@kici-dev/engine 0.15.0 → 0.16.0

package/dist/protocol/messages/platform-orchestrator.d.ts

@@ -5,20 +5,15 @@ import { z } from 'zod';
  * from the enclosing message so the orchestrator's evaluator and cache can type
  * against the policy alone.
  */
+/** Seconds in an hour. */
+export declare const SECONDS_PER_HOUR = 3600;
 /**
- * Documented default hours a security hold stays open.
+ * Documented default window a security hold stays open: 72 hours.
  *
  * The single owner of the value: the fail-closed policy, the orchestrator's
  * stored-policy default, and the hold-sizing fallback all read it, so the
  * number cannot drift between the two packages that enforce it.
  */
-export declare const DEFAULT_APPROVAL_EXPIRY_HOURS = 72;
-/** Seconds in an hour — the one conversion between the two expiry spellings. */
-export declare const SECONDS_PER_HOUR = 3600;
-/**
- * The same documented default as {@link DEFAULT_APPROVAL_EXPIRY_HOURS}, in the
- * granularity the policy actually stores.
- */
 export declare const DEFAULT_APPROVAL_EXPIRY_SECONDS: number;
 /**
  * The shortest expressible security-hold window.
@@ -29,34 +24,8 @@ export declare const DEFAULT_APPROVAL_EXPIRY_SECONDS: number;
  * opinion that also puts the window back out of reach of a test.
  */
 export declare const MIN_APPROVAL_EXPIRY_SECONDS = 1;
-/** The longest window the Platform accepts: one year, the bound already applied to hours. */
-export declare const MAX_APPROVAL_EXPIRY_HOURS = 8760;
-/** {@link MAX_APPROVAL_EXPIRY_HOURS} in seconds, so neither spelling outranges the other. */
+/** The longest window the Platform accepts: one year. */
 export declare const MAX_APPROVAL_EXPIRY_SECONDS: number;
-/**
- * The window a policy actually means, in seconds.
- *
- * `approvalExpirySeconds` is the authority and `approvalExpiryHours` its coarse
- * spelling, so the more specific field wins whenever both are present — the
- * only rule that never discards what an operator asked for. A policy carrying
- * neither (an older peer that sent no window at all) falls back to the
- * documented default.
- */
-export declare function approvalExpirySecondsOf(policy: {
-    approvalExpiryHours?: number | null;
-    approvalExpirySeconds?: number | null;
-}): number;
-/**
- * The coarse `approvalExpiryHours` view of a window stored in seconds.
- *
- * Rounds UP, and never below one hour. A sub-hour window has no exact hours
- * spelling, and the peer reading this field is one that cannot express the real
- * value anyway — so the choice is which way to be wrong. Rounding up yields a
- * longer hold than asked for, which stays approvable; rounding down yields zero,
- * which is the already-expired hold `MIN_APPROVAL_EXPIRY_SECONDS` exists to
- * prevent.
- */
-export declare function approvalExpiryHoursOf(seconds: number): number;
 /**
  * The org-level fork switch: the setting an org's trust policy carries for how
  * fork pull requests are treated. Each value names what the operator is
@@ -102,8 +71,7 @@ export declare const trustPolicySchema: z.ZodObject<{
         hold: "hold";
         ignore: "ignore";
     }>;
-    approvalExpiryHours: z.ZodNumber;
-    approvalExpirySeconds: z.ZodOptional<z.ZodNumber>;
+    approvalExpirySeconds: z.ZodNumber;
 }, z.core.$strict>;
 export type TrustPolicy = z.infer<typeof trustPolicySchema>;
 /** Trust policy update pushed from Platform to orchestrator when policy or identity links change. */
@@ -116,8 +84,7 @@ export declare const trustPolicyUpdateSchema: z.ZodObject<{
             hold: "hold";
             ignore: "ignore";
         }>;
-        approvalExpiryHours: z.ZodNumber;
-        approvalExpirySeconds: z.ZodOptional<z.ZodNumber>;
+        approvalExpirySeconds: z.ZodNumber;
     }, z.core.$strict>;
     identityLinks: z.ZodArray<z.ZodObject<{
         userId: z.ZodString;
@@ -289,18 +256,12 @@ export declare const staleCheckrunCleanupSchema: z.ZodObject<{
 export type StaleCheckrunCleanup = z.infer<typeof staleCheckrunCleanupSchema>;
 /**
  * Platform capability advertisement, sent once by the Platform after the
- * orchestrator authenticates. The orchestrator caches it per connection and
- * pre-flight-checks its own feature-gated sends against it, so a self-hosted
- * orchestrator running ahead of the hosted Platform surfaces a diagnosable
- * capability gap instead of firing a frame the Platform would silently drop.
- * Payload is `platformCapabilitiesSchema` (`.passthrough()`, absent =
- * unsupported).
+ * orchestrator authenticates. Payload is `platformCapabilitiesSchema`, which
+ * defines no flag at protocol 4.
