@kici-dev/engine 0.14.2 → 0.16.0

package/dist/protocol/messages/platform-orchestrator.js

@@ -1,12 +1,12 @@
 import "../../rolldown-runtime-ClRpJifh.js";
 import { heartbeatSchema, nackSchema } from "./common.js";
-import { executionStatusSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema } from "./execution-status.js";
-import { jobContextMessageSchema, runEventMessageSchema } from "./run-events.js";
-import { sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema } from "./source-registration.js";
-import { dashboardPlatformToOrchSchema } from "./dashboard.js";
 import { OrchRole, orchCapabilitiesSchema, platformCapabilitiesSchema } from "./capabilities.js";
 import { authFailureSchema, authRequestSchema, authSuccessSchema } from "./auth.js";
 import { LogStream } from "./log-stream.js";
+import { executionStatusSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema } from "./execution-status.js";
+import { sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema } from "./source-registration.js";
+import { jobContextMessageSchema, runEventMessageSchema } from "./run-events.js";
+import { dashboardPlatformToOrchSchema } from "./dashboard.js";
 import { z } from "zod";
 //#region src/protocol/messages/platform-orchestrator.ts
 /**
@@ -15,20 +15,15 @@ import { z } from "zod";
 * from the enclosing message so the orchestrator's evaluator and cache can type
 * against the policy alone.
 */
+/** Seconds in an hour. */
+const SECONDS_PER_HOUR = 3600;
 /**
-* Documented default hours a security hold stays open.
+* Documented default window a security hold stays open: 72 hours.
 *
 * The single owner of the value: the fail-closed policy, the orchestrator's
 * stored-policy default, and the hold-sizing fallback all read it, so the
 * number cannot drift between the two packages that enforce it.
 */
-const DEFAULT_APPROVAL_EXPIRY_HOURS = 72;
-/** Seconds in an hour — the one conversion between the two expiry spellings. */
-const SECONDS_PER_HOUR = 3600;
-/**
-* The same documented default as {@link DEFAULT_APPROVAL_EXPIRY_HOURS}, in the
-* granularity the policy actually stores.
-*/
 const DEFAULT_APPROVAL_EXPIRY_SECONDS = 72 * SECONDS_PER_HOUR;
 /**
 * The shortest expressible security-hold window.
@@ -39,37 +34,8 @@ const DEFAULT_APPROVAL_EXPIRY_SECONDS = 72 * SECONDS_PER_HOUR;
 * opinion that also puts the window back out of reach of a test.
 */
 const MIN_APPROVAL_EXPIRY_SECONDS = 1;
-/** The longest window the Platform accepts: one year, the bound already applied to hours. */
-const MAX_APPROVAL_EXPIRY_HOURS = 8760;
-/** {@link MAX_APPROVAL_EXPIRY_HOURS} in seconds, so neither spelling outranges the other. */
-const MAX_APPROVAL_EXPIRY_SECONDS = MAX_APPROVAL_EXPIRY_HOURS * SECONDS_PER_HOUR;
-/**
-* The window a policy actually means, in seconds.
-*
-* `approvalExpirySeconds` is the authority and `approvalExpiryHours` its coarse
-* spelling, so the more specific field wins whenever both are present — the
-* only rule that never discards what an operator asked for. A policy carrying
-* neither (an older peer that sent no window at all) falls back to the
-* documented default.
-*/
-function approvalExpirySecondsOf(policy) {
-	if (policy.approvalExpirySeconds != null) return policy.approvalExpirySeconds;
-	if (policy.approvalExpiryHours != null) return policy.approvalExpiryHours * SECONDS_PER_HOUR;
-	return DEFAULT_APPROVAL_EXPIRY_SECONDS;
-}
-/**
