending": "cancel-pending";
+            queue: "queue";
         }>>>;
         requiredReviewers: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
         waitTimerSeconds: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
@@ -1217,7 +1402,12 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     }, z.core.$strip>], "type">;
     contextId: z.ZodString;
     key: z.ZodString;
-    value: z.ZodString;
+    value: z.ZodOptional<z.ZodString>;
+    sealed: z.ZodOptional<z.ZodObject<{
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        encrypted: z.ZodString;
+    }, z.core.$strip>>;
     locked: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.contexts.variables.delete">;
@@ -1470,7 +1660,12 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     }, z.core.$strip>], "type">;
     scope: z.ZodString;
     key: z.ZodString;
-    value: z.ZodString;
+    value: z.ZodOptional<z.ZodString>;
+    sealed: z.ZodOptional<z.ZodObject<{
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        encrypted: z.ZodString;
+    }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.contexts.secrets.delete">;
     requestId: z.ZodString;
@@ -1655,16 +1850,18 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         component: z.ZodString;
     }, z.core.$strip>], "type">;
     status: z.ZodOptional<z.ZodEnum<{
-        pending: "pending";
         approved: "approved";
-        rejected: "rejected";
         expired: "expired";
+        pending: "pending";
+        rejected: "rejected";
+        released: "released";
     }>>;
     queueType: z.ZodOptional<z.ZodEnum<{
         context: "context";
         security: "security";
     }>>;
     runId: z.ZodOptional<z.ZodString>;
+    heldRunId: z.ZodOptional<z.ZodString>;
     orgId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.held-runs.approve">;
@@ -2275,18 +2472,50 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     routingKey: z.ZodOptional<z.ZodString>;
     event: z.ZodOptional<z.ZodString>;
     status: z.ZodOptional<z.ZodEnum<{
-        failed: "failed";
-        received: "received";
-        processed: "processed";
         duplicate: "duplicate";
-        lockfile_missing: "lockfile_missing";
+        failed: "failed";
         lockfile_corrupt: "lockfile_corrupt";
+        lockfile_missing: "lockfile_missing";
+        processed: "processed";
+        received: "received";
     }>>;
     fromTimestamp: z.ZodOptional<z.ZodString>;
     toTimestamp: z.ZodOptional<z.ZodString>;
     deliveryId: z.ZodOptional<z.ZodString>;
     limit: z.ZodOptional<z.ZodNumber>;
     cursor: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.event-log.activity">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+        agent: z.ZodOptional<z.ZodObject<{
+            patId: z.ZodString;
+            label: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+        agent: z.ZodOptional<z.ZodObject<{
+            label: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    orgId: z.ZodString;
+    fromTimestamp: z.ZodString;
+    toTimestamp: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.event-log.detail">;
     requestId: z.ZodString;
@@ -2577,117 +2806,126 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     }, z.core.$strip>], "type">;
     orgId: z.ZodString;
     actorType: z.ZodOptional<z.ZodEnum<{
-        user: "user";
         api_key: "api_key";
-        service_account: "service_account";
         platform_operator: "platform_operator";
+        service_account: "service_account";
         system: "system";
+        user: "user";
     }>>;
     actorId: z.ZodOptional<z.ZodString>;
     action: z.ZodOptional<z.ZodEnum<{
-        "event_dlq.retry": "event_dlq.retry";
-        "event_dlq.discard": "event_dlq.discard";
-        "registration.disable": "registration.disable";
-        "registration.delete": "registration.delete";
-        "global_workflows.update": "global_workflows.update";
-        "fleet.host.declare": "fleet.host.declare";
-        "fleet.host.remove": "fleet.host.remove";
-        "run.detail.read": "run.detail.read";
-        "run.structured.read": "run.structured.read";
-        "runs.list.read": "runs.list.read";
-        "runs.filters.read": "runs.filters.read";
