@kici-dev/engine 0.14.1 → 0.15.0

package/dist/index.js

@@ -33,8 +33,8 @@ import { HostTargetSelector, HostTargetValue, LabelMatcher, canonicalizeMatcher,
 import { ConcurrencyStrategy, DEFAULT_CONCURRENCY_STRATEGY } from "./context/concurrency-strategy.js";
 import { HostInventoryEntry, HostPropertyValue, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, coerceHostPropertyValue, parseHostPropertyAssignments } from "./inventory.js";
 import { REGEX_NEGATIVE_ASSERTION, isNegatedPattern, negatedPatternReason } from "./repo/pattern-negation.js";
-import { ContextDeleteErrorCode, ContextType, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, TestRelayType, artifactListItemSchema, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, eventLogActivityCountsSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
-import { AGENT_CAPABILITIES, AgentCapabilityFlag, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, OrchRole, PLATFORM_CAPABILITIES, agentCapabilitiesSchema, hasAgentCapability, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, platformCapabilitiesSchema } from "./protocol/messages/capabilities.js";
+import { ContextDeleteErrorCode, ContextType, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EventLogPayloadStreamError, FleetHostDisposition, FleetHostWriteRefusal, HeldRunQueueType, TestRelayType, artifactListItemSchema, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, eventLogActivityCountsSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostEntrySchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
+import { AGENT_CAPABILITIES, AgentCapabilityFlag, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, OrchCapabilityFlag, OrchRole, PLATFORM_CAPABILITIES, agentCapabilitiesSchema, hasAgentCapability, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, platformCapabilitiesSchema } from "./protocol/messages/capabilities.js";
 import { authFailureSchema, authRequestSchema, authSuccessSchema } from "./protocol/messages/auth.js";
 import { LogStream } from "./protocol/messages/log-stream.js";
 import { CLUSTER_MEMBERSHIP_MAX_WORKERS, CiTrustLevel, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_APPROVAL_EXPIRY_SECONDS, ForkPolicy, MAX_APPROVAL_EXPIRY_HOURS, MAX_APPROVAL_EXPIRY_SECONDS, MIN_APPROVAL_EXPIRY_SECONDS, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OrchLogPhase, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, SECONDS_PER_HOUR, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, approvalExpiryHoursOf, approvalExpirySecondsOf, cacheStatsSchema, clusterMembershipSchema, collectDiscriminatorTypes, executionEventSchema, logChunkSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, planHeadroomSchema, platformCapabilitiesMessageSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicySchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema } from "./protocol/messages/platform-orchestrator.js";
@@ -48,8 +48,8 @@ import { ActivityFilterSource, ActivityRowSource, activityCursorSchema, activity
 import { logPullOrchToPlatformSchema, logPullPlatformToOrchSchema } from "./protocol/messages/log-pull.js";
 import { EVENT_LOG_PAYLOAD_CHUNK_BYTES } from "./protocol/event-log-payload.js";
 import { browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, platformToBrowserMessageSchema } from "./protocol/messages/browser.js";
-import { joinRequestSchema, joinResponseSchema } from "./protocol/messages/join.js";
-import { PeerForgetOutcome, ScalerOrphansAction, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, fleetSelectionSchema, jobProgressAckSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerForgetRequestSchema, peerForgetResponseSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerScalerOrphansRequestSchema, peerScalerOrphansResponseSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, rerouteSpawnRetrySchema, scalerLiveVmSchema, scalerVmStopResultSchema, workerClusterSettingsSchema } from "./protocol/messages/peer.js";
+import { INVALID_JOIN_REQUEST_MESSAGE, JOIN_PROTOCOL_UNSUPPORTED_MESSAGE, JOIN_PROTOCOL_UPGRADE_TOKEN, JOIN_PROTOCOL_V1_REMOVED_MESSAGE, JOIN_PROTOCOL_VERSION, JoinErrorCode, JoinRequestKind, LEGACY_JOINER_AUTH_MESSAGE, buildJoinRefusal, classifyJoinRequest, isJoinRequestFrame, joinRequestSchema, joinResponseSchema, joinRoutingSchema } from "./protocol/messages/join.js";
+import { PEER_MUTUAL_AUTH_REQUIRED_REASON, PeerAuthMode, PeerAuthScheme, PeerForgetOutcome, ScalerOrphansAction, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, fleetSelectionSchema, jobProgressAckSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerForgetRequestSchema, peerForgetResponseSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerScalerOrphansRequestSchema, peerScalerOrphansResponseSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, rerouteSpawnRetrySchema, scalerLiveVmSchema, scalerVmStopResultSchema, workerClusterSettingsSchema } from "./protocol/messages/peer.js";
 import { AGENT_API_REQUEST_TIMEOUT_MS, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactRejectReason, ArtifactUploadOutcome, CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, invokeResultSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, rateLimitWarningSchema, registerAckSchema, scalerClaimCredentialsResponseSchema, scalerClaimCredentialsSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema } from "./protocol/messages/orchestrator-agent.js";
 import { KNOWN_LINUX_CAPABILITIES, canonicalizeCapability, isKnownCapability } from "./sandbox/capabilities.js";
 import { compileSafeRegex, describeTextMatch, evaluateTextMatch, textMatchHasQuery } from "./trigger/text-match.js";
@@ -96,4 +96,4 @@ import { ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, ArtifactNameSch
 import { PLAN_TYPES, PaidPlanType, PlanType, isPaidTier, planRank } from "./billing/plan-type.js";
 import { SUBSCRIPTION_EXISTS_CODE, StripeSubscriptionStatus, blocksNewCheckout } from "./billing/subscription-status.js";
 import { INFRA_ALERT_TYPES, InfraAlertSeverity, InfraAlertType, normalizeInfraAlertSeverity } from "./diagnostics/infra-alert.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, ACTOR_AGENT_SUFFIX, AGENT_API_REQUEST_TIMEOUT_MS, AGENT_CAPABILITIES, AGENT_FEATURE_LABELS, AGENT_FEATURE_LABEL_PREFIX, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentCapabilityFlag, AgentFailureCategory, AgentFeature, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactNameSchema, ArtifactRejectReason, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CAPABILITY_LABEL_PREFIX, CLUSTER_MEMBERSHIP_MAX_WORKERS, CONTAINER_BUILD_RUNTIME_LABEL, CONTEXTS_MAX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, CiTrustLevel, ConcurrencyStrategy, ConfigPathsSchema, ContextDeleteErrorCode, ContextGateRejectReason, ContextType, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DEAD_ORCH_FAILURE_REASON, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_APPROVAL_EXPIRY_SECONDS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DEFERRED_PATHS_SUMMARY_SUFFIX, DEVELOPER_OPERATIONS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, ForkPolicy, GLOBAL_APPROVAL_MIN_READER, GLOBAL_EVAL_SKIPS_RESULT_AWARE_LABEL, HEARTBEAT_CLOSE_MS, HEARTBEAT_DEGRADED_MS, HEARTBEAT_FRESH_MS, HEARTBEAT_STALE_THRESHOLD_SECONDS, HEARTBEAT_UNHEALTHY_MARK_MS, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, ID_TOKEN_CLAIM_NAMES, INFRA_ALERT_TYPES, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, INSTALL_JOB_ID_PREFIX, INTERNAL_EVENT_NAME_PREFIX, InfraAlertSeverity, InfraAlertType, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JOB_IMAGE_RUNTIME_LABEL, JobKind, JobRejectReason, KICI_AGENT_ENV_PREFIX, KICI_EVENT_NAME_PREFIX, KNOWN_LINUX_CAPABILITIES, KNOWN_ROLES, LEGACY_STATUS_ALIASES, LabelMatcher, LockFileParseError, LogStream, MAX_APPROVAL_EXPIRY_HOURS, MAX_APPROVAL_EXPIRY_SECONDS, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MAX_MATRIX_MATERIALIZATION, MIN_APPROVAL_EXPIRY_SECONDS, MIN_PROTOCOL_VERSION, MatrixShapeError