-* The coarse `approvalExpiryHours` view of a window stored in seconds.
-*
-* Rounds UP, and never below one hour. A sub-hour window has no exact hours
-* spelling, and the peer reading this field is one that cannot express the real
-* value anyway — so the choice is which way to be wrong. Rounding up yields a
-* longer hold than asked for, which stays approvable; rounding down yields zero,
-* which is the already-expired hold `MIN_APPROVAL_EXPIRY_SECONDS` exists to
-* prevent.
-*/
-function approvalExpiryHoursOf(seconds) {
-	return Math.max(1, Math.ceil(seconds / SECONDS_PER_HOUR));
-}
+/** The longest window the Platform accepts: one year. */
+const MAX_APPROVAL_EXPIRY_SECONDS = 8760 * SECONDS_PER_HOUR;
 /**
 * The org-level fork switch: the setting an org's trust policy carries for how
 * fork pull requests are treated. Each value names what the operator is
@@ -110,31 +76,14 @@ const CiTrustLevel = z.enum([
 const trustPolicySchema = z.object({
 	forkPolicy: ForkPolicy,
 	/**
-	* Hours a security hold stays open — the coarse spelling of
-	* `approvalExpirySeconds`, kept required so an orchestrator or CLI on an
-	* older build still receives a window it can read. Not deprecated: it is read,
-	* enforced whenever no seconds value accompanies it, and remains the
-	* ergonomic way to say "72 hours".
-	*
-	* Integer and positive: the column is INTEGER NOT NULL, so a fractional value
-	* throws inside the fire-and-forget persist and the policy is then silently
-	* never stored, and a zero or negative value mints an already-expired hold.
-	*/
-	approvalExpiryHours: z.number().int().min(1),
-	/**
-	* Seconds a security hold stays open — the authoritative window, and the one
-	* granularity that can express a sub-hour hold.
+	* Seconds a security hold stays open.
 	*
-	* Optional because an older Platform sends only the hours field; a frame
-	* without it resolves through {@link approvalExpirySecondsOf}, which falls
-	* back to `approvalExpiryHours * SECONDS_PER_HOUR`. When both are present this
-	* one wins, at every layer.
-	*
-	* Integer and at least {@link MIN_APPROVAL_EXPIRY_SECONDS} for the same two
-	* reasons the hours field is: the column is INTEGER, and a non-positive window
+	* Integer and at least {@link MIN_APPROVAL_EXPIRY_SECONDS}: the column is
+	* INTEGER, so a fractional value throws inside the fire-and-forget persist
+	* and the policy is then silently never stored, and a non-positive window
 	* mints an already-expired hold.
 	*/
-	approvalExpirySeconds: z.number().int().min(1).optional()
+	approvalExpirySeconds: z.number().int().min(1)
 }).strict();
 /** Trust policy update pushed from Platform to orchestrator when policy or identity links change. */
 const trustPolicyUpdateSchema = z.object({
@@ -345,12 +294,8 @@ const staleCheckrunCleanupSchema = z.object({
 });
 /**
 * Platform capability advertisement, sent once by the Platform after the
-* orchestrator authenticates. The orchestrator caches it per connection and
-* pre-flight-checks its own feature-gated sends against it, so a self-hosted
-* orchestrator running ahead of the hosted Platform surfaces a diagnosable
-* capability gap instead of firing a frame the Platform would silently drop.
-* Payload is `platformCapabilitiesSchema` (`.passthrough()`, absent =
-* unsupported).
+* orchestrator authenticates. Payload is `platformCapabilitiesSchema`, which
+* defines no flag at protocol 4.
 */
 const platformCapabilitiesMessageSchema = z.object({