-        "sources.list.read": "sources.list.read";
-        "run.payload.read": "run.payload.read";
-        "run.orch_logs.read": "run.orch_logs.read";
-        "step.logs.read": "step.logs.read";
+        "access_log.list.read": "access_log.list.read";
+        archive_chunk: "archive_chunk";
+        "artifacts.read": "artifacts.read";
+        "attestation.retry": "attestation.retry";
         "attestations.read": "attestations.read";
-        "run.cancel": "run.cancel";
-        "run.rerun": "run.rerun";
-        "run.manual_schedule": "run.manual_schedule";
-        "run.trigger": "run.trigger";
-        "job.cancel": "job.cancel";
-        "event_log.list.read": "event_log.list.read";
-        "event_log.detail.read": "event_log.detail.read";
-        "event_log.payload.read": "event_log.payload.read";
-        "context.list.read": "context.list.read";
-        "context.get.read": "context.get.read";
+        "backend.get.read": "backend.get.read";
+        "backend.list.read": "backend.list.read";
+        "backend.sync": "backend.sync";
+        "backend.sync.one": "backend.sync.one";
+        "backend.test": "backend.test";
+        "cluster_name.update": "cluster_name.update";
         "context.create": "context.create";
-        "context.update": "context.update";
         "context.delete": "context.delete";
-        "context_var.list.read": "context_var.list.read";
-        "context_var.set": "context_var.set";
-        "context_var.delete": "context_var.delete";
-        "source_override.list.read": "source_override.list.read";
-        "source_override.set": "source_override.set";
-        "source_override.delete": "source_override.delete";
+        "context.get.read": "context.get.read";
+        "context.history.read": "context.history.read";
+        "context.list.read": "context.list.read";
+        "context.update": "context.update";
         "context_binding.list.read": "context_binding.list.read";
         "context_binding.set": "context_binding.set";
-        "secret.list.read": "secret.list.read";
-        "secret.set": "secret.set";
-        "secret.delete": "secret.delete";
-        "secret.reveal": "secret.reveal";
-        "secret_scope.create": "secret_scope.create";
-        "secret_scope.rename": "secret_scope.rename";
-        "secret_scope.delete": "secret_scope.delete";
-        "context.history.read": "context.history.read";
-        "held_run.list.read": "held_run.list.read";
-        "held_run.approve": "held_run.approve";
-        "held_run.auto_approve": "held_run.auto_approve";
-        "held_run.reject": "held_run.reject";
-        "held_run.request": "held_run.request";
-        "held_run.expire": "held_run.expire";
-        "registration.list.read": "registration.list.read";
+        "context_var.delete": "context_var.delete";
+        "context_var.list.read": "context_var.list.read";
+        "context_var.set": "context_var.set";
+        "db.create_readonly_user": "db.create_readonly_user";
+        "db.create_role": "db.create_role";
+        "db.ensure": "db.ensure";
+        "db.fresh": "db.fresh";
+        "db.refresh_collation_version": "db.refresh_collation_version";
+        "db.reindex": "db.reindex";
         "diagnostics.read": "diagnostics.read";
-        "scaler.capacity.read": "scaler.capacity.read";
-        "scaler.agents.read": "scaler.agents.read";
-        "fleet.read": "fleet.read";
+        "event_dlq.discard": "event_dlq.discard";
+        "event_dlq.list.read": "event_dlq.list.read";
+        "event_dlq.retry": "event_dlq.retry";
+        "event_log.detail.read": "event_log.detail.read";
+        "event_log.list.read": "event_log.list.read";
+        "event_log.payload.read": "event_log.payload.read";
+        "fleet.host.declare": "fleet.host.declare";
+        "fleet.host.remove": "fleet.host.remove";
         "fleet.init_runner.bringup": "fleet.init_runner.bringup";
         "fleet.pre_boot.send": "fleet.pre_boot.send";
-        "backend.list.read": "backend.list.read";
-        "backend.get.read": "backend.get.read";
-        "backend.sync": "backend.sync";
-        "backend.sync.one": "backend.sync.one";
-        "backend.test": "backend.test";
+        "fleet.read": "fleet.read";
         "global_workflows.get.read": "global_workflows.get.read";