, MinimumTrustSchema, NACK_EXEMPT_MESSAGE_TYPES, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OWN_INGRESS_MODES, OnUnreachableMode, OrchLogPhase, OrchRole, OrchestratorMode, PING_EVENT_TYPE, PLAN_TYPES, PLATFORM_CAPABILITIES, PLATFORM_CONNECTED_MODES, PLATFORM_TAINT_LABELS, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PULL_REQUEST_FAMILY_TRIGGER_EVENTS, PaidPlanType, PatKind, PayloadOmittedReason, PeerForgetOutcome, PlanType, REDACTED_TRACE_FIELD, REGEX_NEGATIVE_ASSERTION, RELAY_INGRESS_MODES, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RUNTIME_LABEL_PREFIX, RegisterableTriggerType, RunFailureClass, RunsOnPick, RuntimeFact, SANDBOX_DEFAULT_VARS, SANDBOX_NETWORK_MODES, SCALER_EVENT_NAMES, SCHEMA_VERSION, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECONDS_PER_HOUR, SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_EPOCH_MAX, STATUS_FAILURE_CLASS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, STATUS_PRECEDENCE, SUBSCRIBABLE_WEBHOOK_EVENT_TYPES, SUBSCRIPTION_EXISTS_CODE, ScaleDownReason, ScalerArch, ScalerBackendType, ScalerEventType, ScalerOrphansAction, ScalerOs, ScalerScaleDownPayload, ScalerScaleUpPayload, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, ScopeNameError, SecretKeyError, SetupStepType, SourceOrigin, SourceProvider, SourceSubtype, StatusFailureClass, StepApprovalOutcome, StepConcurrencyKind, StripeSubscriptionStatus, SubscribableWebhookEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TRACE_TEXT_MAX, TRACE_TRUNCATION_WORKFLOW_NAME, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TRIGGER_TYPE_TO_EVENT_TYPES, TRUSTED_ENV_SCRUB_EXACT, TestRelayType, TimeoutReason, TraceCheck, TraceVerdict, TriggerSource, TrustTierSchema, UNRESOLVED_CLAIM, UnavailablePathsTrace, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WORKFLOW_MODIFICATION_JOB_ID, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_SUPERSEDED_BY_RECONNECT, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookEventType, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentCapabilitiesSchema, agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentFeatureLabel, agentJobResultSchema, agentLabelOf, agentLogChunkSchema, agentMetricsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentRegisterSchema, agentRunListItemSchema, agentRunResultSchema, agentSecretScopeSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, agentWorkflowSummarySchema, apiKeyActorSchema, appendChecks, applyIncludeExclude, approvalExpiryHoursOf, approvalExpirySecondsOf, approvalRequirementSchema, approvalTimeoutSecondsSchema, approveRunToolSchema, approverClauseSchema, artifactInvalidNameError, artifactListItemSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, assertScheduleInputsSatisfiable, assertValidScopeName, assertValidSecretKey, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, blocksNewCheckout, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildEventClaims, buildIdTokenSubject, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, canonicalizeCapability, canonicalizeLabel, canonicalizeLabelSet, canonicalizeLabels, canonicalizeMatcher, capabilityLabel, changedFilesStatusSchema, checkArtifactName, clusterMembershipSchema, coerceDispatchInputs, coerceHostPropertyValue, collectDiscriminatorTypes, compileRegexMatcher, compileSafeRegex, configAckSchema, connectionHealthStatusSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, createCommitMessageTraceEntry, createContentRequirementsTraceEntry, createDispatchFailureTraceEntry, createGlobalFilterTraceEntry, createTraceEntry, createTraceTruncationMarker, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, derivePlatformTaints, describeTextMatch, developerOpsForEntrypoint, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, diffRangeKindSchema, encodeActivityCursor, errorSchema, evaluateTextMatch, eventEmitResponseSchema, eventEmitSchema, eventLogActivityCountsSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, findDuplicateCombination, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getDiagnosticsToolSchema, getRepoGlobMatcher, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubIngressPath, githubWebhookPath, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, hasAgentCapability, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, installGateJobId, invokeResultSchema, isDeferrableRange, isFailureStatus, isInputSatisfiableFromDefaults, isKnownCapability, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, isMintedRef, isNegatedPattern, isPaidTier, isPullRequestFamilyTriggerEvent, isSecurityHoldJobId, isSelfReportedLabel, isSetupStepType, isTrustedEnvScrubbed, isZeroSha, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchTrigger, matchWorkflowTriggers, matchWorkflowsForEvent, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixCombinationCount, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, negatedPatternReason, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeInfraAlertSeverity, normalizeMatrixInput, normalizePersistedHoldType, normalizeRegexFlags, normalizeRunsOn, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerForgetRequestSchema, peerForgetResponseSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerScalerOrphansRequestSchema, peerScalerOrphansResponseSchema, peerToPeerMessageSchema, peerUpdateSchema, persistedHoldTypeSpellings, planHeadroomSchema, planRank, platformCapabilitiesMessageSchema, platformCapabilitiesSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, prepareEventBuckets, provenanceContextSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, rateLimitWarningSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rejectRunToolSchema, renderFenced, rerouteSpawnRetrySchema, rerunRunToolSchema, reservedEventNamePrefix, resolveContentFormat, resolveDiffRange, resolveHeldRunId, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForContext, resolveSecretsWithProvenance, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, runtimeLabel, scalerAgentLabels, scalerClaimCredentialsResponseSchema, scalerClaimCredentialsSchema, scalerLabel, scalerLiveVmSchema, scalerPlatformSchema, scalerVmStopResultSchema, scheduleTriggerKey, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, stripStatefulRegexFlags, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, textMatchHasQuery, toCanonicalStatus, triggerRunToolSchema, truncateDecisionsToByteBudget, truncateTraceText, trustPolicyResponseSchema, trustPolicySchema, trustPolicyUpdateSchema, trustedContributorHoldReason, untrusted, upstreamSnapshotSchema, userActorSchema, utf8ByteLength, validateNoReservedLabels, validateResourceRequest, validateScopeName, validateSecretKey, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, workerClusterSettingsSchema, worstStatus, wrapUntrusted };
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, ACTOR_AGENT_SUFFIX, AGENT_API_REQUEST_TIMEOUT_MS, AGENT_CAPABILITIES, AGENT_FEATURE_LABELS, AGENT_FEATURE_LABEL_PREFIX, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentCapabilityFlag, AgentFailureCategory, AgentFeature, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactNameSchema, ArtifactRejectReason, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CAPABILITY_LABEL_PREFIX, CLUSTER_MEMBERSHIP_MAX_WORKERS, CONTAINER_BUILD_RUNTIME_LABEL, CONTEXTS_MAX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, CiTrustLevel, ConcurrencyStrategy, ConfigPathsSchema, ContextDeleteErrorCode, ContextGateRejectReason, ContextType, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DEAD_ORCH_FAILURE_REASON, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_APPROVAL_EXPIRY_SECONDS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DEFERRED_PATHS_SUMMARY_SUFFIX, DEVELOPER_OPERATIONS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, FleetHostWriteRefusal, ForkPolicy, GLOBAL_APPROVAL_MIN_READER, GLOBAL_EVAL_SKIPS_RESULT_AWARE_LABEL, HEARTBEAT_CLOSE_MS, HEARTBEAT_DEGRADED_MS, HEARTBEAT_FRESH_MS, HEARTBEAT_STALE_THRESHOLD_SECONDS, HEARTBEAT_UNHEALTHY_MARK_MS, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, ID_TOKEN_CLAIM_NAMES, INFRA_ALERT_TYPES, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, INSTALL_JOB_ID_PREFIX, INTERNAL_EVENT_NAME_PREFIX, INVALID_JOIN_REQUEST_MESSAGE, InfraAlertSeverity, InfraAlertType, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JOB_IMAGE_RUNTIME_LABEL, JOIN_PROTOCOL_UNSUPPORTED_MESSAGE, JOIN_PROTOCOL_UPGRADE_TOKEN, JOIN_PROTOCOL_V1_REMOVED_MESSAGE, JOIN_PROTOCOL_VERSION, JobKind, JobRejectReason, JoinErrorCode, JoinRequestKind, KICI_AGENT_ENV_PREFIX, KICI_EVENT_NAME_PREFIX, KNOWN_LINUX_CAPABILITIES, KNOWN_ROLES, LEGACY_JOINER_AUTH_MESSAGE, LEGACY_STATUS_ALIASES, LabelMatcher, LockFileParseError, LogStream, MAX_APPROVAL_EXPIRY_HOURS, MAX_APPROVAL_EXPIRY_SECONDS, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MAX_MATRIX_MATERIALIZATION, MIN_APPROVAL_EXPIRY_SECONDS, MIN_PROTOCOL_VERSION, MatrixShapeError, MinimumTrustSchema, NACK_EXEMPT_MESSAGE_TYPES, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OWN_INGRESS_MODES, OnUnreachableMode, OrchCapabilityFlag, OrchLogPhase, OrchRole, OrchestratorMode, PEER_MUTUAL_AUTH_REQUIRED_REASON, PING_EVENT_TYPE, PLAN_TYPES, PLATFORM_CAPABILITIES, PLATFORM_CONNECTED_MODES, PLATFORM_TAINT_LABELS, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PULL_REQUEST_FAMILY_TRIGGER_EVENTS, PaidPlanType, PatKind, PayloadOmittedReason, PeerAuthMode, PeerAuthScheme, PeerForgetOutcome, PlanType, REDACTED_TRACE_FIELD, REGEX_NEGATIVE_ASSERTION, RELAY_INGRESS_MODES, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RUNTIME_LABEL_PREFIX, RegisterableTriggerType, RunFailureClass, RunsOnPick, RuntimeFact, SANDBOX_DEFAULT_VARS, SANDBOX_NETWORK_MODES, SCALER_EVENT_NAMES, SCHEMA_VERSION, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECONDS_PER_HOUR, SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_EPOCH_MAX, STATUS_FAILURE_CLASS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, STATUS_PRECEDENCE, SUBSCRIBABLE_WEBHOOK_EVENT_TYPES, SUBSCRIPTION_EXISTS_CODE, ScaleDownReason, ScalerArch, ScalerBackendType, ScalerEventType, ScalerOrphansAction, ScalerOs, ScalerScaleDownPayload, ScalerScaleUpPayload, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, ScopeNameError, SecretKeyError, SetupStepType, SourceOrigin, SourceProvider, SourceSubtype, StatusFailureClass, StepApprovalOutcome, StepConcurrencyKind, StripeSubscriptionStatus, SubscribableWebhookEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TRACE_TEXT_MAX, TRACE_TRUNCATION_WORKFLOW_NAME, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TRIGGER_TYPE_TO_EVENT_TYPES, TRUSTED_ENV_SCRUB_EXACT, TestRelayType, TimeoutReason, TraceCheck, TraceVerdict, TriggerSource, TrustTierSchema, UNRESOLVED_CLAIM, UnavailablePathsTrace, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WORKFLOW_MODIFICATION_JOB_ID, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_SUPERSEDED_BY_RECONNECT, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookEventType, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentCapabilitiesSchema, agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentFeatureLabel, agentJobResultSchema, agentLabelOf, agentLogChunkSchema, agentMetricsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentRegisterSchema, agentRunListItemSchema, agentRunResultSchema, agentSecretScopeSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, agentWorkflowSummarySchema, apiKeyActorSchema, appendChecks, applyIncludeExclude, approvalExpiryHoursOf, approvalExpirySecondsOf, approvalRequirementSchema, approvalTimeoutSecondsSchema, approveRunToolSchema, approverClauseSchema, artifactInvalidNameError, artifactListItemSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, assertScheduleInputsSatisfiable, assertValidScopeName, assertValidSecretKey, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, blocksNewCheckout, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildEventClaims, buildIdTokenSubject, buildJoinRefusal, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, canonicalizeCapability, canonicalizeLabel, canonicalizeLabelSet, canonicalizeLabels, canonicalizeMatcher, capabilityLabel, changedFilesStatusSchema, checkArtifactName, classifyJoinRequest, clusterMembershipSchema, coerceDispatchInputs, coerceHostPropertyValue, collectDiscriminatorTypes, compileRegexMatcher, compileSafeRegex, configAckSchema, connectionHealthStatusSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, createCommitMessageTraceEntry, createContentRequirementsTraceEntry, createDispatchFailureTraceEntry, createGlobalFilterTraceEntry, createTraceEntry, createTraceTruncationMarker, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, derivePlatformTaints, describeTextMatch, developerOpsForEntrypoint, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, diffRangeKindSchema, encodeActivityCursor, errorSchema, evaluateTextMatch, eventEmitResponseSchema, eventEmitSchema, eventLogActivityCountsSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, findDuplicateCombination, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostEntrySchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getDiagnosticsToolSchema, getRepoGlobMatcher, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubIngressPath, githubWebhookPath, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, hasAgentCapability, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, installGateJobId, invokeResultSchema, isDeferrableRange, isFailureStatus, isInputSatisfiableFromDefaults, isJoinRequestFrame, isKnownCapability, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, isMintedRef, isNegatedPattern, isPaidTier, isPullRequestFamilyTriggerEvent, isSecurityHoldJobId, isSelfReportedLabel, isSetupStepType, isTrustedEnvScrubbed, isZeroSha, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, joinRoutingSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchTrigger, matchWorkflowTriggers, matchWorkflowsForEvent, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixCombinationCount, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, negatedPatternReason, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeInfraAlertSeverity, normalizeMatrixInput, normalizePersistedHoldType, normalizeRegexFlags, normalizeRunsOn, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerForgetRequestSchema, peerForgetResponseSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerScalerOrphansRequestSchema, peerScalerOrphansResponseSchema, peerToPeerMessageSchema, peerUpdateSchema, persistedHoldTypeSpellings, planHeadroomSchema, planRank, platformCapabilitiesMessageSchema, platformCapabilitiesSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, prepareEventBuckets, provenanceContextSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, rateLimitWarningSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rejectRunToolSchema, renderFenced, rerouteSpawnRetrySchema, rerunRunToolSchema, reservedEventNamePrefix, resolveContentFormat, resolveDiffRange, resolveHeldRunId, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForContext, resolveSecretsWithProvenance, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, runtimeLabel, scalerAgentLabels, scalerClaimCredentialsResponseSchema, scalerClaimCredentialsSchema, scalerLabel, scalerLiveVmSchema, scalerPlatformSchema, scalerVmStopResultSchema, scheduleTriggerKey, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, stripStatefulRegexFlags, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, textMatchHasQuery, toCanonicalStatus, triggerRunToolSchema, truncateDecisionsToByteBudget, truncateTraceText, trustPolicyResponseSchema, trustPolicySchema, trustPolicyUpdateSchema, trustedContributorHoldReason, untrusted, upstreamSnapshotSchema, userActorSchema, utf8ByteLength, validateNoReservedLabels, validateResourceRequest, validateScopeName, validateSecretKey, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, workerClusterSettingsSchema, worstStatus, wrapUntrusted };

