@kici-dev/engine 0.14.2 → 0.16.0

package/dist/approval/expiry-duration.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Parse an approval-expiry duration (`72h`, `30m`, `90s`, `1h30m`) into seconds.
+ * Units appear at most once, in h-m-s order, with no spaces.
+ *
+ * Throws an `Error` for a malformed value and a `RangeError` for a value
+ * outside `MIN_APPROVAL_EXPIRY_SECONDS..MAX_APPROVAL_EXPIRY_SECONDS`.
+ */
+export declare function parseExpiryDuration(input: string): number;
+/** Format seconds as the shortest exact h/m/s spelling, e.g. 5400 → `1h30m`. */
+export declare function formatExpiryDuration(seconds: number): string;
+//# sourceMappingURL=expiry-duration.d.ts.map

package/dist/approval/expiry-duration.js

@@ -0,0 +1,29 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { MAX_APPROVAL_EXPIRY_SECONDS } from "../protocol/messages/platform-orchestrator.js";
+//#region src/approval/expiry-duration.ts
+const DURATION = /^(?:(\d+)h)?(?:(\d+)m)?(?:(\d+)s)?$/;
+/**
+* Parse an approval-expiry duration (`72h`, `30m`, `90s`, `1h30m`) into seconds.
+* Units appear at most once, in h-m-s order, with no spaces.
+*
+* Throws an `Error` for a malformed value and a `RangeError` for a value
+* outside `MIN_APPROVAL_EXPIRY_SECONDS..MAX_APPROVAL_EXPIRY_SECONDS`.
+*/
+function parseExpiryDuration(input) {
+	const m = DURATION.exec(input);
+	if (!input || !m) throw new Error(`invalid duration "${input}": use h, m and s units, e.g. 72h or 1h30m`);
+	const seconds = Number(m[1] ?? 0) * 3600 + Number(m[2] ?? 0) * 60 + Number(m[3] ?? 0);
+	if (seconds < 1 || seconds > 31536e3) throw new RangeError(`duration "${input}" is outside 1s..${MAX_APPROVAL_EXPIRY_SECONDS}s`);
+	return seconds;
+}
+/** Format seconds as the shortest exact h/m/s spelling, e.g. 5400 → `1h30m`. */
+function formatExpiryDuration(seconds) {
+	const h = Math.floor(seconds / 3600);
+	const m = Math.floor(seconds % 3600 / 60);
+	const s = seconds % 60;
+	return `${h ? `${h}h` : ""}${m ? `${m}m` : ""}${s || !h && !m ? `${s}s` : ""}`;
+}
+//#endregion
+export { formatExpiryDuration, parseExpiryDuration };
+
+//# sourceMappingURL=expiry-duration.js.map

package/dist/audit/access-log-policy.js

@@ -174,8 +174,10 @@ const POLICY_BY_ACTION = {
 	"cluster_name.update": { kind: "always" },
 	"attestation.retry": { kind: "always" },
 	"scaler.orphan.stop": { kind: "always" },
+	"scaler.reload": { kind: "always" },
 	"peer.forget": { kind: "always" },
 	"db.fresh": { kind: "always" },
+	"db.migrate": { kind: "always" },
 	"db.ensure": { kind: "always" },
 	"db.create_role": { kind: "always" },
 	"db.create_readonly_user": { kind: "always" },

package/dist/audit/retention-policy.d.ts

@@ -70,7 +70,7 @@ export declare function accessLogWarmSqlCase(): string;
  * Postgres CASE for Platform `audit_log`. Mirrors `auditLogWarmDays()`.
  *
  * The Platform `audit_log` table has neither an `outcome` nor an `actor_type`
- * column (per migration `001_initial`). Actor type only exists in the JS
+ * column. Actor type only exists in the JS
  * application layer — when an actor is written, the JS code derives `actor_id`
  * from `actor.sub` (or a fixed string like `'platform-admin-cli'`). Because of
  * that, the SQL CASE here cannot apply the `actor.type='platform_operator'`

package/dist/audit/retention-policy.js

@@ -78,8 +78,10 @@ const ACCESS_LOG_WARM_DAYS = {
 	"cluster_name.update": 180,
 	"attestation.retry": 180,
 	"scaler.orphan.stop": 180,
+	"scaler.reload": 180,
 	"peer.forget": 180,
 	"db.fresh": 180,
+	"db.migrate": 180,
 	"db.ensure": 180,
 	"db.create_role": 180,
 	"db.create_readonly_user": 180,
@@ -218,7 +220,7 @@ function accessLogWarmSqlCase() {
 * Postgres CASE for Platform `audit_log`. Mirrors `auditLogWarmDays()`.
 *
 * The Platform `audit_log` table has neither an `outcome` nor an `actor_type`
-* column (per migration `001_initial`). Actor type only exists in the JS
+* column. Actor type only exists in the JS
 * application layer — when an actor is written, the JS code derives `actor_id`
 * from `actor.sub` (or a fixed string like `'platform-admin-cli'`). Because of
 * that, the SQL CASE here cannot apply the `actor.type='platform_operator'`
@@ -337,8 +339,10 @@ const ACCESS_LOG_COLD_DAYS = {
 	"cluster_name.update": 730,
 	"attestation.retry": 730,
 	"scaler.orphan.stop": 730,
+	"scaler.reload": 730,
 	"peer.forget": 730,
 	"db.fresh": 730,
+	"db.migrate": 730,
 	"db.ensure": 730,
 	"db.create_role": 730,
 	"db.create_readonly_user": 730,

package/dist/auth/permissions.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The resource × level permission matrix shared by the Platform (enforcement)
+ * and the dashboard (conditional rendering). Browser-safe: data and types only.
+ */
+/** Resources that can be permission-gated. */
+export type Resource = 'runs' | 'api_keys' | 'webhook_sources' | 'org_settings' | 'members' | 'secrets' | 'workflows' | 'billing' | 'audit' | 'contexts' | 'ci_trust' | 'webhook_endpoints' | 'event_log' | 'event_dlq'
+/**
+ * `support` gates the `manage_support_access` capability: enabling /
+ * disabling KiCI support sessions for the org (the `support_sessions_enabled`
+ * org flag). Checked at `admin` level (`requirePermission(db, 'support',
+ * 'admin')`) — managing whether KiCI staff may open a read session is an
+ * owner-tier operation, so members get `none`.
+ */
+ | 'support'
+/**
+ * `teams` gates managing operator-defined teams: creating / renaming /
+ * deleting teams, editing membership, and attaching / detaching team-role
+ * grants. `teams:admin` to manage; `teams:read` to view. Owners get `admin`,
+ * members get `read` by default.
+ */
+ | 'teams'
+/**
+ * `fleet` gates fleet-management: viewing the host roster, declaring /
+ * removing hosts, and agent control. `fleet:read` to view, `fleet:write`
+ * to mutate. Owners get `write`, members get `none` by default.
+ */
+ | 'fleet'
+/**
+ * `notifications` gates execution-notification config: connecting the Slack
+ * app, managing channels, and creating subscriptions. `notifications:admin`
+ * to manage; `notifications:read` to view. Owners get `admin`, members get
+ * `read` by default. Not repo-scoped.
+ */
+ | 'notifications';
+/**
+ * Permission levels ordered by privilege.
+ *
+ * `read_payload` is a special level used ONLY for the `event_log` resource.
+ * It sits between `read` and `write`: holders can fetch the raw webhook
+ * payload bodies, which may carry PII (commit messages, PR bodies, sender
+ * emails, accidentally-echoed tokens). Listing the metadata rows is gated
+ * by plain `read`; the payload body is gated by `read_payload` (or higher).
+ *
+ * For all other resources, `read_payload` is treated equivalently to `read`
+ * by the hierarchy.
+ */
+export type PermissionLevel = 'none' | 'read' | 'read_payload' | 'write' | 'admin';
+/**
+ * Permission matrix mapping each resource to a permission level.
+ */
+export type Permissions = Record<Resource, PermissionLevel>;
+/**
+ * Numeric hierarchy for comparing permission levels.
+ */
+export declare const PERMISSION_HIERARCHY: Record<PermissionLevel, number>;
+/**
+ * All resources in the system.
+ */
+export declare const ALL_RESOURCES: Resource[];
+/**
+ * Check if a permissions object grants sufficient access to a resource.
+ *
+ * @param permissions - The permission matrix to check
+ * @param resource - The resource being accessed
+ * @param required - The minimum permission level required
+ * @returns true if the permission level for the resource is >= required
+ */
+export declare function hasPermission(permissions: Permissions, resource: Resource, required: PermissionLevel): boolean;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/auth/permissions.js