+        "global_workflows.update": "global_workflows.update";
+        "held_run.approve": "held_run.approve";
+        "held_run.auto_approve": "held_run.auto_approve";
+        "held_run.expire": "held_run.expire";
+        "held_run.list.read": "held_run.list.read";
+        "held_run.reject": "held_run.reject";
+        "held_run.request": "held_run.request";
+        "job.cancel": "job.cancel";
         "org_settings.dashboard_write_policy.update": "org_settings.dashboard_write_policy.update";
-        "cluster_name.update": "cluster_name.update";
-        "attestation.retry": "attestation.retry";
-        "access_log.list.read": "access_log.list.read";
-        "event_dlq.list.read": "event_dlq.list.read";
-        archive_chunk: "archive_chunk";
         purge_chunk: "purge_chunk";
+        "registration.delete": "registration.delete";
+        "registration.disable": "registration.disable";
+        "registration.list.read": "registration.list.read";
+        "run.cancel": "run.cancel";
+        "run.detail.read": "run.detail.read";
+        "run.manual_schedule": "run.manual_schedule";
+        "run.orch_logs.read": "run.orch_logs.read";
+        "run.payload.read": "run.payload.read";
+        "run.rerun": "run.rerun";
+        "run.structured.read": "run.structured.read";
+        "run.trigger": "run.trigger";
+        "runs.filters.read": "runs.filters.read";
+        "runs.list.read": "runs.list.read";
+        "scaler.agents.read": "scaler.agents.read";
+        "scaler.capacity.read": "scaler.capacity.read";
+        "secret.delete": "secret.delete";
+        "secret.list.read": "secret.list.read";
+        "secret.reveal": "secret.reveal";
+        "secret.set": "secret.set";
+        "secret_scope.create": "secret_scope.create";
+        "secret_scope.delete": "secret_scope.delete";
+        "secret_scope.rename": "secret_scope.rename";
+        "source_override.delete": "source_override.delete";
+        "source_override.list.read": "source_override.list.read";
+        "source_override.set": "source_override.set";
+        "sources.list.read": "sources.list.read";
+        "step.logs.read": "step.logs.read";
+        "trust_policy.updated": "trust_policy.updated";
     }>>;
     source: z.ZodOptional<z.ZodEnum<{
+        admin_cli: "admin_cli";
+        admin_http: "admin_http";
         agent: "agent";
         platform_proxy: "platform_proxy";
-        admin_http: "admin_http";
-        admin_cli: "admin_cli";
     }>>;
     outcome: z.ZodOptional<z.ZodEnum<{
-        error: "error";
         allowed: "allowed";
         denied: "denied";
+        error: "error";
     }>>;
     targetType: z.ZodOptional<z.ZodEnum<{
-        job: "job";
-        step: "step";
-        run: "run";
+        access_log: "access_log";
+        attestation: "attestation";
+        backend: "backend";
+        cluster_meta: "cluster_meta";
         context: "context";
-        payload: "payload";
+        database: "database";
+        diagnostics: "diagnostics";
+        event_dlq: "event_dlq";
         event_log: "event_log";
         event_log_payload: "event_log_payload";
-        secret_scope: "secret_scope";
-        registration: "registration";
-        backend: "backend";
-        diagnostics: "diagnostics";
-        scaler: "scaler";
         fleet: "fleet";
         held_run: "held_run";
-        access_log: "access_log";
-        event_dlq: "event_dlq";
+        job: "job";
         org_settings: "org_settings";
-        cluster_meta: "cluster_meta";
-        attestation: "attestation";
+        payload: "payload";
+        registration: "registration";
+        run: "run";
+        scaler: "scaler";
+        secret_scope: "secret_scope";
+        step: "step";
     }>>;
     targetId: z.ZodOptional<z.ZodString>;
     fromTimestamp: z.ZodOptional<z.ZodString>;
@@ -2910,9 +3148,10 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
     deliveryId: z.ZodString;
     result: z.ZodOptional<z.ZodEnum<{
         accepted: "accepted";
+        rejected_misconfigured: "rejected_misconfigured";
         rejected_signature: "rejected_signature";
         rejected_unknown_source: "rejected_unknown_source";
-        rejected_misconfigured: "rejected_misconfigured";