package/dist/protocol/messages/auth.d.ts

@@ -51,6 +51,7 @@ export declare const authRequestSchema: z.ZodObject<{
             use: z.ZodOptional<z.ZodLiteral<"enc">>;
         }, z.core.$loose>>;
         dashboardVerifiedIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        clusterJoinV2: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$loose>>;
 }, z.core.$strip>;
 /** Auth success response sent by Platform to orchestrator after successful authentication. */
@@ -60,6 +61,7 @@ export declare const authSuccessSchema: z.ZodObject<{
     orgPublicAlias: z.ZodOptional<z.ZodString>;
     orgId: z.ZodOptional<z.ZodString>;
     provenanceIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    githubWebhookUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>;
 /** Auth failure response sent by Platform to orchestrator when authentication fails. */
 export declare const authFailureSchema: z.ZodObject<{

package/dist/protocol/messages/auth.js

@@ -41,7 +41,16 @@ const authSuccessSchema = z.object({
 	* the orchestrator records each attestation's verdict as `unverifiable`
 	* rather than silently `verified`.
 	*/
-	provenanceIssuer: z.string().nullable().optional()
+	provenanceIssuer: z.string().nullable().optional(),
+	/**
+	* The Platform's org-scoped GitHub App webhook URL
+	* (`<WEBHOOK_PUBLIC_URL>/webhook/<orgId>/github`). It is known before any
+	* App exists, so the orchestrator's manifest flow bakes it into a new App in
+	* platform and hybrid mode. `null` when the Platform has no public webhook
+	* base. Absent from a Platform that does not send it; the orchestrator then
+	* reports the URL as unknown.
+	*/
+	githubWebhookUrl: z.string().nullable().optional()
 });
 /** Auth failure response sent by Platform to orchestrator when authentication fails. */
 const authFailureSchema = z.object({

package/dist/protocol/messages/capabilities.d.ts

@@ -78,6 +78,7 @@ export declare const orchCapabilitiesSchema: z.ZodObject<{
         use: z.ZodOptional<z.ZodLiteral<"enc">>;
     }, z.core.$loose>>;
     dashboardVerifiedIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    clusterJoinV2: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$loose>;
 /** Inferred type for orchestrator capabilities. */
 export type OrchCapabilities = z.infer<typeof orchCapabilitiesSchema>;
@@ -94,6 +95,11 @@ export declare const ORCH_CAPABILITIES: Readonly<{
  * orchestrator) or the flag is missing/false.
  */
 export declare function hasOrchCapability(capabilities: OrchCapabilities | undefined, flag: string): boolean;
+/** Flag names of {@link orchCapabilitiesSchema}, for {@link hasOrchCapability} lookups. */
+export declare const OrchCapabilityFlag: z.ZodEnum<{
+    clusterJoinV2: "clusterJoinV2";
+}>;
+export type OrchCapabilityFlag = z.infer<typeof OrchCapabilityFlag>;
 /**
  * Platform-advertised capabilities sent to the orchestrator after auth.
  * Uses .passthrough() so a newer Platform's unknown flags are preserved.

package/dist/protocol/messages/capabilities.js

@@ -68,7 +68,13 @@ const orchCapabilitiesSchema = z.object({
 	* `dashboard_verified_issuer` cluster setting. Null/absent ⇒ the Verified
 	* tier is not offered and the Convenient tier applies.
 	*/
-	dashboardVerifiedIssuer: z.string().nullable().optional()
+	dashboardVerifiedIssuer: z.string().nullable().optional(),
+	/**
+	* The orchestrator answers join protocol v2 `join.request` frames. The Platform
+	* relays a join only to an orchestrator that advertises this, because an older
+	* build drops a v2 frame without a reply.
+	*/
+	clusterJoinV2: z.boolean().optional()
 }).passthrough();
 /** Default orchestrator capabilities sent in auth.request. */
 const ORCH_CAPABILITIES = Object.freeze({
@@ -85,6 +91,8 @@ const ORCH_CAPABILITIES = Object.freeze({
 function hasOrchCapability(capabilities, flag) {
 	return capabilities?.[flag] === true;
 }
+/** Flag names of {@link orchCapabilitiesSchema}, for {@link hasOrchCapability} lookups. */
+const OrchCapabilityFlag = z.enum(["clusterJoinV2"]);
 /**
 * Platform-advertised capabilities sent to the orchestrator after auth.
 * Uses .passthrough() so a newer Platform's unknown flags are preserved.
@@ -172,6 +180,6 @@ function hasAgentCapability(capabilities, flag) {
 	return capabilities?.[flag] === true;
 }
 //#endregion
-export { AGENT_CAPABILITIES, AgentCapabilityFlag, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, OrchRole, PLATFORM_CAPABILITIES, agentCapabilitiesSchema, hasAgentCapability, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, platformCapabilitiesSchema };
+export { AGENT_CAPABILITIES, AgentCapabilityFlag, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, OrchCapabilityFlag, OrchRole, PLATFORM_CAPABILITIES, agentCapabilitiesSchema, hasAgentCapability, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, platformCapabilitiesSchema };
 
 //# sourceMappingURL=capabilities.js.map

package/dist/protocol/messages/dashboard.d.ts

@@ -3214,6 +3214,32 @@ export declare const fleetPreviewHostSchema: z.ZodObject<{
     }>;
 }, z.core.$strip>;
 export type FleetPreviewHost = z.infer<typeof fleetPreviewHostSchema>;
+/**
+ * A roster host as the dashboard sees it: the SDK inventory entry plus whether
+ * an agent registration or an operator declaration confirmed it. An
+ * unconfirmed host was created from the dashboard and is not a fan-out or
+ * inventory target. Optional so an older orchestrator's frames still parse.
+ */
+export declare const fleetHostEntrySchema: z.ZodObject<{
+    agentId: z.ZodString;
+    labels: z.ZodArray<z.ZodString>;
+    properties: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    hostname: z.ZodNullable<z.ZodString>;
+    platform: z.ZodNullable<z.ZodString>;
+    arch: z.ZodNullable<z.ZodString>;
+    lifecycleClass: z.ZodEnum<{
+        ephemeral: "ephemeral";
+        static: "static";
+    }>;
+    status: z.ZodEnum<{
+        ready: "ready";
+        stale: "stale";
+        unreachable: "unreachable";
+    }>;
+    lastSeen: z.ZodString;
+    confirmed: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type FleetHostEntry = z.infer<typeof fleetHostEntrySchema>;
 export declare const dashboardFleetHostsRequestSchema: z.ZodObject<{
     type: z.ZodLiteral<"dashboard.fleet.hosts">;
     requestId: z.ZodString;
@@ -3326,6 +3352,7 @@ export declare const dashboardFleetHostsResponseSchema: z.ZodObject<{
             unreachable: "unreachable";
         }>;
         lastSeen: z.ZodString;
+        confirmed: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export declare const dashboardFleetHostResponseSchema: z.ZodObject<{
@@ -3348,6 +3375,7 @@ export declare const dashboardFleetHostResponseSchema: z.ZodObject<{
             unreachable: "unreachable";
         }>;
         lastSeen: z.ZodString;
+        confirmed: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     runs: z.ZodArray<z.ZodObject<{
         runId: z.ZodString;
@@ -3467,6 +3495,20 @@ export declare const dashboardFleetWorkflowsForHostResponseSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type DashboardFleetWorkflowsForHostRequest = z.infer<typeof dashboardFleetWorkflowsForHostRequestSchema>;
 export type DashboardFleetWorkflowsForHostResponse = z.infer<typeof dashboardFleetWorkflowsForHostResponseSchema>;
+/**
+ * Why the orchestrator refused a Platform-relayed fleet host write. Travels in
+ * the response `error` field, as `operation_disabled` does.
+ *
+ * - `reserved_property` — a label or property key is in the reserved `kici:` namespace.
+ * - `host_exists` — a dashboard declare named a host that already exists.
+ * - `host_confirmed` — a dashboard remove named a host an agent or operator confirmed.
+ */
+export declare const FleetHostWriteRefusal: z.ZodEnum<{
+    host_confirmed: "host_confirmed";
+    host_exists: "host_exists";
+    reserved_property: "reserved_property";
+}>;
+export type FleetHostWriteRefusal = z.infer<typeof FleetHostWriteRefusal>;
 /** Declare a static host into the roster (wraps HostRosterStore.declareStatic). */
 export declare const fleetHostDeclareRequestSchema: z.ZodObject<{
     type: z.ZodLiteral<"dashboard.fleet.host.declare">;
@@ -3508,6 +3550,7 @@ export declare const fleetHostDeclareResponseSchema: z.ZodObject<{
     declared: z.ZodOptional<z.ZodBoolean>;
     created: z.ZodOptional<z.ZodBoolean>;
     error: z.ZodOptional<z.ZodString>;
+    reservedKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
 /** Remove a host from the roster by agent id (HostRosterStore.removeStatic). */
 export declare const fleetHostRemoveRequestSchema: z.ZodObject<{
@@ -8151,6 +8194,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             unreachable: "unreachable";
         }>;
         lastSeen: z.ZodString;
+        confirmed: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.fleet.host.response">;
@@ -8172,6 +8216,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             unreachable: "unreachable";
         }>;
         lastSeen: z.ZodString;
+        confirmed: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     runs: z.ZodArray<z.ZodObject<{
         runId: z.ZodString;
@@ -8237,6 +8282,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
     declared: z.ZodOptional<z.ZodBoolean>;
     created: z.ZodOptional<z.ZodBoolean>;
     error: z.ZodOptional<z.ZodString>;
+    reservedKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.fleet.host.remove.response">;
     requestId: z.ZodString;