@@ -0,0 +1,51 @@
+import "../rolldown-runtime-ClRpJifh.js";
+//#region src/auth/permissions.ts
+/**
+* Numeric hierarchy for comparing permission levels.
+*/
+const PERMISSION_HIERARCHY = {
+	none: 0,
+	read: 1,
+	read_payload: 2,
+	write: 3,
+	admin: 4
+};
+/**
+* All resources in the system.
+*/
+const ALL_RESOURCES = [
+	"runs",
+	"api_keys",
+	"webhook_sources",
+	"org_settings",
+	"members",
+	"secrets",
+	"workflows",
+	"billing",
+	"audit",
+	"contexts",
+	"ci_trust",
+	"webhook_endpoints",
+	"event_log",
+	"event_dlq",
+	"support",
+	"teams",
+	"fleet",
+	"notifications"
+];
+/**
+* Check if a permissions object grants sufficient access to a resource.
+*
+* @param permissions - The permission matrix to check
+* @param resource - The resource being accessed
+* @param required - The minimum permission level required
+* @returns true if the permission level for the resource is >= required
+*/
+function hasPermission(permissions, resource, required) {
+	const level = permissions[resource] ?? "none";
+	return PERMISSION_HIERARCHY[level] >= PERMISSION_HIERARCHY[required];
+}
+//#endregion
+export { ALL_RESOURCES, PERMISSION_HIERARCHY, hasPermission };
+
+//# sourceMappingURL=permissions.js.map

package/dist/context/hold-type.d.ts

@@ -18,23 +18,4 @@ export declare const HoldType: z.ZodEnum<{
     timer: "timer";
 }>;
 export type HoldType = z.infer<typeof HoldType>;
-/**
- * Map a persisted hold type onto the gate vocabulary.
- *
- * An unrecognised value passes through unchanged rather than being coerced to a
- * default: the wire field is `z.string()` precisely so a newer orchestrator's
- * hold type survives an older reader, and the dashboard's gray fallback badge
- * is the correct rendering for a genuinely unknown type.
- */
-export declare function normalizePersistedHoldType(raw: string): string;
-/**
- * Every spelling `held_runs.hold_type` may hold for one gate hold type — the
- * current one first, then any legacy alias that normalizes onto it.
- *
- * For queries that must match a hold type in SQL, where the row-by-row
- * `normalizePersistedHoldType` cannot run. Feeding this into an `IN (…)` filter
- * keeps a sweep matching rows an un-upgraded orchestrator wrote, and keeps the
- * legacy spellings out of call sites as bare literals.
- */
-export declare function persistedHoldTypeSpellings(type: HoldType): string[];
 //# sourceMappingURL=hold-type.d.ts.map

package/dist/context/hold-type.js

@@ -19,43 +19,7 @@ const HoldType = z.enum([
 	"concurrency",
 	"security"
 ]);
-/**
-* Legacy persisted `held_runs.hold_type` spellings → the gate vocabulary.
-*
-* A row written by an un-upgraded orchestrator can carry `approval` for a
-* reviewer hold or `wait_timer` for a workflow-install wait hold. Writers emit
-* the gate vocabulary and a migration backfills the column, so this map exists
-* for those older rows — it is what lets the two sides deploy independently
-* instead of in lockstep.
-*/
-const LEGACY_HOLD_TYPES = Object.freeze({
-	approval: HoldType.enum.reviewer,
-	wait_timer: HoldType.enum.timer
-});
-/**
-* Map a persisted hold type onto the gate vocabulary.
-*
-* An unrecognised value passes through unchanged rather than being coerced to a
-* default: the wire field is `z.string()` precisely so a newer orchestrator's
-* hold type survives an older reader, and the dashboard's gray fallback badge
-* is the correct rendering for a genuinely unknown type.
-*/
-function normalizePersistedHoldType(raw) {
-	return Object.hasOwn(LEGACY_HOLD_TYPES, raw) ? LEGACY_HOLD_TYPES[raw] : raw;
-}
-/**
-* Every spelling `held_runs.hold_type` may hold for one gate hold type — the
-* current one first, then any legacy alias that normalizes onto it.
-*
-* For queries that must match a hold type in SQL, where the row-by-row
-* `normalizePersistedHoldType` cannot run. Feeding this into an `IN (…)` filter
-* keeps a sweep matching rows an un-upgraded orchestrator wrote, and keeps the
-* legacy spellings out of call sites as bare literals.
-*/
-function persistedHoldTypeSpellings(type) {
-	return [type, ...Object.keys(LEGACY_HOLD_TYPES).filter((spelling) => LEGACY_HOLD_TYPES[spelling] === type)];
-}
 //#endregion
-export { HoldType, normalizePersistedHoldType, persistedHoldTypeSpellings };
+export { HoldType };
 
 //# sourceMappingURL=hold-type.js.map

package/dist/context/index.d.ts

@@ -1,6 +1,6 @@
 export type { Context, ContextBinding, ContextVariable, ContextSourceOverride, ScopedSecret, HeldRun, ProtectionGateResult, TrustTier, MinimumTrust, } from './types.js';
 export { TrustTierSchema, MinimumTrustSchema } from './types.js';
-export { HoldType, normalizePersistedHoldType, persistedHoldTypeSpellings } from './hold-type.js';
+export { HoldType } from './hold-type.js';
 export { trustedContributorHoldReason } from './hold-reason.js';
 export { HeldRunStatus } from './held-run-status.js';
 export { WORKFLOW_MODIFICATION_JOB_ID, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, isSecurityHoldJobId, INSTALL_JOB_ID_PREFIX, installGateJobId, } from './held-run-job-id.js';