+        shed_retry_later: "shed_retry_later";
     }>>;
     reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>, z.ZodObject<{
@@ -2920,10 +3159,10 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
     messageId: z.ZodString;
     runId: z.ZodString;
     event: z.ZodEnum<{
-        started: "started";
-        job_dispatched: "job_dispatched";
-        job_completed: "job_completed";
         finished: "finished";
+        job_completed: "job_completed";
+        job_dispatched: "job_dispatched";
+        started: "started";
     }>;
     data: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     timestamp: z.ZodNumber;
@@ -2935,20 +3174,38 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
     stepIndex: z.ZodNumber;
     lines: z.ZodArray<z.ZodString>;
     timestamp: z.ZodNumber;
+    stream: z.ZodOptional<z.ZodEnum<{
+        stderr: "stderr";
+        stdout: "stdout";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"orch-log.chunk">;
+    runId: z.ZodString;
+    jobId: z.ZodString;
+    phase: z.ZodEnum<{
+        dispatch: "dispatch";
+        provisioning: "provisioning";
+        setup: "setup";
+        teardown: "teardown";
+        unknown: "unknown";
+    }>;
+    lines: z.ZodArray<z.ZodString>;
+    ts: z.ZodNumber;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"execution.status">;
     messageId: z.ZodString;
     runId: z.ZodString;
     workflowName: z.ZodString;
     status: z.ZodEnum<{
-        success: "success";
-        pending: "pending";
-        running: "running";
-        failed: "failed";
         cancelled: "cancelled";
         cancelling: "cancelling";
+        failed: "failed";
         held: "held";
+        pending: "pending";
+        running: "running";
+        success: "success";
     }>;
+    routingKey: z.ZodOptional<z.ZodString>;
     repoIdentifier: z.ZodOptional<z.ZodString>;
     repoProvider: z.ZodOptional<z.ZodString>;
     localWorkingTree: z.ZodOptional<z.ZodBoolean>;
@@ -2976,18 +3233,28 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             run: "run";
         }>;
         category: z.ZodEnum<{
-            secret_resolution: "secret_resolution";
-            install_secrets: "install_secrets";
-            lock_resolution: "lock_resolution";
+            approval_misconfig: "approval_misconfig";
             build_coordination: "build_coordination";
             context_rules: "context_rules";
             dynamic_eval: "dynamic_eval";
-            no_agent: "no_agent";
+            install_secrets: "install_secrets";
+            lock_resolution: "lock_resolution";
             matrix_expansion: "matrix_expansion";
+            no_agent: "no_agent";
+            sandbox_denied: "sandbox_denied";
+            secret_resolution: "secret_resolution";
+            trust_policy: "trust_policy";
         }>;
         message: z.ZodString;
         jobName: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
+    failureClass: z.ZodOptional<z.ZodEnum<{
+        cancelled: "cancelled";
+        dead_orchestrator: "dead_orchestrator";
+        never_started: "never_started";
+        step_failure: "step_failure";
+        timed_out: "timed_out";
+    }>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"step.status.forward">;
     messageId: z.ZodString;
@@ -2997,20 +3264,20 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
     stepIndex: z.ZodNumber;
     stepName: z.ZodString;
     state: z.ZodEnum<{
-        skipped: "skipped";
-        success: "success";
+        cancelled: "cancelled";
+        failed: "failed";
         pending: "pending";
         running: "running";
-        failed: "failed";
-        cancelled: "cancelled";
+        skipped: "skipped";
+        success: "success";
     }>;
     timestamp: z.ZodNumber;
     data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     secretsAccessed: z.ZodOptional<z.ZodArray<z.ZodString>>;
     concurrencyKind: z.ZodOptional<z.ZodEnum<{
-        sequential: "sequential";
         "parallel-child": "parallel-child";
         "parallel-group": "parallel-group";
+        sequential: "sequential";
     }>>;
     groupId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
@@ -3020,17 +3287,18 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