package/dist/protocol/messages/dashboard.js

@@ -1512,6 +1512,13 @@ const fleetPreviewHostSchema = z.object({
 	entry: HostInventoryEntry,
 	disposition: FleetHostDisposition
 });
+/**
+* A roster host as the dashboard sees it: the SDK inventory entry plus whether
+* an agent registration or an operator declaration confirmed it. An
+* unconfirmed host was created from the dashboard and is not a fan-out or
+* inventory target. Optional so an older orchestrator's frames still parse.
+*/
+const fleetHostEntrySchema = HostInventoryEntry.extend({ confirmed: z.boolean().optional() });
 const dashboardFleetHostsRequestSchema = z.object({
 	type: z.literal("dashboard.fleet.hosts"),
 	requestId: z.string(),
@@ -1532,12 +1539,12 @@ const dashboardFleetPreviewRequestSchema = z.object({
 const dashboardFleetHostsResponseSchema = z.object({
 	type: z.literal("dashboard.fleet.hosts.response"),
 	requestId: z.string(),
-	hosts: z.array(HostInventoryEntry)
+	hosts: z.array(fleetHostEntrySchema)
 });
 const dashboardFleetHostResponseSchema = z.object({
 	type: z.literal("dashboard.fleet.host.response"),
 	requestId: z.string(),
-	host: HostInventoryEntry.nullable(),
+	host: fleetHostEntrySchema.nullable(),
 	runs: z.array(fleetPinnedRunSchema)
 });
 const dashboardFleetPreviewResponseSchema = z.object({
@@ -1567,6 +1574,19 @@ const dashboardFleetWorkflowsForHostResponseSchema = z.object({
 	requestId: z.string(),
 	workflows: z.array(fleetHostWorkflowSchema)
 });
+/**
+* Why the orchestrator refused a Platform-relayed fleet host write. Travels in
+* the response `error` field, as `operation_disabled` does.
+*
+* - `reserved_property` — a label or property key is in the reserved `kici:` namespace.
+* - `host_exists` — a dashboard declare named a host that already exists.
+* - `host_confirmed` — a dashboard remove named a host an agent or operator confirmed.
+*/
+const FleetHostWriteRefusal = z.enum([
+	"reserved_property",
+	"host_exists",
+	"host_confirmed"
+]);
 /** Declare a static host into the roster (wraps HostRosterStore.declareStatic). */
 const fleetHostDeclareRequestSchema = z.object({
 	type: z.literal("dashboard.fleet.host.declare"),
@@ -1586,7 +1606,9 @@ const fleetHostDeclareResponseSchema = z.object({
 	requestId: z.string(),
 	declared: z.boolean().optional(),
 	created: z.boolean().optional(),
-	error: z.string().optional()
+	error: z.string().optional(),
+	/** The reserved keys behind a `reserved_property` refusal. */
+	reservedKeys: z.array(z.string()).optional()
 });
 /** Remove a host from the roster by agent id (HostRosterStore.removeStatic). */
 const fleetHostRemoveRequestSchema = z.object({
@@ -2603,6 +2625,6 @@ const DashboardResponseErrorCode = z.enum([
 	"internal_error"
 ]);
 //#endregion
-export { ContextDeleteErrorCode, ContextType, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, HeldRunStatus, TestRelayType, artifactListItemSchema, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, eventLogActivityCountsSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema };
+export { ContextDeleteErrorCode, ContextType, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EventLogPayloadStreamError, FleetHostDisposition, FleetHostWriteRefusal, HeldRunQueueType, HeldRunStatus, TestRelayType, artifactListItemSchema, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, eventLogActivityCountsSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostEntrySchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema };
 
 //# sourceMappingURL=dashboard.js.map

package/dist/protocol/messages/join.d.ts

@@ -1,18 +1,89 @@
 import { z } from 'zod';
-/** Join request sent by a new orchestrator (via Platform relay or direct peer). */
+export declare const JOIN_PROTOCOL_VERSION: 2;
+/** `Upgrade` header value on the HTTP 426 that refuses a version-1 join. */
+export declare const JOIN_PROTOCOL_UPGRADE_TOKEN = "kici-join-v2";
+export declare const JOIN_PROTOCOL_V1_REMOVED_MESSAGE = "This kici-admin uses join protocol v1, which orchestrators no longer accept. Upgrade kici-admin, then run kici-admin join again.";
+export declare const JOIN_PROTOCOL_UNSUPPORTED_MESSAGE = "The cluster's orchestrators predate join protocol v2. Upgrade them, then join again.";
+export declare const LEGACY_JOINER_AUTH_MESSAGE = "This kici-admin cannot join through the Platform. Upgrade kici-admin, then run kici-admin join again.";
+export declare const INVALID_JOIN_REQUEST_MESSAGE = "Invalid join request";
+/** Why a join was refused. Every refusal on the Platform, the orchestrator and the HTTP route sets one. */
+export declare const JoinErrorCode: z.ZodEnum<{
+    invalid_request: "invalid_request";
+    invalid_token: "invalid_token";
+    join_protocol_unsupported: "join_protocol_unsupported";
+    join_protocol_v1_removed: "join_protocol_v1_removed";
+    no_target: "no_target";
+    org_mismatch: "org_mismatch";
+    relay_timeout: "relay_timeout";
+    token_already_used: "token_already_used";
+    token_expired: "token_expired";
+}>;
+export type JoinErrorCode = z.infer<typeof JoinErrorCode>;
+export declare const JoinRequestKind: z.ZodEnum<{
+    invalid: "invalid";
+    v1_removed: "v1_removed";
+    v2: "v2";
+}>;
+export type JoinRequestKind = z.infer<typeof JoinRequestKind>;
+/** The decoded routing part of a join token. A lookup key only: the orchestrator trusts its stored row. */
+export declare const joinRoutingSchema: z.ZodObject<{
+    orgId: z.ZodString;
+    routingKey: z.ZodString;
+    expiry: z.ZodNumber;
+}, z.core.$loose>;
+export type JoinRouting = z.infer<typeof joinRoutingSchema>;
+/** Join request sent by a new orchestrator (through the Platform relay or directly to a peer). */
 export declare const joinRequestSchema: z.ZodObject<{
     type: z.ZodLiteral<"join.request">;
     messageId: z.ZodOptional<z.ZodString>;
-    token: z.ZodString;
+    joinProtocol: z.ZodLiteral<2>;
+    routing: z.ZodString;
+    joinerPublicKey: z.ZodString;
+    joinerNonce: z.ZodString;
+    joinerProof: z.ZodString;
 }, z.core.$strip>;
 /** Join response from an existing orchestrator back to the joiner. */
 export declare const joinResponseSchema: z.ZodObject<{
     type: z.ZodLiteral<"join.response">;
     messageId: z.ZodOptional<z.ZodString>;
     success: z.ZodBoolean;
+    joinProtocol: z.ZodOptional<z.ZodLiteral<2>>;
+    serverPublicKey: z.ZodOptional<z.ZodString>;
+    serverNonce: z.ZodOptional<z.ZodString>;
+    serverProof: z.ZodOptional<z.ZodString>;
     encryptedBundle: z.ZodOptional<z.ZodString>;
     error: z.ZodOptional<z.ZodString>;
+    errorCode: z.ZodOptional<z.ZodEnum<{
+        invalid_request: "invalid_request";
+        invalid_token: "invalid_token";
+        join_protocol_unsupported: "join_protocol_unsupported";
+        join_protocol_v1_removed: "join_protocol_v1_removed";
+        no_target: "no_target";
+        org_mismatch: "org_mismatch";
+        relay_timeout: "relay_timeout";
+        token_already_used: "token_already_used";
+        token_expired: "token_expired";
+    }>>;
 }, z.core.$strip>;
 export type JoinRequest = z.infer<typeof joinRequestSchema>;
 export type JoinResponse = z.infer<typeof joinResponseSchema>;
+export type ClassifiedJoinRequest = {
+    kind: typeof JoinRequestKind.enum.v2;
+    request: JoinRequest;
+} | {
+    kind: typeof JoinRequestKind.enum.v1_removed;
+    messageId?: string;
+} | {
+    kind: typeof JoinRequestKind.enum.invalid;
+    messageId?: string;
+};
+/** True for an object whose `type` is `join.request`, whatever else it carries. */
+export declare function isJoinRequestFrame(raw: unknown): boolean;
+/**
+ * Classify a join.request frame. A frame that carries `token` is version 1 even when
+ * v2 fields are present too: it is checked before the parse, which would strip it.
+ */
+export declare function classifyJoinRequest(raw: unknown): ClassifiedJoinRequest;
+/** A refused join.response carrying its error code. */
+export declare function buildJoinRefusal(messageId: string | undefined, errorCode: JoinErrorCode, error: string): JoinResponse;
 //# sourceMappingURL=join.d.ts.map