package/dist/context/index.js

@@ -1,8 +1,8 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import { HeldRunStatus } from "./held-run-status.js";
-import { HoldType, normalizePersistedHoldType, persistedHoldTypeSpellings } from "./hold-type.js";
 import { MinimumTrustSchema, TrustTierSchema } from "./types.js";
 import { ConcurrencyStrategy, DEFAULT_CONCURRENCY_STRATEGY } from "./concurrency-strategy.js";
+import { HoldType } from "./hold-type.js";
 import { trustedContributorHoldReason } from "./hold-reason.js";
 import { INSTALL_JOB_ID_PREFIX, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, WORKFLOW_MODIFICATION_JOB_ID, installGateJobId, isSecurityHoldJobId } from "./held-run-job-id.js";
 import { DEFAULT_HOLD_EXPIRY_SECONDS } from "./hold-expiry.js";
@@ -10,4 +10,4 @@ import { matchScopePattern, resolveSecretsForContext, resolveSecretsWithProvenan
 import { ContextGateRejectReason, mergeOrderedMaps } from "./multi-context.js";
 import { SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, ScopeNameError, assertValidScopeName, validateScopeName } from "./scope-name.js";
 import { SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SecretKeyError, assertValidSecretKey, validateSecretKey } from "./secret-key.js";
-export { ConcurrencyStrategy, ContextGateRejectReason, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, HeldRunStatus, HoldType, INSTALL_JOB_ID_PREFIX, MinimumTrustSchema, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, ScopeNameError, SecretKeyError, TrustTierSchema, WORKFLOW_MODIFICATION_JOB_ID, assertValidScopeName, assertValidSecretKey, installGateJobId, isSecurityHoldJobId, matchScopePattern, mergeOrderedMaps, normalizePersistedHoldType, persistedHoldTypeSpellings, resolveSecretsForContext, resolveSecretsWithProvenance, stripScopePrefix, trustedContributorHoldReason, validateScopeName, validateSecretKey };
+export { ConcurrencyStrategy, ContextGateRejectReason, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, HeldRunStatus, HoldType, INSTALL_JOB_ID_PREFIX, MinimumTrustSchema, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, ScopeNameError, SecretKeyError, TrustTierSchema, WORKFLOW_MODIFICATION_JOB_ID, assertValidScopeName, assertValidSecretKey, installGateJobId, isSecurityHoldJobId, matchScopePattern, mergeOrderedMaps, resolveSecretsForContext, resolveSecretsWithProvenance, stripScopePrefix, trustedContributorHoldReason, validateScopeName, validateSecretKey };