 	type: z.literal("platform.capabilities"),
@@ -436,20 +381,16 @@ const planHeadroomSchema = z.object({
 /**
 * Acknowledgment that a webhook was received and processing started.
 *
-* Under the chunked relay protocol the orchestrator also reports the HMAC
-* verification outcome here via `result`, and may include a non-secret-bearing
-* diagnostic in `reason` when result is a rejection. Both fields are optional
-* for backward compatibility during the rollout: pre-cutover senders omit them.
+* The orchestrator reports the HMAC verification outcome via `result`, and may
+* include a non-secret-bearing diagnostic in `reason` when result is a
+* rejection.
 */
 const webhookAckSchema = z.object({
 	type: z.literal("webhook.ack"),
 	messageId: z.string(),
 	deliveryId: z.string(),
-	/**
-	* Verification + processing outcome. Required from the chunked relay path
-	* (commit 3 onwards on the orch side); pre-chunked acks omit this.
-	*/
-	result: WebhookRelayResult.optional(),
+	/** Verification + processing outcome. */
+	result: WebhookRelayResult,
 	/**
 	* Optional non-secret-bearing diagnostic for rejection cases. MUST NOT
 	* include any secret material (HMAC keys, bearer tokens, computed signatures).
@@ -479,11 +420,8 @@ const logChunkSchema = z.object({
 	stepIndex: z.number(),
 	lines: z.array(z.string()),
 	timestamp: z.number(),
-	/**
-	* Which stream these lines came from. Optional for backward compatibility
-	* with orchestrators that do not send it; absent is read as `stdout`.
-	*/
-	stream: LogStream.optional()
+	/** Which stream these lines came from. */
+	stream: LogStream
 });
 /**
 * Phase of an orchestration/provisioning log line. Mirrors the phases the
@@ -620,6 +558,6 @@ const ORCH_TO_PLATFORM_RECOGNIZED_TYPES = new Set(collectDiscriminatorTypes(orch
 */
 const PLATFORM_TO_ORCH_RECOGNIZED_TYPES = new Set(collectDiscriminatorTypes(platformToOrchestratorMessageSchema));
 //#endregion
-export { CLUSTER_MEMBERSHIP_MAX_WORKERS, CiTrustLevel, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_APPROVAL_EXPIRY_SECONDS, ForkPolicy, MAX_APPROVAL_EXPIRY_HOURS, MAX_APPROVAL_EXPIRY_SECONDS, MIN_APPROVAL_EXPIRY_SECONDS, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OrchLogPhase, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, SECONDS_PER_HOUR, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, approvalExpiryHoursOf, approvalExpirySecondsOf, cacheStatsSchema, clusterMembershipSchema, collectDiscriminatorTypes, executionEventSchema, logChunkSchema, orchCapabilitiesUpdateSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, planHeadroomSchema, platformCapabilitiesMessageSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicySchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };
+export { CLUSTER_MEMBERSHIP_MAX_WORKERS, CiTrustLevel, DEFAULT_APPROVAL_EXPIRY_SECONDS, ForkPolicy, MAX_APPROVAL_EXPIRY_SECONDS, MIN_APPROVAL_EXPIRY_SECONDS, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OrchLogPhase, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, SECONDS_PER_HOUR, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, cacheStatsSchema, clusterMembershipSchema, collectDiscriminatorTypes, executionEventSchema, logChunkSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, planHeadroomSchema, platformCapabilitiesMessageSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicySchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };
 