     jobId: z.ZodString;
     jobName: z.ZodString;
     status: z.ZodEnum<{
-        skipped: "skipped";
-        success: "success";
-        pending: "pending";
-        running: "running";
-        failed: "failed";
         cancelled: "cancelled";
         cancelling: "cancelling";
+        drift_dropped: "drift_dropped";
+        failed: "failed";
+        pending: "pending";
         queued: "queued";
         recovering: "recovering";
+        running: "running";
+        skipped: "skipped";
+        success: "success";
         timed_out_stale: "timed_out_stale";
-        drift_dropped: "drift_dropped";
+        unroutable: "unroutable";
     }>;
     matrixValues: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     startedAt: z.ZodOptional<z.ZodNumber>;
@@ -3049,14 +3317,17 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             run: "run";
         }>;
         category: z.ZodEnum<{
-            secret_resolution: "secret_resolution";
-            install_secrets: "install_secrets";
-            lock_resolution: "lock_resolution";
+            approval_misconfig: "approval_misconfig";
             build_coordination: "build_coordination";
             context_rules: "context_rules";
             dynamic_eval: "dynamic_eval";
-            no_agent: "no_agent";
+            install_secrets: "install_secrets";
+            lock_resolution: "lock_resolution";
             matrix_expansion: "matrix_expansion";
+            no_agent: "no_agent";
+            sandbox_denied: "sandbox_denied";
+            secret_resolution: "secret_resolution";
+            trust_policy: "trust_policy";
         }>;
         message: z.ZodString;
         jobName: z.ZodOptional<z.ZodString>;
@@ -3068,13 +3339,13 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
         runId: z.ZodString;
         workflowName: z.ZodString;
         status: z.ZodEnum<{
-            success: "success";
-            pending: "pending";
-            running: "running";
-            failed: "failed";
             cancelled: "cancelled";
             cancelling: "cancelling";
+            failed: "failed";
             held: "held";
+            pending: "pending";
+            running: "running";
+            success: "success";
         }>;
         routingKey: z.ZodOptional<z.ZodString>;
         repoIdentifier: z.ZodOptional<z.ZodString>;
@@ -3091,6 +3362,13 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
         triggeredBy: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         triggeredByAgentLabel: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         failureReason: z.ZodOptional<z.ZodString>;
+        failureClass: z.ZodOptional<z.ZodEnum<{
+            cancelled: "cancelled";
+            dead_orchestrator: "dead_orchestrator";
+            never_started: "never_started";
+            step_failure: "step_failure";
+            timed_out: "timed_out";
+        }>>;
         jobs: z.ZodArray<z.ZodObject<{
             jobId: z.ZodString;
             jobName: z.ZodString;
@@ -3112,54 +3390,66 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             coordinator: "coordinator";
             worker: "worker";
         }>>;
-        dashboardWrites: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
-            "secrets.set": "secrets.set";
-            "secrets.delete": "secrets.delete";
-            "secrets.scope.create": "secrets.scope.create";
-            "secrets.scope.rename": "secrets.scope.rename";
-            "secrets.scope.delete": "secrets.scope.delete";
-            "variables.set": "variables.set";
-            "variables.delete": "variables.delete";
-            "contexts.create": "contexts.create";
-            "contexts.update": "contexts.update";
-            "contexts.test_access.set": "contexts.test_access.set";
-            "contexts.delete": "contexts.delete";
-            "contexts.bindings.set": "contexts.bindings.set";
-            "contexts.source_overrides.set": "contexts.source_overrides.set";
-            "contexts.source_overrides.delete": "contexts.source_overrides.delete";
-            "held_runs.approve": "held_runs.approve";
-            "held_runs.reject": "held_runs.reject";
-            "event_dlq.retry": "event_dlq.retry";