package/dist/index.d.ts

@@ -20,7 +20,7 @@ export * from './mcp/held-run-resolve.js';
 export * from './mcp/fence.js';
 export * from './protocol/messages/auth.js';
 export * from './protocol/messages/capabilities.js';
-export { webhookRelaySchema, webhookRelayStartSchema, webhookRelayChunkSchema, webhookAckSchema, WebhookRelayResult, WEBHOOK_RELAY_MAX_BODY_BYTES, WEBHOOK_RELAY_CHUNK_SIZE, executionEventSchema, logChunkSchema, orchLogChunkSchema, OrchLogPhase, peerDiscoverSchema, peerUpdateSchema, cacheStatsSchema, orchMetricsSchema, clusterMembershipSchema, CLUSTER_MEMBERSHIP_MAX_WORKERS, planHeadroomSchema, platformToOrchestratorMessageSchema, orchestratorToPlatformMessageSchema, collectDiscriminatorTypes, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, type WebhookRelay, type WebhookRelayStart, type WebhookRelayChunk, type WebhookAck, type LogChunk, type OrchLogChunk, type PeerDiscover, type PeerUpdate, type CacheStats, type OrchMetrics, type ClusterMembership, type PlanHeadroom, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_APPROVAL_EXPIRY_SECONDS, SECONDS_PER_HOUR, MIN_APPROVAL_EXPIRY_SECONDS, MAX_APPROVAL_EXPIRY_HOURS, MAX_APPROVAL_EXPIRY_SECONDS, approvalExpirySecondsOf, approvalExpiryHoursOf, ForkPolicy, CiTrustLevel, trustPolicySchema, type TrustPolicy, trustPolicyUpdateSchema, type TrustPolicyUpdate, staleCheckrunCleanupSchema, type StaleCheckrunCleanup, platformCapabilitiesMessageSchema, type PlatformCapabilitiesMessage, type PlatformToOrchestratorMessage, type OrchestratorToPlatformMessage, } from './protocol/messages/platform-orchestrator.js';
+export { webhookRelaySchema, webhookRelayStartSchema, webhookRelayChunkSchema, webhookAckSchema, WebhookRelayResult, WEBHOOK_RELAY_MAX_BODY_BYTES, WEBHOOK_RELAY_CHUNK_SIZE, executionEventSchema, logChunkSchema, orchLogChunkSchema, OrchLogPhase, peerDiscoverSchema, peerUpdateSchema, cacheStatsSchema, orchMetricsSchema, clusterMembershipSchema, CLUSTER_MEMBERSHIP_MAX_WORKERS, planHeadroomSchema, platformToOrchestratorMessageSchema, orchestratorToPlatformMessageSchema, collectDiscriminatorTypes, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, type WebhookRelay, type WebhookRelayStart, type WebhookRelayChunk, type WebhookAck, type LogChunk, type OrchLogChunk, type PeerDiscover, type PeerUpdate, type CacheStats, type OrchMetrics, type ClusterMembership, type PlanHeadroom, DEFAULT_APPROVAL_EXPIRY_SECONDS, SECONDS_PER_HOUR, MIN_APPROVAL_EXPIRY_SECONDS, MAX_APPROVAL_EXPIRY_SECONDS, ForkPolicy, CiTrustLevel, trustPolicySchema, type TrustPolicy, trustPolicyUpdateSchema, type TrustPolicyUpdate, staleCheckrunCleanupSchema, type StaleCheckrunCleanup, platformCapabilitiesMessageSchema, type PlatformCapabilitiesMessage, type PlatformToOrchestratorMessage, type OrchestratorToPlatformMessage, } from './protocol/messages/platform-orchestrator.js';
 export * from './protocol/messages/execution-status.js';
 export * from './status/presentation.js';
 export * from './protocol/messages/agent-run-result.js';
@@ -33,6 +33,7 @@ export * from './protocol/messages/scaler-event.js';
 export * from './protocol/messages/event-log.js';
 export * from './protocol/messages/access-log.js';
 export * from './approval/types.js';
+export { formatExpiryDuration, parseExpiryDuration } from './approval/expiry-duration.js';
 export * from './audit/access-log-policy.js';
 export * from './audit/retention-policy.js';
 export * from './audit/activity.js';
@@ -69,7 +70,7 @@ export type { RateLimiterConfig, RateLimitResult } from './ws/rate-limiter.js';
 export * from './env/environment-allowlist.js';
 export * from './secrets/index.js';
 export * from './context/index.js';
-export { deriveOsArchLabels, derivePlatformTaints, PLATFORM_TAINT_LABELS, ScalerOs, ScalerArch, scalerPlatformSchema, platformToOsArchLabels, platformToTaints, nodePlatformToScalerOs, nodeArchToScalerArch, hostToScalerPlatform, hostLabel, parseHostLabel, HOST_LABEL_PREFIX, agentTypeLabel, scalerLabel, mergeAutoLabels, normalizeRunsOn, KNOWN_ROLES, resolveRoleLabels, validateNoReservedLabels, scalerAgentLabels, isSelfReportedLabel, SELF_REPORTED_LABEL_PREFIXES, CAPABILITY_LABEL_PREFIX, capabilityLabel, SSH_TRANSPORT_CAPABILITY, RUNTIME_LABEL_PREFIX, runtimeLabel, RuntimeFact, CONTAINER_BUILD_RUNTIME_LABEL, JOB_IMAGE_RUNTIME_LABEL, AGENT_FEATURE_LABEL_PREFIX, AgentFeature, agentFeatureLabel, GLOBAL_EVAL_SKIPS_RESULT_AWARE_LABEL, AGENT_FEATURE_LABELS, INIT_LABEL, PRIVILEGED_ROOT_LABEL, INIT_RUNNER_ROLE_LABEL, } from './labels.js';
+export { deriveOsArchLabels, ScalerOs, ScalerArch, scalerPlatformSchema, platformToOsArchLabels, platformToTaints, nodePlatformToScalerOs, nodeArchToScalerArch, hostToScalerPlatform, hostLabel, parseHostLabel, HOST_LABEL_PREFIX, agentTypeLabel, scalerLabel, mergeAutoLabels, normalizeRunsOn, KNOWN_ROLES, resolveRoleLabels, validateNoReservedLabels, scalerAgentLabels, isSelfReportedLabel, SELF_REPORTED_LABEL_PREFIXES, CAPABILITY_LABEL_PREFIX, capabilityLabel, SSH_TRANSPORT_CAPABILITY, RUNTIME_LABEL_PREFIX, runtimeLabel, RuntimeFact, CONTAINER_BUILD_RUNTIME_LABEL, JOB_IMAGE_RUNTIME_LABEL, AGENT_FEATURE_LABEL_PREFIX, AgentFeature, agentFeatureLabel, GLOBAL_EVAL_SKIPS_RESULT_AWARE_LABEL, AGENT_FEATURE_LABELS, INIT_LABEL, PRIVILEGED_ROOT_LABEL, INIT_RUNNER_ROLE_LABEL, } from './labels.js';
 export type { NormalizedRunsOn } from './labels.js';
 export type { AgentRole } from './labels.js';
 export type { ScalerPlatform } from './labels.js';
@@ -89,4 +90,8 @@ export * from './artifacts/name.js';
 export * from './billing/plan-type.js';
 export * from './billing/subscription-status.js';
 export * from './diagnostics/infra-alert.js';
+export { sleep } from './util/sleep.js';
+export { toIsoString } from './util/date.js';
+export { parseDuration } from './util/parse-duration.js';
+export { ALL_RESOURCES, PERMISSION_HIERARCHY, hasPermission, type PermissionLevel, type Permissions, type Resource, } from './auth/permissions.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -11,45 +11,45 @@ import { ACTOR_AGENT_SUFFIX, ActorType, actorPrincipalSchema, agentLabelOf, apiK
 import { PatKind } from "./protocol/messages/pat-kind.js";
 import { approveRunToolSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, getDiagnosticsToolSchema, getRunToolSchema, getStepLogsToolSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, rejectRunToolSchema, rerunRunToolSchema, triggerRunToolSchema } from "./mcp/tool-schemas.js";
 import { HeldRunStatus } from "./context/held-run-status.js";
-import { HoldType, normalizePersistedHoldType, persistedHoldTypeSpellings } from "./context/hold-type.js";
 import { resolveHeldRunId } from "./mcp/held-run-resolve.js";
 import { renderFenced } from "./mcp/fence.js";
+import { AGENT_CAPABILITIES, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, OrchRole, PLATFORM_CAPABILITIES, agentCapabilitiesSchema, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, platformCapabilitiesSchema } from "./protocol/messages/capabilities.js";
+import { authFailureSchema, authRequestSchema, authSuccessSchema } from "./protocol/messages/auth.js";
+import { LogStream } from "./protocol/messages/log-stream.js";
 import { CONTEXTS_MAX, CacheOutcome, CacheRunEventType, CacheStepType, DEAD_ORCH_FAILURE_REASON, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, JobKind, MAX_JOBS_PER_RUN, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RunFailureClass, STATE_REPLAY_MAX_RUNS, STATUS_EPOCH_MAX, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, SetupStepType, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, isSetupStepType, jobStatusForwardSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepStatusForwardSchema } from "./protocol/messages/execution-status.js";
+import { DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema } from "./protocol/messages/deployment-identity.js";
+import { ConfigPathsSchema } from "./protocol/messages/config-paths.js";
+import { OWN_INGRESS_MODES, OrchestratorMode, PLATFORM_CONNECTED_MODES, RELAY_INGRESS_MODES, SourceProvider, SourceSubtype, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema } from "./protocol/messages/source-registration.js";
 import { MinimumTrustSchema, TrustTierSchema } from "./context/types.js";
 import { AgentFailureCategory, agentJobResultSchema, agentRunListItemSchema, agentRunResultSchema, agentStepLogsSchema, agentStepResultSchema, agentWorkflowSummarySchema, untrusted, wrapUntrusted } from "./protocol/messages/agent-run-result.js";
 import { AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, accessLogFilterSchema, accessLogItemSchema, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema } from "./protocol/messages/access-log.js";
 import { browserJobContextSchema, browserRunEventSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, jobContextMessageSchema, runEventMessageSchema } from "./protocol/messages/run-events.js";
 import { EventLogSource, EventLogStatus, PayloadOmittedReason } from "./protocol/messages/event-log.js";
-import { DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema } from "./protocol/messages/deployment-identity.js";
-import { ConfigPathsSchema } from "./protocol/messages/config-paths.js";
-import { OWN_INGRESS_MODES, OrchestratorMode, PLATFORM_CONNECTED_MODES, RELAY_INGRESS_MODES, SourceProvider, SourceSubtype, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema } from "./protocol/messages/source-registration.js";
 import { INTERNAL_EVENT_NAME_PREFIX, KICI_EVENT_NAME_PREFIX, ScalerBackendType, reservedEventNamePrefix } from "./scaler/scaler-backend-type.js";
 import { ApprovalDecision, HoldScope, TriggerSource, approvalRequirementSchema, approvalTimeoutSecondsSchema, approverClauseSchema } from "./approval/types.js";
-import { CANONICAL_STATUSES, LEGACY_STATUS_ALIASES, STATUS_FAILURE_CLASS, STATUS_PRECEDENCE, StatusFailureClass, isFailureStatus, toCanonicalStatus, worstStatus } from "./status/presentation.js";