 //# sourceMappingURL=platform-orchestrator.js.map

package/dist/protocol/messages/source-registration.d.ts

@@ -134,19 +134,6 @@ export declare const sourceRegistrationSchema: z.ZodObject<{
     s3LogAccess: z.ZodOptional<z.ZodBoolean>;
     queueTimeoutMs: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
-/**
- * One accepted source in a {@link sourceRegistrationAckSchema}. Carries the
- * public webhook URL the Platform computed for this routing key so the
- * orchestrator (which only knows its org *alias*, never the canonical org id)
- * can surface it to the operator — e.g. `kici-admin source add` printing the
- * URL to paste into a GitHub App. `webhookUrl` is null when the Platform has
- * no public webhook base configured (`config.webhookPublicUrl` unset).
- */
-export declare const acceptedSourceSchema: z.ZodObject<{
-    routingKey: z.ZodString;
-    webhookUrl: z.ZodNullable<z.ZodString>;
-}, z.core.$strip>;
-export type AcceptedSource = z.infer<typeof acceptedSourceSchema>;
 /** Platform acknowledgment of source registration. */
 export declare const sourceRegistrationAckSchema: z.ZodObject<{
     type: z.ZodLiteral<"source.register.ack">;

package/dist/protocol/messages/source-registration.js

@@ -131,30 +131,29 @@ const sourceRegistrationSchema = z.object({
 	* different orchestrator clusters that accidentally share the same
 	* `clusterName` in one org: every coord in an HA cluster shares the
 	* same orch DB and therefore the same `clusterId`, while two unrelated
-	* clusters carry distinct UUIDs. Optional — older orchestrators that
-	* haven't been redeployed yet won't publish it, in which case Platform
-	* skips the cross-cluster collision warn for that connection.
+	* clusters carry distinct UUIDs. Absent when the orchestrator could not
+	* read its cluster id, in which case Platform skips the cross-cluster
+	* collision warn for that connection.
 	*/
 	clusterId: z.string().uuid().optional(),
 	/** Reachable address for peer-to-peer connections (from KICI_CLUSTER_ADDRESS env var). */
 	address: z.string().nullable().optional(),
-	/** Orchestrator version (e.g. "0.0.1"). Optional for backward compatibility with older orchestrators. */
+	/** Orchestrator version (e.g. "0.0.1"). Absent when the orchestrator cannot read its own version. */
 	version: z.string().optional(),
-	/** Orchestrator config mode. Optional for backward compatibility. */
+	/** Orchestrator config mode. */
 	mode: OrchestratorMode.optional(),
 	/** Scaler backends configured on this orchestrator (e.g. ["container", "firecracker"]). */
 	scalerBackends: z.array(z.string()).optional(),
 	/**
 	* How the orchestrator process itself was deployed (systemd/launchd/windows/
 	* compose/unknown), used by the dashboard to build the correct kici-admin
-	* invocation. Optional: older orchestrators that haven't been redeployed don't
-	* publish it, in which case the dashboard treats the shape as `unknown`.
+	* invocation. Absent when the orchestrator cannot detect it, in which case
+	* the dashboard treats the shape as `unknown`.
 	*/
 	deployment: DeploymentIdentitySchema.optional(),
 	/**
 	* Where this orchestrator's own config files live on its host, so the
-	* dashboard can point an operator straight at them. Optional: an
-	* orchestrator that predates the field omits it, and each member is omitted
+	* dashboard can point an operator straight at them. Each member is omitted
 	* independently when that path is not knowable.
 	*/
 	configPaths: ConfigPathsSchema.optional(),
@@ -205,6 +204,6 @@ const sourceDeregisterAckSchema = z.object({
 	removed: z.array(z.string())
 });
 //#endregion
-export { OWN_INGRESS_MODES, OrchestratorMode, PLATFORM_CONNECTED_MODES, RELAY_INGRESS_MODES, SourceProvider, SourceSubtype, acceptedSourceSchema, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema };
+export { OWN_INGRESS_MODES, OrchestratorMode, PLATFORM_CONNECTED_MODES, RELAY_INGRESS_MODES, SourceProvider, SourceSubtype, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema };
 
 //# sourceMappingURL=source-registration.js.map

package/dist/protocol/version.d.ts

@@ -1,21 +1,15 @@
 /**
  * Protocol version. Sent during WebSocket handshake.
  *
- * Increment when a message schema gains something an older peer cannot parse,
- * and pair the bump with a named floor so a sender can gate on the version a
- * peer negotiated instead of guessing.
+ * Increment when a message schema gains something an older peer cannot parse.
+ * The minimum equals the current version, so every bump is a breaking change:
+ * every tier upgrades in the same window.
  *
- * Version 3 records that a version-2 peer (every 0.8.x build) cannot parse the
- * 0.9.0 `trust_policy.update` policy, the peer heartbeat, or the
- * `artifacts.upload.complete` frame: the fields it requires were removed and
- * the schemas are strict, so a version-2 peer that was let through the
- * handshake would drop or refuse those frames silently.
+ * Version 4: fields every sender already set are required, and the capability
+ * flags every build advertised are gone. A version-3 peer (every release
+ * before it) may omit those fields, so it is refused at connect.
  */
-export declare const PROTOCOL_VERSION = 3;
-/**
- * Minimum protocol version accepted.
- * Connections below this are rejected.
- * Capabilities handle per-feature negotiation above this baseline.
- */
-export declare const MIN_PROTOCOL_VERSION = 3;
+export declare const PROTOCOL_VERSION = 4;
+/** Minimum protocol version accepted. Connections below this are rejected. */
+export declare const MIN_PROTOCOL_VERSION = 4;
 //# sourceMappingURL=version.d.ts.map