-            "event_dlq.discard": "event_dlq.discard";
+        dashboardWrites: z.ZodOptional<z.ZodPipe<z.ZodRecord<z.ZodEnum<{
             "attestations.retry": "attestations.retry";
-            "registration.disable": "registration.disable";
-            "registration.delete": "registration.delete";
-            "global_workflows.update": "global_workflows.update";
             "backends.sync": "backends.sync";
             "backends.sync_one": "backends.sync_one";
             "backends.test": "backends.test";
+            "contexts.bindings.set": "contexts.bindings.set";
+            "contexts.create": "contexts.create";
+            "contexts.delete": "contexts.delete";
+            "contexts.source_overrides.delete": "contexts.source_overrides.delete";
+            "contexts.source_overrides.set": "contexts.source_overrides.set";
+            "contexts.test_access.set": "contexts.test_access.set";
+            "contexts.update": "contexts.update";
+            "event_dlq.discard": "event_dlq.discard";
+            "event_dlq.retry": "event_dlq.retry";
             "fleet.host.declare": "fleet.host.declare";
             "fleet.host.remove": "fleet.host.remove";
-        }> & z.core.$partial, z.ZodBoolean>>;
+            "global_workflows.update": "global_workflows.update";
+            "held_runs.approve": "held_runs.approve";
+            "held_runs.reject": "held_runs.reject";
+            "registration.delete": "registration.delete";
+            "registration.disable": "registration.disable";
+            "secrets.delete": "secrets.delete";
+            "secrets.scope.create": "secrets.scope.create";
+            "secrets.scope.delete": "secrets.scope.delete";
+            "secrets.scope.rename": "secrets.scope.rename";
+            "secrets.set": "secrets.set";
+            "variables.delete": "variables.delete";
+            "variables.set": "variables.set";
+        }> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodEnum<{
+            disabled: "disabled";
+            encrypted: "encrypted";
+            permissive: "permissive";
+        }>]>>, z.ZodTransform<Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive">>, Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive" | boolean>>>>>;
         supportedDashboardRequests: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        dashboardEncryptionKey: z.ZodOptional<z.ZodObject<{
+            kty: z.ZodLiteral<"OKP">;
+            crv: z.ZodLiteral<"X25519">;
+            x: z.ZodString;
+            kid: z.ZodString;
+            use: z.ZodOptional<z.ZodLiteral<"enc">>;
+        }, z.core.$loose>>;
+        dashboardVerifiedIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, z.core.$loose>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"source.register">;
     messageId: z.ZodString;
     sources: z.ZodArray<z.ZodObject<{
         provider: z.ZodEnum<{
-            github: "github";
-            gitlab: "gitlab";
             bitbucket: "bitbucket";
             generic: "generic";
+            github: "github";
+            gitlab: "gitlab";
         }>;
         routingKey: z.ZodString;
         name: z.ZodString;
         subtype: z.ZodEnum<{
-            github_app: "github_app";
             generic_webhook: "generic_webhook";
-            universal_git: "universal_git";
+            github_app: "github_app";
             local: "local";
+            universal_git: "universal_git";
         }>;
         slug: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
@@ -3169,24 +3459,27 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
     address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     version: z.ZodOptional<z.ZodString>;
     mode: z.ZodOptional<z.ZodEnum<{
-        platform: "platform";
         hybrid: "hybrid";
         independent: "independent";
+        observed: "observed";
+        platform: "platform";
     }>>;
     scalerBackends: z.ZodOptional<z.ZodArray<z.ZodString>>;
     deployment: z.ZodOptional<z.ZodObject<{
         mode: z.ZodEnum<{
-            unknown: "unknown";
-            systemd: "systemd";
+            compose: "compose";
             launchd: "launchd";
+            systemd: "systemd";
+            unknown: "unknown";
             windows: "windows";