-import { BREAKING_FLOOR, GLOBAL_APPROVAL_MIN_READER, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, changedFilesStatusSchema, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, resolveContentFormat, resolveWhenToRunOn } from "./trigger/types.js";
+import { CANONICAL_STATUSES, STATUS_FAILURE_CLASS, STATUS_PRECEDENCE, StatusFailureClass, isFailureStatus, toCanonicalStatus, worstStatus } from "./status/presentation.js";
+import { BREAKING_FLOOR, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, changedFilesStatusSchema, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, resolveContentFormat, resolveWhenToRunOn } from "./trigger/types.js";
 import { canonicalizeLabel, canonicalizeLabelSet, canonicalizeLabels } from "./labels-canonical.js";
 import { normalizeRegexFlags, stripStatefulRegexFlags } from "./regex-flags.js";
 import { HostTargetSelector, HostTargetValue, LabelMatcher, canonicalizeMatcher, compileRegexMatcher, hostSatisfiesTarget, matcherMatches, matcherSatisfiedBy, partitionMatchers } from "./labels-match.js";
 import { ConcurrencyStrategy, DEFAULT_CONCURRENCY_STRATEGY } from "./context/concurrency-strategy.js";
 import { HostInventoryEntry, HostPropertyValue, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, coerceHostPropertyValue, parseHostPropertyAssignments } from "./inventory.js";
 import { REGEX_NEGATIVE_ASSERTION, isNegatedPattern, negatedPatternReason } from "./repo/pattern-negation.js";
-import { ContextDeleteErrorCode, ContextType, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, TestRelayType, artifactListItemSchema, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, eventLogActivityCountsSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
-import { AGENT_CAPABILITIES, AgentCapabilityFlag, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, OrchRole, PLATFORM_CAPABILITIES, agentCapabilitiesSchema, hasAgentCapability, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, platformCapabilitiesSchema } from "./protocol/messages/capabilities.js";
-import { authFailureSchema, authRequestSchema, authSuccessSchema } from "./protocol/messages/auth.js";
-import { LogStream } from "./protocol/messages/log-stream.js";
-import { CLUSTER_MEMBERSHIP_MAX_WORKERS, CiTrustLevel, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_APPROVAL_EXPIRY_SECONDS, ForkPolicy, MAX_APPROVAL_EXPIRY_HOURS, MAX_APPROVAL_EXPIRY_SECONDS, MIN_APPROVAL_EXPIRY_SECONDS, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OrchLogPhase, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, SECONDS_PER_HOUR, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, approvalExpiryHoursOf, approvalExpirySecondsOf, cacheStatsSchema, clusterMembershipSchema, collectDiscriminatorTypes, executionEventSchema, logChunkSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, planHeadroomSchema, platformCapabilitiesMessageSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicySchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema } from "./protocol/messages/platform-orchestrator.js";
+import { ContextDeleteErrorCode, ContextType, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EventLogPayloadStreamError, FleetHostDisposition, FleetHostWriteRefusal, HeldRunQueueType, TestRelayType, artifactListItemSchema, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, eventLogActivityCountsSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostEntrySchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
+import { CLUSTER_MEMBERSHIP_MAX_WORKERS, CiTrustLevel, DEFAULT_APPROVAL_EXPIRY_SECONDS, ForkPolicy, MAX_APPROVAL_EXPIRY_SECONDS, MIN_APPROVAL_EXPIRY_SECONDS, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OrchLogPhase, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, SECONDS_PER_HOUR, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, cacheStatsSchema, clusterMembershipSchema, collectDiscriminatorTypes, executionEventSchema, logChunkSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, planHeadroomSchema, platformCapabilitiesMessageSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicySchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema } from "./protocol/messages/platform-orchestrator.js";
 import { HEARTBEAT_CLOSE_MS, HEARTBEAT_DEGRADED_MS, HEARTBEAT_FRESH_MS, HEARTBEAT_STALE_THRESHOLD_SECONDS, HEARTBEAT_UNHEALTHY_MARK_MS, connectionHealthStatusSchema } from "./protocol/messages/heartbeat-health.js";
 import { agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentSecretScopeSchema } from "./protocol/messages/agent-dev-ops.js";
 import { DEVELOPER_OPERATIONS, developerOpsForEntrypoint } from "./dev-ops/operations.js";
 import { ScalerEventType } from "./protocol/messages/scaler-event.js";
+import { formatExpiryDuration, parseExpiryDuration } from "./approval/expiry-duration.js";
 import { AccessLogPolicyKind, POLICY_BY_ACTION, fnv1a32, shouldRecordAccess, shouldRecordSecretResolve } from "./audit/access-log-policy.js";
 import { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, accessLogWarmSqlCase, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase } from "./audit/retention-policy.js";
 import { ActivityFilterSource, ActivityRowSource, activityCursorSchema, activityFilterSchema, activityRowSchema, decodeActivityCursor, encodeActivityCursor, resolveRunIdSugar } from "./audit/activity.js";
 import { logPullOrchToPlatformSchema, logPullPlatformToOrchSchema } from "./protocol/messages/log-pull.js";
 import { EVENT_LOG_PAYLOAD_CHUNK_BYTES } from "./protocol/event-log-payload.js";
 import { browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, platformToBrowserMessageSchema } from "./protocol/messages/browser.js";
-import { joinRequestSchema, joinResponseSchema } from "./protocol/messages/join.js";
-import { PeerForgetOutcome, ScalerOrphansAction, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, fleetSelectionSchema, jobProgressAckSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerForgetRequestSchema, peerForgetResponseSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerScalerOrphansRequestSchema, peerScalerOrphansResponseSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, rerouteSpawnRetrySchema, scalerLiveVmSchema, scalerVmStopResultSchema, workerClusterSettingsSchema } from "./protocol/messages/peer.js";
+import { INVALID_JOIN_REQUEST_MESSAGE, JOIN_PROTOCOL_UNSUPPORTED_MESSAGE, JOIN_PROTOCOL_UPGRADE_TOKEN, JOIN_PROTOCOL_V1_REMOVED_MESSAGE, JOIN_PROTOCOL_VERSION, JoinErrorCode, JoinRequestKind, LEGACY_JOINER_AUTH_MESSAGE, buildJoinRefusal, classifyJoinRequest, isJoinRequestFrame, joinRequestSchema, joinResponseSchema, joinRoutingSchema } from "./protocol/messages/join.js";
+import { PEER_MUTUAL_AUTH_REQUIRED_REASON, PeerAuthMode, PeerAuthScheme, PeerForgetOutcome, ScalerOrphansAction, ScalerReloadOutcome, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, fleetSelectionSchema, jobProgressAckSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerForgetRequestSchema, peerForgetResponseSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerScalerOrphansRequestSchema, peerScalerOrphansResponseSchema, peerScalerReloadRequestSchema, peerScalerReloadResponseSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, rerouteSpawnRetrySchema, scalerLiveVmSchema, scalerReloadAnswerSchema, scalerReloadInstanceResultSchema, scalerReloadPlanSchema, scalerVmStopResultSchema, workerClusterSettingsSchema } from "./protocol/messages/peer.js";
 import { AGENT_API_REQUEST_TIMEOUT_MS, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactRejectReason, ArtifactUploadOutcome, CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, invokeResultSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, rateLimitWarningSchema, registerAckSchema, scalerClaimCredentialsResponseSchema, scalerClaimCredentialsSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema } from "./protocol/messages/orchestrator-agent.js";
 import { KNOWN_LINUX_CAPABILITIES, canonicalizeCapability, isKnownCapability } from "./sandbox/capabilities.js";
 import { compileSafeRegex, describeTextMatch, evaluateTextMatch, textMatchHasQuery } from "./trigger/text-match.js";
@@ -75,6 +75,7 @@ import { WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAM
 import { WsRateLimiter } from "./ws/rate-limiter.js";
 import { AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, KICI_AGENT_ENV_PREFIX, SANDBOX_DEFAULT_VARS, TRUSTED_ENV_SCRUB_EXACT, buildTrustedPassthroughEnv, isTrustedEnvScrubbed } from "./env/environment-allowlist.js";
 import "./secrets/index.js";
+import { HoldType } from "./context/hold-type.js";
 import { trustedContributorHoldReason } from "./context/hold-reason.js";
 import { INSTALL_JOB_ID_PREFIX, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, WORKFLOW_MODIFICATION_JOB_ID, installGateJobId, isSecurityHoldJobId } from "./context/held-run-job-id.js";
 import { DEFAULT_HOLD_EXPIRY_SECONDS } from "./context/hold-expiry.js";
@@ -83,7 +84,7 @@ import { ContextGateRejectReason, mergeOrderedMaps } from "./context/multi-conte
 import { SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, ScopeNameError, assertValidScopeName, validateScopeName } from "./context/scope-name.js";
 import { SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SecretKeyError, assertValidSecretKey, validateSecretKey } from "./context/secret-key.js";
 import "./context/index.js";
-import { AGENT_FEATURE_LABELS, AGENT_FEATURE_LABEL_PREFIX, AgentFeature, CAPABILITY_LABEL_PREFIX, CONTAINER_BUILD_RUNTIME_LABEL, GLOBAL_EVAL_SKIPS_RESULT_AWARE_LABEL, HOST_LABEL_PREFIX, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, JOB_IMAGE_RUNTIME_LABEL, KNOWN_ROLES, PLATFORM_TAINT_LABELS, PRIVILEGED_ROOT_LABEL, RUNTIME_LABEL_PREFIX, RuntimeFact, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, ScalerArch, ScalerOs, agentFeatureLabel, agentTypeLabel, capabilityLabel, deriveOsArchLabels, derivePlatformTaints, hostLabel, hostToScalerPlatform, isSelfReportedLabel, mergeAutoLabels, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeRunsOn, parseHostLabel, platformToOsArchLabels, platformToTaints, resolveRoleLabels, runtimeLabel, scalerAgentLabels, scalerLabel, scalerPlatformSchema, validateNoReservedLabels } from "./labels.js";