package/dist/protocol/messages/join.js

@@ -1,28 +1,117 @@
 import "../../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/protocol/messages/join.ts
-/** Join request sent by a new orchestrator (via Platform relay or direct peer). */
+const JOIN_PROTOCOL_VERSION = 2;
+/** `Upgrade` header value on the HTTP 426 that refuses a version-1 join. */
+const JOIN_PROTOCOL_UPGRADE_TOKEN = "kici-join-v2";
+const JOIN_PROTOCOL_V1_REMOVED_MESSAGE = "This kici-admin uses join protocol v1, which orchestrators no longer accept. Upgrade kici-admin, then run kici-admin join again.";
+const JOIN_PROTOCOL_UNSUPPORTED_MESSAGE = "The cluster's orchestrators predate join protocol v2. Upgrade them, then join again.";
+const LEGACY_JOINER_AUTH_MESSAGE = "This kici-admin cannot join through the Platform. Upgrade kici-admin, then run kici-admin join again.";
+const INVALID_JOIN_REQUEST_MESSAGE = "Invalid join request";
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+const BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
+const HEX_PROOF = /^[0-9a-f]{64}$/;
+const MAX_MESSAGE_ID = 256;
+/** Why a join was refused. Every refusal on the Platform, the orchestrator and the HTTP route sets one. */
+const JoinErrorCode = z.enum([
+	"join_protocol_v1_removed",
+	"join_protocol_unsupported",
+	"invalid_request",
+	"invalid_token",
+	"token_expired",
+	"token_already_used",
+	"org_mismatch",
+	"no_target",
+	"relay_timeout"
+]);
+const JoinRequestKind = z.enum([
+	"v2",
+	"v1_removed",
+	"invalid"
+]);
+/** The decoded routing part of a join token. A lookup key only: the orchestrator trusts its stored row. */
+const joinRoutingSchema = z.object({
+	orgId: z.string().min(1),
+	routingKey: z.string().min(1),
+	expiry: z.number().finite()
+}).passthrough();
+/** Join request sent by a new orchestrator (through the Platform relay or directly to a peer). */
 const joinRequestSchema = z.object({
 	type: z.literal("join.request"),
-	/** Correlation ID for Platform relay routing. Platform injects this on relay to match
-	*  join.response back to the correct joining orchestrator when multiple joiners
-	*  are active concurrently. */
-	messageId: z.string().optional(),
-	/** The full join token: kici_join_v1.<base64url_routing>.<secret_hex> */
-	token: z.string()
+	/** Correlation ID the Platform injects on relay to route the response back. */
+	messageId: z.string().max(MAX_MESSAGE_ID).optional(),
+	joinProtocol: z.literal(2),
+	/** The token's base64url routing part, exactly as it appears in the token. */
+	routing: z.string().max(2048).regex(BASE64URL),
+	/** The joiner's one-time X25519 public key, DER SPKI, base64. */
+	joinerPublicKey: z.string().max(128).regex(BASE64),
+	/** 32 random bytes, base64. */
+	joinerNonce: z.string().max(64).regex(BASE64),
+	/** HMAC-SHA256 over the request transcript, lowercase hex. */
+	joinerProof: z.string().regex(HEX_PROOF)
 });
 /** Join response from an existing orchestrator back to the joiner. */
 const joinResponseSchema = z.object({
 	type: z.literal("join.response"),
 	/** Correlation ID echoed from join.request for Platform relay routing. */
-	messageId: z.string().optional(),
+	messageId: z.string().max(MAX_MESSAGE_ID).optional(),
 	success: z.boolean(),
-	/** Base64-encoded AES-256-GCM encrypted config bundle (present on success). */
+	joinProtocol: z.literal(2).optional(),
+	/** The existing orchestrator's one-time X25519 public key, DER SPKI, base64. */
+	serverPublicKey: z.string().max(128).regex(BASE64).optional(),
+	/** 32 random bytes, base64. */
+	serverNonce: z.string().max(64).regex(BASE64).optional(),
+	/** HMAC-SHA256 over the response transcript, lowercase hex. */
+	serverProof: z.string().regex(HEX_PROOF).optional(),
+	/** Base64 AES-256-GCM sealed configuration bundle (on success). */
 	encryptedBundle: z.string().optional(),
-	/** Error message (present on failure). */
-	error: z.string().optional()
+	/** Error message (on failure). */
+	error: z.string().optional(),
+	errorCode: JoinErrorCode.optional()
 });
+function isRecord(raw) {
+	return typeof raw === "object" && raw !== null && !Array.isArray(raw);
+}
+function messageIdOf(raw) {
+	if (!isRecord(raw)) return void 0;
+	const id = raw.messageId;
+	return typeof id === "string" && id.length <= MAX_MESSAGE_ID ? id : void 0;
+}
+/** True for an object whose `type` is `join.request`, whatever else it carries. */
+function isJoinRequestFrame(raw) {
+	return isRecord(raw) && raw.type === "join.request";
+}
+/**
+* Classify a join.request frame. A frame that carries `token` is version 1 even when
+* v2 fields are present too: it is checked before the parse, which would strip it.
+*/
+function classifyJoinRequest(raw) {
+	const messageId = messageIdOf(raw);
+	if (isJoinRequestFrame(raw) && Object.prototype.hasOwnProperty.call(raw, "token")) return {
+		kind: JoinRequestKind.enum.v1_removed,
+		messageId
+	};
+	const parsed = joinRequestSchema.safeParse(raw);
+	if (parsed.success) return {
+		kind: JoinRequestKind.enum.v2,
+		request: parsed.data
+	};
+	return {
+		kind: JoinRequestKind.enum.invalid,
+		messageId
+	};
+}
+/** A refused join.response carrying its error code. */
+function buildJoinRefusal(messageId, errorCode, error) {
+	return {
+		type: "join.response",
+		messageId,
+		success: false,
+		errorCode,
+		error
+	};
+}
 //#endregion
-export { joinRequestSchema, joinResponseSchema };
+export { INVALID_JOIN_REQUEST_MESSAGE, JOIN_PROTOCOL_UNSUPPORTED_MESSAGE, JOIN_PROTOCOL_UPGRADE_TOKEN, JOIN_PROTOCOL_V1_REMOVED_MESSAGE, JOIN_PROTOCOL_VERSION, JoinErrorCode, JoinRequestKind, LEGACY_JOINER_AUTH_MESSAGE, buildJoinRefusal, classifyJoinRequest, isJoinRequestFrame, joinRequestSchema, joinResponseSchema, joinRoutingSchema };
 