-            compose: "compose";
         }>;
         containerName: z.ZodOptional<z.ZodString>;
         containerRuntime: z.ZodOptional<z.ZodEnum<{
-            podman: "podman";
             docker: "docker";
+            podman: "podman";
         }>>;
+        adminInvocation: z.ZodOptional<z.ZodString>;
+        adminPath: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     s3LogAccess: z.ZodOptional<z.ZodBoolean>;
     queueTimeoutMs: z.ZodOptional<z.ZodNumber>;
@@ -3197,8 +3490,8 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"cache.stats">;
     cacheType: z.ZodEnum<{
-        source: "source";
         dep: "dep";
+        source: "source";
     }>;
     hit: z.ZodBoolean;
 }, z.core.$strip>, z.ZodObject<{
@@ -3210,36 +3503,48 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             coordinator: "coordinator";
             worker: "worker";
         }>>;
-        dashboardWrites: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
-            "secrets.set": "secrets.set";
-            "secrets.delete": "secrets.delete";
-            "secrets.scope.create": "secrets.scope.create";
-            "secrets.scope.rename": "secrets.scope.rename";
-            "secrets.scope.delete": "secrets.scope.delete";
-            "variables.set": "variables.set";
-            "variables.delete": "variables.delete";
-            "contexts.create": "contexts.create";
-            "contexts.update": "contexts.update";
-            "contexts.test_access.set": "contexts.test_access.set";
-            "contexts.delete": "contexts.delete";
-            "contexts.bindings.set": "contexts.bindings.set";
-            "contexts.source_overrides.set": "contexts.source_overrides.set";
-            "contexts.source_overrides.delete": "contexts.source_overrides.delete";
-            "held_runs.approve": "held_runs.approve";
-            "held_runs.reject": "held_runs.reject";
-            "event_dlq.retry": "event_dlq.retry";
-            "event_dlq.discard": "event_dlq.discard";
+        dashboardWrites: z.ZodOptional<z.ZodPipe<z.ZodRecord<z.ZodEnum<{
             "attestations.retry": "attestations.retry";
-            "registration.disable": "registration.disable";
-            "registration.delete": "registration.delete";
-            "global_workflows.update": "global_workflows.update";
             "backends.sync": "backends.sync";
             "backends.sync_one": "backends.sync_one";
             "backends.test": "backends.test";
+            "contexts.bindings.set": "contexts.bindings.set";
+            "contexts.create": "contexts.create";
+            "contexts.delete": "contexts.delete";
+            "contexts.source_overrides.delete": "contexts.source_overrides.delete";
+            "contexts.source_overrides.set": "contexts.source_overrides.set";
+            "contexts.test_access.set": "contexts.test_access.set";
+            "contexts.update": "contexts.update";
+            "event_dlq.discard": "event_dlq.discard";
+            "event_dlq.retry": "event_dlq.retry";
             "fleet.host.declare": "fleet.host.declare";
             "fleet.host.remove": "fleet.host.remove";
-        }> & z.core.$partial, z.ZodBoolean>>;
+            "global_workflows.update": "global_workflows.update";
+            "held_runs.approve": "held_runs.approve";
+            "held_runs.reject": "held_runs.reject";
+            "registration.delete": "registration.delete";
+            "registration.disable": "registration.disable";
+            "secrets.delete": "secrets.delete";
+            "secrets.scope.create": "secrets.scope.create";
+            "secrets.scope.delete": "secrets.scope.delete";
+            "secrets.scope.rename": "secrets.scope.rename";
+            "secrets.set": "secrets.set";
+            "variables.delete": "variables.delete";
+            "variables.set": "variables.set";
+        }> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodEnum<{
+            disabled: "disabled";
+            encrypted: "encrypted";
+            permissive: "permissive";
+        }>]>>, z.ZodTransform<Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive">>, Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive" | boolean>>>>>;