+import { AGENT_FEATURE_LABELS, AGENT_FEATURE_LABEL_PREFIX, AgentFeature, CAPABILITY_LABEL_PREFIX, CONTAINER_BUILD_RUNTIME_LABEL, GLOBAL_EVAL_SKIPS_RESULT_AWARE_LABEL, HOST_LABEL_PREFIX, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, JOB_IMAGE_RUNTIME_LABEL, KNOWN_ROLES, PRIVILEGED_ROOT_LABEL, RUNTIME_LABEL_PREFIX, RuntimeFact, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, ScalerArch, ScalerOs, agentFeatureLabel, agentTypeLabel, capabilityLabel, deriveOsArchLabels, hostLabel, hostToScalerPlatform, isSelfReportedLabel, mergeAutoLabels, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeRunsOn, parseHostLabel, platformToOsArchLabels, platformToTaints, resolveRoleLabels, runtimeLabel, scalerAgentLabels, scalerLabel, scalerPlatformSchema, validateNoReservedLabels } from "./labels.js";
 import { SCALER_EVENT_NAMES, ScaleDownReason, ScalerScaleDownPayload, ScalerScaleUpPayload } from "./scaler/scaler-events.js";
 import { parseMemoryString, resourceRequestNestedSchema, resourceSpecSchema, validateResourceRequest } from "./scaler/resource-types.js";
 import { RegisterableTriggerType } from "./registration/registerable-trigger-type.js";
@@ -96,4 +97,8 @@ import { ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, ArtifactNameSch
 import { PLAN_TYPES, PaidPlanType, PlanType, isPaidTier, planRank } from "./billing/plan-type.js";
 import { SUBSCRIPTION_EXISTS_CODE, StripeSubscriptionStatus, blocksNewCheckout } from "./billing/subscription-status.js";
 import { INFRA_ALERT_TYPES, InfraAlertSeverity, InfraAlertType, normalizeInfraAlertSeverity } from "./diagnostics/infra-alert.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, ACTOR_AGENT_SUFFIX, AGENT_API_REQUEST_TIMEOUT_MS, AGENT_CAPABILITIES, AGENT_FEATURE_LABELS, AGENT_FEATURE_LABEL_PREFIX, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentCapabilityFlag, AgentFailureCategory, AgentFeature, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactNameSchema, ArtifactRejectReason, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CAPABILITY_LABEL_PREFIX, CLUSTER_MEMBERSHIP_MAX_WORKERS, CONTAINER_BUILD_RUNTIME_LABEL, CONTEXTS_MAX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, CiTrustLevel, ConcurrencyStrategy, ConfigPathsSchema, ContextDeleteErrorCode, ContextGateRejectReason, ContextType, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DEAD_ORCH_FAILURE_REASON, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_APPROVAL_EXPIRY_SECONDS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DEFERRED_PATHS_SUMMARY_SUFFIX, DEVELOPER_OPERATIONS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, ForkPolicy, GLOBAL_APPROVAL_MIN_READER, GLOBAL_EVAL_SKIPS_RESULT_AWARE_LABEL, HEARTBEAT_CLOSE_MS, HEARTBEAT_DEGRADED_MS, HEARTBEAT_FRESH_MS, HEARTBEAT_STALE_THRESHOLD_SECONDS, HEARTBEAT_UNHEALTHY_MARK_MS, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, ID_TOKEN_CLAIM_NAMES, INFRA_ALERT_TYPES, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, INSTALL_JOB_ID_PREFIX, INTERNAL_EVENT_NAME_PREFIX, InfraAlertSeverity, InfraAlertType, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JOB_IMAGE_RUNTIME_LABEL, JobKind, JobRejectReason, KICI_AGENT_ENV_PREFIX, KICI_EVENT_NAME_PREFIX, KNOWN_LINUX_CAPABILITIES, KNOWN_ROLES, LEGACY_STATUS_ALIASES, LabelMatcher, LockFileParseError, LogStream, MAX_APPROVAL_EXPIRY_HOURS, MAX_APPROVAL_EXPIRY_SECONDS, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MAX_MATRIX_MATERIALIZATION, MIN_APPROVAL_EXPIRY_SECONDS, MIN_PROTOCOL_VERSION, MatrixShapeError, MinimumTrustSchema, NACK_EXEMPT_MESSAGE_TYPES, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OWN_INGRESS_MODES, OnUnreachableMode, OrchLogPhase, OrchRole, OrchestratorMode, PING_EVENT_TYPE, PLAN_TYPES, PLATFORM_CAPABILITIES, PLATFORM_CONNECTED_MODES, PLATFORM_TAINT_LABELS, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PULL_REQUEST_FAMILY_TRIGGER_EVENTS, PaidPlanType, PatKind, PayloadOmittedReason, PeerForgetOutcome, PlanType, REDACTED_TRACE_FIELD, REGEX_NEGATIVE_ASSERTION, RELAY_INGRESS_MODES, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RUNTIME_LABEL_PREFIX, RegisterableTriggerType, RunFailureClass, RunsOnPick, RuntimeFact, SANDBOX_DEFAULT_VARS, SANDBOX_NETWORK_MODES, SCALER_EVENT_NAMES, SCHEMA_VERSION, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECONDS_PER_HOUR, SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_EPOCH_MAX, STATUS_FAILURE_CLASS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, STATUS_PRECEDENCE, SUBSCRIBABLE_WEBHOOK_EVENT_TYPES, SUBSCRIPTION_EXISTS_CODE, ScaleDownReason, ScalerArch, ScalerBackendType, ScalerEventType, ScalerOrphansAction, ScalerOs, ScalerScaleDownPayload, ScalerScaleUpPayload, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, ScopeNameError, SecretKeyError, SetupStepType, SourceOrigin, SourceProvider, SourceSubtype, StatusFailureClass, StepApprovalOutcome, StepConcurrencyKind, StripeSubscriptionStatus, SubscribableWebhookEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TRACE_TEXT_MAX, TRACE_TRUNCATION_WORKFLOW_NAME, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TRIGGER_TYPE_TO_EVENT_TYPES, TRUSTED_ENV_SCRUB_EXACT, TestRelayType, TimeoutReason, TraceCheck, TraceVerdict, TriggerSource, TrustTierSchema, UNRESOLVED_CLAIM, UnavailablePathsTrace, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WORKFLOW_MODIFICATION_JOB_ID, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_SUPERSEDED_BY_RECONNECT, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookEventType, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentCapabilitiesSchema, agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentFeatureLabel, agentJobResultSchema, agentLabelOf, agentLogChunkSchema, agentMetricsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentRegisterSchema, agentRunListItemSchema, agentRunResultSchema, agentSecretScopeSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, agentWorkflowSummarySchema, apiKeyActorSchema, appendChecks, applyIncludeExclude, approvalExpiryHoursOf, approvalExpirySecondsOf, approvalRequirementSchema, approvalTimeoutSecondsSchema, approveRunToolSchema, approverClauseSchema, artifactInvalidNameError, artifactListItemSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, assertScheduleInputsSatisfiable, assertValidScopeName, assertValidSecretKey, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, blocksNewCheckout, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildEventClaims, buildIdTokenSubject, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, canonicalizeCapability, canonicalizeLabel, canonicalizeLabelSet, canonicalizeLabels, canonicalizeMatcher, capabilityLabel, changedFilesStatusSchema, checkArtifactName, clusterMembershipSchema, coerceDispatchInputs, coerceHostPropertyValue, collectDiscriminatorTypes, compileRegexMatcher, compileSafeRegex, configAckSchema, connectionHealthStatusSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, createCommitMessageTraceEntry, createContentRequirementsTraceEntry, createDispatchFailureTraceEntry, createGlobalFilterTraceEntry, createTraceEntry, createTraceTruncationMarker, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, derivePlatformTaints, describeTextMatch, developerOpsForEntrypoint, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, diffRangeKindSchema, encodeActivityCursor, errorSchema, evaluateTextMatch, eventEmitResponseSchema, eventEmitSchema, eventLogActivityCountsSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, findDuplicateCombination, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getDiagnosticsToolSchema, getRepoGlobMatcher, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubIngressPath, githubWebhookPath, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, hasAgentCapability, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, installGateJobId, invokeResultSchema, isDeferrableRange, isFailureStatus, isInputSatisfiableFromDefaults, isKnownCapability, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, isMintedRef, isNegatedPattern, isPaidTier, isPullRequestFamilyTriggerEvent, isSecurityHoldJobId, isSelfReportedLabel, isSetupStepType, isTrustedEnvScrubbed, isZeroSha, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchTrigger, matchWorkflowTriggers, matchWorkflowsForEvent, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixCombinationCount, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, negatedPatternReason, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeInfraAlertSeverity, normalizeMatrixInput, normalizePersistedHoldType, normalizeRegexFlags, normalizeRunsOn, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerForgetRequestSchema, peerForgetResponseSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerScalerOrphansRequestSchema, peerScalerOrphansResponseSchema, peerToPeerMessageSchema, peerUpdateSchema, persistedHoldTypeSpellings, planHeadroomSchema, planRank, platformCapabilitiesMessageSchema, platformCapabilitiesSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, prepareEventBuckets, provenanceContextSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, rateLimitWarningSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rejectRunToolSchema, renderFenced, rerouteSpawnRetrySchema, rerunRunToolSchema, reservedEventNamePrefix, resolveContentFormat, resolveDiffRange, resolveHeldRunId, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForContext, resolveSecretsWithProvenance, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, runtimeLabel, scalerAgentLabels, scalerClaimCredentialsResponseSchema, scalerClaimCredentialsSchema, scalerLabel, scalerLiveVmSchema, scalerPlatformSchema, scalerVmStopResultSchema, scheduleTriggerKey, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, stripStatefulRegexFlags, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, textMatchHasQuery, toCanonicalStatus, triggerRunToolSchema, truncateDecisionsToByteBudget, truncateTraceText, trustPolicyResponseSchema, trustPolicySchema, trustPolicyUpdateSchema, trustedContributorHoldReason, untrusted, upstreamSnapshotSchema, userActorSchema, utf8ByteLength, validateNoReservedLabels, validateResourceRequest, validateScopeName, validateSecretKey, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, workerClusterSettingsSchema, worstStatus, wrapUntrusted };