 //# sourceMappingURL=join.js.map

package/dist/protocol/messages/peer.d.ts

@@ -22,29 +22,54 @@ declare const scalerCapacitySummarySchema: z.ZodObject<{
     spawnsOnLocalHost: z.ZodOptional<z.ZodBoolean>;
     labelSetMandatoryLabels: z.ZodArray<z.ZodArray<z.ZodString>>;
 }, z.core.$strict>;
-/** Peer hello: initiator sends ephemeral X25519 public key and nonce. */
+/** Peer authentication schemes. A server lists the ones it accepts in `peer.hello`. */
+export declare const PeerAuthScheme: z.ZodEnum<{
+    "mutual-v2": "mutual-v2";
+}>;
+export type PeerAuthScheme = z.infer<typeof PeerAuthScheme>;
+/** How a peer proves itself: with its persisted credential, or with a join token on first join. */
+export declare const PeerAuthMode: z.ZodEnum<{
+    credential: "credential";
+    token: "token";
+}>;
+export type PeerAuthMode = z.infer<typeof PeerAuthMode>;
+/**
+ * The reason a server gives a peer that authenticates without mutual-v2 (a
+ * proof or token field, or no scheme). It is none of the credential-divergence
+ * reasons, so that peer keeps its credential file.
+ */
+export declare const PEER_MUTUAL_AUTH_REQUIRED_REASON = "Mutual peer authentication required";
+/** Peer hello: the server sends its ephemeral X25519 public key, a nonce and its schemes. */
 export declare const peerHelloSchema: z.ZodObject<{
     type: z.ZodLiteral<"peer.hello">;
     ephemeralPublicKey: z.ZodString;
     nonce: z.ZodString;
+    authSchemes: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
 /** Peer hello response: responder sends their ephemeral X25519 public key. */
 export declare const peerHelloResponseSchema: z.ZodObject<{
     type: z.ZodLiteral<"peer.hello.response">;
     ephemeralPublicKey: z.ZodString;
 }, z.core.$strip>;
-/** Peer auth request sent after ECDH handshake (encrypted channel established). */
+/** Peer auth request sent after the ECDH handshake, under the handshake key. */
 export declare const peerAuthRequestSchema: z.ZodObject<{
     type: z.ZodLiteral<"peer.auth.request">;
     instanceId: z.ZodString;
-    token: z.ZodOptional<z.ZodString>;
-    proof: z.ZodOptional<z.ZodString>;
     protocolVersion: z.ZodNumber;
     softwareVersion: z.ZodOptional<z.ZodString>;
     role: z.ZodOptional<z.ZodEnum<{
         coordinator: "coordinator";
         worker: "worker";
     }>>;
+    scheme: z.ZodEnum<{
+        "mutual-v2": "mutual-v2";
+    }>;
+    mode: z.ZodEnum<{
+        credential: "credential";
+        token: "token";
+    }>;
+    clientProof: z.ZodString;
+    tokenRouting: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /** Peer auth response indicating whether the connection was accepted. */
 export declare const peerAuthResponseSchema: z.ZodObject<{
@@ -52,6 +77,7 @@ export declare const peerAuthResponseSchema: z.ZodObject<{
     accepted: z.ZodBoolean;
     instanceId: z.ZodOptional<z.ZodString>;
     reason: z.ZodOptional<z.ZodString>;
+    serverProof: z.ZodOptional<z.ZodString>;
     sessionCredential: z.ZodOptional<z.ZodString>;
     role: z.ZodOptional<z.ZodString>;
     softwareVersion: z.ZodOptional<z.ZodString>;
@@ -646,25 +672,34 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     type: z.ZodLiteral<"peer.hello">;
     ephemeralPublicKey: z.ZodString;
     nonce: z.ZodString;
+    authSchemes: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"peer.hello.response">;
     ephemeralPublicKey: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"peer.auth.request">;
     instanceId: z.ZodString;
-    token: z.ZodOptional<z.ZodString>;
-    proof: z.ZodOptional<z.ZodString>;
     protocolVersion: z.ZodNumber;
     softwareVersion: z.ZodOptional<z.ZodString>;
     role: z.ZodOptional<z.ZodEnum<{
         coordinator: "coordinator";
         worker: "worker";
     }>>;
+    scheme: z.ZodEnum<{
+        "mutual-v2": "mutual-v2";
+    }>;
+    mode: z.ZodEnum<{
+        credential: "credential";
+        token: "token";
+    }>;
+    clientProof: z.ZodString;
+    tokenRouting: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"peer.auth.response">;
     accepted: z.ZodBoolean;
     instanceId: z.ZodOptional<z.ZodString>;
     reason: z.ZodOptional<z.ZodString>;
+    serverProof: z.ZodOptional<z.ZodString>;
     sessionCredential: z.ZodOptional<z.ZodString>;
     role: z.ZodOptional<z.ZodString>;
     softwareVersion: z.ZodOptional<z.ZodString>;
@@ -1031,25 +1066,34 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     type: z.ZodLiteral<"peer.hello">;
     ephemeralPublicKey: z.ZodString;
     nonce: z.ZodString;
+    authSchemes: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"peer.hello.response">;
     ephemeralPublicKey: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"peer.auth.request">;
     instanceId: z.ZodString;
-    token: z.ZodOptional<z.ZodString>;
-    proof: z.ZodOptional<z.ZodString>;
     protocolVersion: z.ZodNumber;
     softwareVersion: z.ZodOptional<z.ZodString>;
     role: z.ZodOptional<z.ZodEnum<{
         coordinator: "coordinator";
         worker: "worker";
     }>>;
+    scheme: z.ZodEnum<{
+        "mutual-v2": "mutual-v2";
+    }>;
+    mode: z.ZodEnum<{
+        credential: "credential";
+        token: "token";
+    }>;
+    clientProof: z.ZodString;
+    tokenRouting: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"peer.auth.response">;
     accepted: z.ZodBoolean;
     instanceId: z.ZodOptional<z.ZodString>;
     reason: z.ZodOptional<z.ZodString>;
+    serverProof: z.ZodOptional<z.ZodString>;
     sessionCredential: z.ZodOptional<z.ZodString>;
     role: z.ZodOptional<z.ZodString>;
     softwareVersion: z.ZodOptional<z.ZodString>;
@@ -1414,6 +1458,9 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
 export type PeerCapabilities = z.infer<typeof peerCapabilitiesSchema>;
 export type ScalerCapacitySummary = z.infer<typeof scalerCapacitySummarySchema>;
 export type PeerHeartbeat = z.infer<typeof peerHeartbeatSchema>;
+export type PeerHello = z.infer<typeof peerHelloSchema>;
+export type PeerAuthRequest = z.infer<typeof peerAuthRequestSchema>;
+export type PeerAuthResponse = z.infer<typeof peerAuthResponseSchema>;
 export type JobReroute = z.infer<typeof jobRerouteSchema>;
 export type RerouteSpawnRetry = z.infer<typeof rerouteSpawnRetrySchema>;
 export type JobProgress = z.infer<typeof jobProgressSchema>;