package/dist/protocol/version.js

@@ -3,23 +3,17 @@ import "../rolldown-runtime-ClRpJifh.js";
 /**
 * Protocol version. Sent during WebSocket handshake.
 *
-* Increment when a message schema gains something an older peer cannot parse,
-* and pair the bump with a named floor so a sender can gate on the version a
-* peer negotiated instead of guessing.
+* Increment when a message schema gains something an older peer cannot parse.
+* The minimum equals the current version, so every bump is a breaking change:
+* every tier upgrades in the same window.
 *
-* Version 3 records that a version-2 peer (every 0.8.x build) cannot parse the
-* 0.9.0 `trust_policy.update` policy, the peer heartbeat, or the
-* `artifacts.upload.complete` frame: the fields it requires were removed and
-* the schemas are strict, so a version-2 peer that was let through the
-* handshake would drop or refuse those frames silently.
+* Version 4: fields every sender already set are required, and the capability
+* flags every build advertised are gone. A version-3 peer (every release
+* before it) may omit those fields, so it is refused at connect.
 */
-const PROTOCOL_VERSION = 3;
-/**
-* Minimum protocol version accepted.
-* Connections below this are rejected.
-* Capabilities handle per-feature negotiation above this baseline.
-*/
-const MIN_PROTOCOL_VERSION = 3;
+const PROTOCOL_VERSION = 4;
+/** Minimum protocol version accepted. Connections below this are rejected. */
+const MIN_PROTOCOL_VERSION = 4;
 //#endregion
 export { MIN_PROTOCOL_VERSION, PROTOCOL_VERSION };
 

package/dist/provenance/id-token-claim-names.d.ts

@@ -1,11 +1,9 @@
 /**
  * Every claim a KiCI provenance ID token carries, in a stable order.
  *
- * Both OIDC discovery documents render `claims_supported` from this list — the
- * orchestrator issuer that mints tokens today and the legacy Platform issuer
- * whose already-issued tokens carried the same shape — so a relying party
- * configuring a trust policy reads the same names under either `iss`. The
- * orchestrator binds the list to its `IdTokenClaims` type at compile time and
+ * The orchestrator's OIDC discovery document renders `claims_supported` from
+ * this list, so a relying party configuring a trust policy reads the names the
+ * tokens carry. The orchestrator binds the list to its `IdTokenClaims` type at compile time and
  * a drift test checks it against the claims its builder actually emits.
  */
 export declare const ID_TOKEN_CLAIM_NAMES: readonly ['iss', 'sub', 'aud', 'iat', 'nbf', 'exp', 'jti', 'kici_run_id', 'kici_job_id', 'repository', 'workflow_repository', 'ref', 'base_ref', 'head_ref', 'head_repository', 'is_fork', 'event_name', 'trust_tier', 'actor', 'sha', 'workflow_ref', 'orchestrator_id', 'org_id', 'source_origin', 'provider', 'statement_hash', 'attestation_origin'];

package/dist/provenance/id-token-claim-names.js

@@ -3,11 +3,9 @@ import "../rolldown-runtime-ClRpJifh.js";
 /**
 * Every claim a KiCI provenance ID token carries, in a stable order.
 *
-* Both OIDC discovery documents render `claims_supported` from this list — the
-* orchestrator issuer that mints tokens today and the legacy Platform issuer
-* whose already-issued tokens carried the same shape — so a relying party
-* configuring a trust policy reads the same names under either `iss`. The
-* orchestrator binds the list to its `IdTokenClaims` type at compile time and
+* The orchestrator's OIDC discovery document renders `claims_supported` from
+* this list, so a relying party configuring a trust policy reads the names the
+* tokens carry. The orchestrator binds the list to its `IdTokenClaims` type at compile time and
 * a drift test checks it against the claims its builder actually emits.
 */
 const ID_TOKEN_CLAIM_NAMES = [