+import { sleep } from "./util/sleep.js";
+import { toIsoString } from "./util/date.js";
+import { parseDuration } from "./util/parse-duration.js";
+import { ALL_RESOURCES, PERMISSION_HIERARCHY, hasPermission } from "./auth/permissions.js";
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, ACTOR_AGENT_SUFFIX, AGENT_API_REQUEST_TIMEOUT_MS, AGENT_CAPABILITIES, AGENT_FEATURE_LABELS, AGENT_FEATURE_LABEL_PREFIX, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, ALL_RESOURCES, ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentFailureCategory, AgentFeature, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactNameSchema, ArtifactRejectReason, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CAPABILITY_LABEL_PREFIX, CLUSTER_MEMBERSHIP_MAX_WORKERS, CONTAINER_BUILD_RUNTIME_LABEL, CONTEXTS_MAX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, CiTrustLevel, ConcurrencyStrategy, ConfigPathsSchema, ContextDeleteErrorCode, ContextGateRejectReason, ContextType, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DEAD_ORCH_FAILURE_REASON, DEFAULT_APPROVAL_EXPIRY_SECONDS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DEFERRED_PATHS_SUMMARY_SUFFIX, DEVELOPER_OPERATIONS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, FleetHostWriteRefusal, ForkPolicy, GLOBAL_EVAL_SKIPS_RESULT_AWARE_LABEL, HEARTBEAT_CLOSE_MS, HEARTBEAT_DEGRADED_MS, HEARTBEAT_FRESH_MS, HEARTBEAT_STALE_THRESHOLD_SECONDS, HEARTBEAT_UNHEALTHY_MARK_MS, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, ID_TOKEN_CLAIM_NAMES, INFRA_ALERT_TYPES, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, INSTALL_JOB_ID_PREFIX, INTERNAL_EVENT_NAME_PREFIX, INVALID_JOIN_REQUEST_MESSAGE, InfraAlertSeverity, InfraAlertType, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JOB_IMAGE_RUNTIME_LABEL, JOIN_PROTOCOL_UNSUPPORTED_MESSAGE, JOIN_PROTOCOL_UPGRADE_TOKEN, JOIN_PROTOCOL_V1_REMOVED_MESSAGE, JOIN_PROTOCOL_VERSION, JobKind, JobRejectReason, JoinErrorCode, JoinRequestKind, KICI_AGENT_ENV_PREFIX, KICI_EVENT_NAME_PREFIX, KNOWN_LINUX_CAPABILITIES, KNOWN_ROLES, LEGACY_JOINER_AUTH_MESSAGE, LabelMatcher, LockFileParseError, LogStream, MAX_APPROVAL_EXPIRY_SECONDS, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MAX_MATRIX_MATERIALIZATION, MIN_APPROVAL_EXPIRY_SECONDS, MIN_PROTOCOL_VERSION, MatrixShapeError, MinimumTrustSchema, NACK_EXEMPT_MESSAGE_TYPES, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OWN_INGRESS_MODES, OnUnreachableMode, OrchLogPhase, OrchRole, OrchestratorMode, PEER_MUTUAL_AUTH_REQUIRED_REASON, PERMISSION_HIERARCHY, PING_EVENT_TYPE, PLAN_TYPES, PLATFORM_CAPABILITIES, PLATFORM_CONNECTED_MODES, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PULL_REQUEST_FAMILY_TRIGGER_EVENTS, PaidPlanType, PatKind, PayloadOmittedReason, PeerAuthMode, PeerAuthScheme, PeerForgetOutcome, PlanType, REDACTED_TRACE_FIELD, REGEX_NEGATIVE_ASSERTION, RELAY_INGRESS_MODES, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RUNTIME_LABEL_PREFIX, RegisterableTriggerType, RunFailureClass, RunsOnPick, RuntimeFact, SANDBOX_DEFAULT_VARS, SANDBOX_NETWORK_MODES, SCALER_EVENT_NAMES, SCHEMA_VERSION, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECONDS_PER_HOUR, SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_EPOCH_MAX, STATUS_FAILURE_CLASS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, STATUS_PRECEDENCE, SUBSCRIBABLE_WEBHOOK_EVENT_TYPES, SUBSCRIPTION_EXISTS_CODE, ScaleDownReason, ScalerArch, ScalerBackendType, ScalerEventType, ScalerOrphansAction, ScalerOs, ScalerReloadOutcome, ScalerScaleDownPayload, ScalerScaleUpPayload, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, ScopeNameError, SecretKeyError, SetupStepType, SourceOrigin, SourceProvider, SourceSubtype, StatusFailureClass, StepApprovalOutcome, StepConcurrencyKind, StripeSubscriptionStatus, SubscribableWebhookEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TRACE_TEXT_MAX, TRACE_TRUNCATION_WORKFLOW_NAME, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TRIGGER_TYPE_TO_EVENT_TYPES, TRUSTED_ENV_SCRUB_EXACT, TestRelayType, TimeoutReason, TraceCheck, TraceVerdict, TriggerSource, TrustTierSchema, UNRESOLVED_CLAIM, UnavailablePathsTrace, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WORKFLOW_MODIFICATION_JOB_ID, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_SUPERSEDED_BY_RECONNECT, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookEventType, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentCapabilitiesSchema, agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentFeatureLabel, agentJobResultSchema, agentLabelOf, agentLogChunkSchema, agentMetricsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentRegisterSchema, agentRunListItemSchema, agentRunResultSchema, agentSecretScopeSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, agentWorkflowSummarySchema, apiKeyActorSchema, appendChecks, applyIncludeExclude, approvalRequirementSchema, approvalTimeoutSecondsSchema, approveRunToolSchema, approverClauseSchema, artifactInvalidNameError, artifactListItemSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, assertScheduleInputsSatisfiable, assertValidScopeName, assertValidSecretKey, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, blocksNewCheckout, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildEventClaims, buildIdTokenSubject, buildJoinRefusal, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, canonicalizeCapability, canonicalizeLabel, canonicalizeLabelSet, canonicalizeLabels, canonicalizeMatcher, capabilityLabel, changedFilesStatusSchema, checkArtifactName, classifyJoinRequest, clusterMembershipSchema, coerceDispatchInputs, coerceHostPropertyValue, collectDiscriminatorTypes, compileRegexMatcher, compileSafeRegex, configAckSchema, connectionHealthStatusSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, createCommitMessageTraceEntry, createContentRequirementsTraceEntry, createDispatchFailureTraceEntry, createGlobalFilterTraceEntry, createTraceEntry, createTraceTruncationMarker, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, describeTextMatch, developerOpsForEntrypoint, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, diffRangeKindSchema, encodeActivityCursor, errorSchema, evaluateTextMatch, eventEmitResponseSchema, eventEmitSchema, eventLogActivityCountsSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, findDuplicateCombination, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostEntrySchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatExpiryDuration, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getDiagnosticsToolSchema, getRepoGlobMatcher, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubIngressPath, githubWebhookPath, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, hasPermission, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, installGateJobId, invokeResultSchema, isDeferrableRange, isFailureStatus, isInputSatisfiableFromDefaults, isJoinRequestFrame, isKnownCapability, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, isMintedRef, isNegatedPattern, isPaidTier, isPullRequestFamilyTriggerEvent, isSecurityHoldJobId, isSelfReportedLabel, isSetupStepType, isTrustedEnvScrubbed, isZeroSha, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, joinRoutingSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchTrigger, matchWorkflowTriggers, matchWorkflowsForEvent, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixCombinationCount, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, negatedPatternReason, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeInfraAlertSeverity, normalizeMatrixInput, normalizeRegexFlags, normalizeRunsOn, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseDuration, parseExpiryDuration, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerForgetRequestSchema, peerForgetResponseSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerScalerOrphansRequestSchema, peerScalerOrphansResponseSchema, peerScalerReloadRequestSchema, peerScalerReloadResponseSchema, peerToPeerMessageSchema, peerUpdateSchema, planHeadroomSchema, planRank, platformCapabilitiesMessageSchema, platformCapabilitiesSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, prepareEventBuckets, provenanceContextSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, rateLimitWarningSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rejectRunToolSchema, renderFenced, rerouteSpawnRetrySchema, rerunRunToolSchema, reservedEventNamePrefix, resolveContentFormat, resolveDiffRange, resolveHeldRunId, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForContext, resolveSecretsWithProvenance, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, runtimeLabel, scalerAgentLabels, scalerClaimCredentialsResponseSchema, scalerClaimCredentialsSchema, scalerLabel, scalerLiveVmSchema, scalerPlatformSchema, scalerReloadAnswerSchema, scalerReloadInstanceResultSchema, scalerReloadPlanSchema, scalerVmStopResultSchema, scheduleTriggerKey, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sleep, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, stripStatefulRegexFlags, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, textMatchHasQuery, toCanonicalStatus, toIsoString, triggerRunToolSchema, truncateDecisionsToByteBudget, truncateTraceText, trustPolicyResponseSchema, trustPolicySchema, trustPolicyUpdateSchema, trustedContributorHoldReason, untrusted, upstreamSnapshotSchema, userActorSchema, utf8ByteLength, validateNoReservedLabels, validateResourceRequest, validateScopeName, validateSecretKey, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, workerClusterSettingsSchema, worstStatus, wrapUntrusted };