package/dist/protocol/messages/peer.js

@@ -67,13 +67,29 @@ const scalerCapacitySummarySchema = z.object({
 	*/
 	labelSetMandatoryLabels: z.array(z.array(z.string()))
 }).strict();
-/** Peer hello: initiator sends ephemeral X25519 public key and nonce. */
+/** Peer authentication schemes. A server lists the ones it accepts in `peer.hello`. */
+const PeerAuthScheme = z.enum(["mutual-v2"]);
+/** How a peer proves itself: with its persisted credential, or with a join token on first join. */
+const PeerAuthMode = z.enum(["credential", "token"]);
+/**
+* The reason a server gives a peer that authenticates without mutual-v2 (a
+* proof or token field, or no scheme). It is none of the credential-divergence
+* reasons, so that peer keeps its credential file.
+*/
+const PEER_MUTUAL_AUTH_REQUIRED_REASON = "Mutual peer authentication required";
+/** Peer hello: the server sends its ephemeral X25519 public key, a nonce and its schemes. */
 const peerHelloSchema = z.object({
 	type: z.literal("peer.hello"),
 	/** Base64-encoded X25519 DER SPKI ephemeral public key. */
 	ephemeralPublicKey: z.string(),
 	/** Base64-encoded 32-byte random nonce (HKDF salt). */
-	nonce: z.string()
+	nonce: z.string(),
+	/**
+	* The authentication schemes this server accepts. Strings rather than an
+	* enum, so a hello naming a scheme this build does not know still parses.
+	* Optional so a hello naming none reaches the client's explicit refusal.
+	*/
+	authSchemes: z.array(z.string()).optional()
 });
 /** Peer hello response: responder sends their ephemeral X25519 public key. */
 const peerHelloResponseSchema = z.object({
@@ -81,19 +97,21 @@ const peerHelloResponseSchema = z.object({
 	/** Base64-encoded X25519 DER SPKI ephemeral public key. */
 	ephemeralPublicKey: z.string()
 });
-/** Peer auth request sent after ECDH handshake (encrypted channel established). */
+/** Peer auth request sent after the ECDH handshake, under the handshake key. */
 const peerAuthRequestSchema = z.object({
 	type: z.literal("peer.auth.request"),
 	instanceId: z.string(),
-	/** Join token (first connection via token-based auth). */
-	token: z.string().optional(),
-	/** HMAC proof of credential ownership (reconnection). */
-	proof: z.string().optional(),
 	protocolVersion: z.number(),
-	/** Software version of the connecting peer (for version compat check). */
+	/** Software version of the connecting peer (logged). */
 	softwareVersion: z.string().optional(),
-	/** Role of the connecting peer. */
-	role: z.enum(["coordinator", "worker"]).optional()
+	/** Role of the connecting peer, as it declares it. */
+	role: z.enum(["coordinator", "worker"]).optional(),
+	scheme: PeerAuthScheme,
+	mode: PeerAuthMode,
+	/** Hex HMAC-SHA256 proof bound to the handshake transcript. */
+	clientProof: z.string(),
+	/** The join token's base64url routing segment. The server requires it in token mode. */
+	tokenRouting: z.string().optional()
 });
 /** Peer auth response indicating whether the connection was accepted. */
 const peerAuthResponseSchema = z.object({
@@ -101,6 +119,8 @@ const peerAuthResponseSchema = z.object({
 	accepted: z.boolean(),
 	instanceId: z.string().optional(),
 	reason: z.string().optional(),
+	/** Hex proof that the server holds the same credential or token; present on every acceptance. */
+	serverProof: z.string().optional(),
 	/** Session credential issued on first join (worker stores for reconnection). */
 	sessionCredential: z.string().optional(),
 	/** Assigned role echoed back to the connecting peer. */
@@ -650,6 +670,6 @@ const peerFromPeerMessageSchema = z.discriminatedUnion("type", [
 	peerScalerEventSchema
 ]);
 //#endregion
-export { PeerForgetOutcome, ScalerOrphansAction, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, fleetSelectionSchema, jobProgressAckSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerForgetRequestSchema, peerForgetResponseSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerScalerOrphansRequestSchema, peerScalerOrphansResponseSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, rerouteSpawnRetrySchema, scalerLiveVmSchema, scalerVmStopResultSchema, workerClusterSettingsSchema };
+export { PEER_MUTUAL_AUTH_REQUIRED_REASON, PeerAuthMode, PeerAuthScheme, PeerForgetOutcome, ScalerOrphansAction, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, fleetSelectionSchema, jobProgressAckSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerForgetRequestSchema, peerForgetResponseSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerScalerOrphansRequestSchema, peerScalerOrphansResponseSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, rerouteSpawnRetrySchema, scalerLiveVmSchema, scalerVmStopResultSchema, workerClusterSettingsSchema };
 
 //# sourceMappingURL=peer.js.map

package/dist/protocol/messages/platform-orchestrator.d.ts

@@ -544,6 +544,7 @@ export declare const orchCapabilitiesUpdateSchema: z.ZodObject<{
             use: z.ZodOptional<z.ZodLiteral<"enc">>;
         }, z.core.$loose>>;
         dashboardVerifiedIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        clusterJoinV2: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$loose>;
 }, z.core.$strip>;
 export type OrchCapabilitiesUpdate = z.infer<typeof orchCapabilitiesUpdateSchema>;
@@ -633,6 +634,7 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     orgPublicAlias: z.ZodOptional<z.ZodString>;
     orgId: z.ZodOptional<z.ZodString>;
     provenanceIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    githubWebhookUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"auth.failure">;
     reason: z.ZodString;
@@ -3568,6 +3570,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             use: z.ZodOptional<z.ZodLiteral<"enc">>;
         }, z.core.$loose>>;
         dashboardVerifiedIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        clusterJoinV2: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$loose>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"source.register">;
@@ -3686,6 +3689,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             use: z.ZodOptional<z.ZodLiteral<"enc">>;
         }, z.core.$loose>>;
         dashboardVerifiedIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        clusterJoinV2: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$loose>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"heartbeat">;

package/dist/webhook/webhook-url-format.d.ts

@@ -2,8 +2,8 @@
  * Route shape for a GitHub App webhook. Org-scoped, NOT app-scoped — the app
  * id does not appear, so the URL is resolvable before the App exists (the
  * manifest setup flow needs it up front to bake into the App manifest). Shared
- * by the Platform's webhook-URL builder and the orchestrator's manifest
- * pre-flight so the two never drift.
+ * by the Platform's relay route and the orchestrator's org-scoped direct route,
+ * and by both sides' URL builders, so they never drift.
  */
 export declare function githubWebhookPath(orgId: string): string;
 /**

package/dist/webhook/webhook-url-format.js

@@ -4,8 +4,8 @@ import "../rolldown-runtime-ClRpJifh.js";
 * Route shape for a GitHub App webhook. Org-scoped, NOT app-scoped — the app
 * id does not appear, so the URL is resolvable before the App exists (the
 * manifest setup flow needs it up front to bake into the App manifest). Shared
-* by the Platform's webhook-URL builder and the orchestrator's manifest
-* pre-flight so the two never drift.
+* by the Platform's relay route and the orchestrator's org-scoped direct route,
+* and by both sides' URL builders, so they never drift.
 */
 function githubWebhookPath(orgId) {
 	return `/webhook/${orgId}/github`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/engine",
-  "version": "0.14.1",
+  "version": "0.15.0",
   "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
   "keywords": [
     "ci",

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/engine@0.14.1",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.14.1/bdf9966d-24d2-432a-b69d-6100cb893919",
+  "name": "@kici-dev/engine@0.15.0",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.15.0/24481e55-dbc5-4970-be42-91b11ccfadb8",
   "creationInfo": {
-    "created": "2026-10-02T17:53:08Z",
+    "created": "2026-10-04T12:25:10Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -54,7 +54,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.14.1",
+      "versionInfo": "0.15.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -65,7 +65,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.14.1"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.15.0"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",