         supportedDashboardRequests: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        dashboardEncryptionKey: z.ZodOptional<z.ZodObject<{
+            kty: z.ZodLiteral<"OKP">;
+            crv: z.ZodLiteral<"X25519">;
+            x: z.ZodString;
+            kid: z.ZodString;
+            use: z.ZodOptional<z.ZodLiteral<"enc">>;
+        }, z.core.$loose>>;
+        dashboardVerifiedIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, z.core.$loose>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"heartbeat">;
@@ -3251,8 +3556,8 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
     timestampMs: z.ZodNumber;
     sourceService: z.ZodEnum<{
         agent: "agent";
-        platform: "platform";
         orchestrator: "orchestrator";
+        platform: "platform";
     }>;
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     traceId: z.ZodOptional<z.ZodString>;
@@ -3270,10 +3575,10 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             name: z.ZodString;
             value: z.ZodString;
             category: z.ZodEnum<{
-                user: "user";
-                system: "system";
                 inherited: "inherited";
                 secret: "secret";
+                system: "system";
+                user: "user";
             }>;
         }, z.core.$strip>>>;
         runtime: z.ZodOptional<z.ZodObject<{
@@ -3301,8 +3606,8 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
         name: z.ZodString;
         type: z.ZodEnum<{
             counter: "counter";
-            histogram: "histogram";
             gauge: "gauge";
+            histogram: "histogram";
             upDownCounter: "upDownCounter";
         }>;
         value: z.ZodOptional<z.ZodNumber>;
@@ -3328,7 +3633,45 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
         deferred: "deferred";
         "offline-backfill": "offline-backfill";
     }>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"nack">;
+    messageId: z.ZodOptional<z.ZodString>;
+    receivedType: z.ZodOptional<z.ZodString>;
+    reason: z.ZodString;
 }, z.core.$strip>], "type">;
+/** Minimal structural shape of a Zod object schema carrying a `type` literal. */
+type TypeLiteralObjectSchema = {
+    shape: {
+        type: {
+            value: string;
+        };
+    };
+};
+/**
+ * Extract the discriminator `type` values a schema recognizes: every option of a
+ * discriminated union, or the single `type` literal of an object schema. Reuses
+ * the `schema.options.map((o) => o.shape.type.value)` idiom already used for
+ * `DASHBOARD_REQUEST_TYPES`, so a recognized-type set derived through this helper
+ * can never drift from the schema it is built from.
+ */
+export declare function collectDiscriminatorTypes(schema: {
+    options: readonly TypeLiteralObjectSchema[];
+} | TypeLiteralObjectSchema): string[];
+/**
+ * Every message `type` the orchestrator→Platform mainline union recognizes.
+ * The Platform WS handler unions this with its extra recognition-chain schemas
+ * (log-pull, dashboard responses, cluster join) to decide whether a frame that
+ * failed validation is a known-but-invalid type (close the connection) or a
+ * genuinely-unknown one (version-skew NACK + keep alive).
+ */
+export declare const ORCH_TO_PLATFORM_RECOGNIZED_TYPES: ReadonlySet<string>;
+/**
+ * Every message `type` the Platform→orchestrator mainline union recognizes
+ * (dashboard request types included — they are members of this union). The
+ * orchestrator's platform client unions this with its extra recognition-chain
+ * schemas to make the same known-but-invalid vs unknown decision.
+ */
+export declare const PLATFORM_TO_ORCH_RECOGNIZED_TYPES: ReadonlySet<string>;
 export type WebhookRelay = z.infer<typeof webhookRelaySchema>;
 export type WebhookAck = z.infer<typeof webhookAckSchema>;
 export type ExecutionEvent = z.infer<typeof executionEventSchema>;
@@ -3337,4 +3680,5 @@ export type PeerDiscover = z.infer<typeof peerDiscoverSchema>;
 export type PeerUpdate = z.infer<typeof peerUpdateSchema>;
 export type PlatformToOrchestratorMessage = z.infer<typeof platformToOrchestratorMessageSchema>;
 export type OrchestratorToPlatformMessage = z.infer<typeof orchestratorToPlatformMessageSchema>;
+export {};
 //# sourceMappingURL=platform-orchestrator.d.ts.map