package/dist/labels.d.ts

@@ -31,20 +31,6 @@ import { z } from 'zod';
  * Derive kici:os: and kici:arch: labels from platform and architecture strings.
  */
 export declare function deriveOsArchLabels(platform: string, arch: string): string[];
-/**
- * Plain OS/arch labels that gate a bare-metal scaler as a mandatory taint.
- * A pool whose declared labels include one of these only accepts jobs that
- * explicitly request that platform. Linux and x64/amd64 are the defaults and
- * are absent on purpose — an unqualified `runsOn: 'bare-metal'` job must still
- * land on a Linux-x64 scaler.
- */
-export declare const PLATFORM_TAINT_LABELS: Set<string>;
-/**
- * Intersect a pool's declared labels with {@link PLATFORM_TAINT_LABELS},
- * returning the de-duplicated plain platform-taint labels (lowercased) in
- * input order.
- */
-export declare function derivePlatformTaints(declaredLabels: string[]): string[];
 /**
  * Operating systems a scaler pool can declare via the structured `platform`
  * field. `linux` is the default and carries no taint; `macos` / `windows` are
@@ -94,9 +80,8 @@ export declare function platformToOsArchLabels(platform: ScalerPlatform): string
  * Derive the plain platform-taint labels for a declared structured platform.
  * Returns the canonical tokens (`macos`, `windows`, `arm64`) that a job's
  * `runsOn` must include to allocate on the pool. The linux/x64 default carries
- * no taint. Unlike {@link derivePlatformTaints} (which intersects declared
- * labels against a denylist), this derives from the structured field, so a pool
- * labeled `windows-2022` still taints correctly.
+ * no taint. It derives from the structured field, so a pool labeled
+ * `windows-2022` still taints correctly.
  */
 export declare function platformToTaints(platform: ScalerPlatform): string[];
 /** Map an `os.platform()` string to a `ScalerOs`, or null when unrecognised. */