package/dist/status/presentation.d.ts

@@ -1,6 +1,6 @@
 /**
  * Shared execution-status presentation vocabulary: the canonical status union,
- * a total precedence order for roll-up aggregates, legacy-spelling resolution,
+ * a total precedence order for roll-up aggregates, canonical-status resolution,
  * and a per-status failure classification.
  *
  * Pure Zod (browser-safe): the engine barrel re-exports this module and the
@@ -23,21 +23,9 @@ export type CanonicalStatus = ExecutionRunStatus | ExecutionJobStatus;
 export declare const CANONICAL_STATUSES: readonly CanonicalStatus[];
 /** Canonical statuses ordered worst-first. Derived from `STATUS_RANK`. */
 export declare const STATUS_PRECEDENCE: readonly CanonicalStatus[];
-/**
- * Legacy status spellings that map onto a canonical status. An alias always
- * resolves like the status it aliases, so a consumer never needs a second
- * hand-written copy of the mapping.
- */
-export declare const LEGACY_STATUS_ALIASES: Readonly<Record<string, CanonicalStatus>>;
 /**
  * Resolve a status string onto its canonical status, or `undefined` when it is
- * neither canonical nor a known legacy alias. Callers that accept mixed case
- * lowercase their input first.
- *
- * `Object.hasOwn`, not a bare index: an object literal inherits
- * `Object.prototype`, so indexing it with `toString` / `constructor` /
- * `valueOf` would yield a function rather than `undefined` and the caller's
- * fallback would never fire.
+ * not canonical. Callers that accept mixed case lowercase their input first.
  */
 export declare function toCanonicalStatus(status: string): CanonicalStatus | undefined;
 /**

package/dist/status/presentation.js

@@ -4,7 +4,7 @@ import { z } from "zod";
 //#region src/status/presentation.ts
 /**
 * Shared execution-status presentation vocabulary: the canonical status union,
-* a total precedence order for roll-up aggregates, legacy-spelling resolution,
+* a total precedence order for roll-up aggregates, canonical-status resolution,
 * and a per-status failure classification.
 *
 * Pure Zod (browser-safe): the engine barrel re-exports this module and the
@@ -61,30 +61,10 @@ const STATUS_RANK = Object.freeze({
 /** Canonical statuses ordered worst-first. Derived from `STATUS_RANK`. */
 const STATUS_PRECEDENCE = Object.freeze([...CANONICAL_STATUSES].sort((a, b) => STATUS_RANK[a] - STATUS_RANK[b]));
 /**
-* Legacy status spellings that map onto a canonical status. An alias always
-* resolves like the status it aliases, so a consumer never needs a second
-* hand-written copy of the mapping.
-*/
-const LEGACY_STATUS_ALIASES = Object.freeze({
-	passed: ExecutionRunStatus.enum.success,
-	completed: ExecutionRunStatus.enum.success,
-	in_progress: ExecutionRunStatus.enum.running,
-	error: ExecutionRunStatus.enum.failed,
-	canceled: ExecutionRunStatus.enum.cancelled,
-	waiting: ExecutionRunStatus.enum.pending
-});
-/**
 * Resolve a status string onto its canonical status, or `undefined` when it is
-* neither canonical nor a known legacy alias. Callers that accept mixed case
-* lowercase their input first.
-*
-* `Object.hasOwn`, not a bare index: an object literal inherits
-* `Object.prototype`, so indexing it with `toString` / `constructor` /
-* `valueOf` would yield a function rather than `undefined` and the caller's
-* fallback would never fire.
+* not canonical. Callers that accept mixed case lowercase their input first.
 */
 function toCanonicalStatus(status) {
-	if (Object.hasOwn(LEGACY_STATUS_ALIASES, status)) return LEGACY_STATUS_ALIASES[status];
 	return CANONICAL_SET.has(status) ? status : void 0;
 }
 /**
@@ -158,6 +138,6 @@ function isFailureStatus(status) {
 	return canonical !== void 0 && STATUS_FAILURE_CLASS[canonical] === StatusFailureClass.enum.failure;
 }
 //#endregion
-export { CANONICAL_STATUSES, LEGACY_STATUS_ALIASES, STATUS_FAILURE_CLASS, STATUS_PRECEDENCE, StatusFailureClass, isFailureStatus, toCanonicalStatus, worstStatus };
+export { CANONICAL_STATUSES, STATUS_FAILURE_CLASS, STATUS_PRECEDENCE, StatusFailureClass, isFailureStatus, toCanonicalStatus, worstStatus };
 
 //# sourceMappingURL=presentation.js.map