  */
 export declare const platformCapabilitiesMessageSchema: z.ZodObject<{
     type: z.ZodLiteral<"platform.capabilities">;
-    capabilities: z.ZodObject<{
-        orchMetrics: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$loose>;
+    capabilities: z.ZodObject<{}, z.core.$loose>;
 }, z.core.$strip>;
 export type PlatformCapabilitiesMessage = z.infer<typeof platformCapabilitiesMessageSchema>;
 /**
@@ -388,22 +349,21 @@ export type PlanHeadroom = z.infer<typeof planHeadroomSchema>;
 /**
  * Acknowledgment that a webhook was received and processing started.
  *
- * Under the chunked relay protocol the orchestrator also reports the HMAC
- * verification outcome here via `result`, and may include a non-secret-bearing
- * diagnostic in `reason` when result is a rejection. Both fields are optional
- * for backward compatibility during the rollout: pre-cutover senders omit them.
+ * The orchestrator reports the HMAC verification outcome via `result`, and may
+ * include a non-secret-bearing diagnostic in `reason` when result is a
+ * rejection.
  */
 export declare const webhookAckSchema: z.ZodObject<{
     type: z.ZodLiteral<"webhook.ack">;
     messageId: z.ZodString;
     deliveryId: z.ZodString;
-    result: z.ZodOptional<z.ZodEnum<{
+    result: z.ZodEnum<{
         accepted: "accepted";
         rejected_misconfigured: "rejected_misconfigured";
         rejected_signature: "rejected_signature";
         rejected_unknown_source: "rejected_unknown_source";
         shed_retry_later: "shed_retry_later";
-    }>>;
+    }>;
     reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>;
 /** Execution lifecycle event reported back to Platform. */
@@ -429,10 +389,10 @@ export declare const logChunkSchema: z.ZodObject<{
     stepIndex: z.ZodNumber;
     lines: z.ZodArray<z.ZodString>;
     timestamp: z.ZodNumber;
-    stream: z.ZodOptional<z.ZodEnum<{
+    stream: z.ZodEnum<{
         stderr: "stderr";
         stdout: "stdout";
-    }>>;
+    }>;
 }, z.core.$strip>;
 /**
  * Phase of an orchestration/provisioning log line. Mirrors the phases the
@@ -486,68 +446,6 @@ export declare const cacheStatsSchema: z.ZodObject<{
     hit: z.ZodBoolean;
 }, z.core.$strip>;
 export type CacheStats = z.infer<typeof cacheStatsSchema>;
-/**
- * Runtime broadcast of an updated dashboard-write policy. Carries the
- * orch's full capabilities object (same shape as `orchCapabilitiesSchema`
- * via `auth.request`) so Platform's per-org cache can be replaced
- * wholesale rather than merged. Emitted by the orch whenever an
- * operator flips a switch via `kici-admin org-settings dashboard-writes`;
- * Platform receives it, updates its cache, and re-broadcasts the
- * relevant subset to any connected dashboard SPA sessions.
- */
-export declare const orchCapabilitiesUpdateSchema: z.ZodObject<{
-    type: z.ZodLiteral<"orch.capabilities.update">;
-    capabilities: z.ZodObject<{
-        orchRole: z.ZodOptional<z.ZodEnum<{
-            coordinator: "coordinator";
-            worker: "worker";
-        }>>;
-        dashboardWrites: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
-            "attestations.retry": "attestations.retry";
-            "backends.sync": "backends.sync";
-            "backends.sync_one": "backends.sync_one";
-            "backends.test": "backends.test";
-            "contexts.bindings.set": "contexts.bindings.set";
-            "contexts.create": "contexts.create";
-            "contexts.delete": "contexts.delete";
-            "contexts.source_overrides.delete": "contexts.source_overrides.delete";
-            "contexts.source_overrides.set": "contexts.source_overrides.set";
-            "contexts.test_access.set": "contexts.test_access.set";
-            "contexts.update": "contexts.update";
-            "event_dlq.discard": "event_dlq.discard";
-            "event_dlq.retry": "event_dlq.retry";
-            "fleet.host.declare": "fleet.host.declare";
-            "fleet.host.remove": "fleet.host.remove";
-            "global_workflows.update": "global_workflows.update";
-            "held_runs.approve": "held_runs.approve";
-            "held_runs.reject": "held_runs.reject";
-            "registration.delete": "registration.delete";
-            "registration.disable": "registration.disable";
-            "secrets.delete": "secrets.delete";
-            "secrets.scope.create": "secrets.scope.create";
-            "secrets.scope.delete": "secrets.scope.delete";
-            "secrets.scope.rename": "secrets.scope.rename";
-            "secrets.set": "secrets.set";
-            "variables.delete": "variables.delete";
-            "variables.set": "variables.set";
-        }> & z.core.$partial, z.ZodEnum<{
-            disabled: "disabled";
-            encrypted: "encrypted";
-            permissive: "permissive";
-        }>>>;
-        supportedDashboardRequests: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        dashboardEncryptionKey: z.ZodOptional<z.ZodObject<{
-            kty: z.ZodLiteral<"OKP">;
-            crv: z.ZodLiteral<"X25519">;
-            x: z.ZodString;
-            kid: z.ZodString;
-            use: z.ZodOptional<z.ZodLiteral<"enc">>;
-        }, z.core.$loose>>;
-        dashboardVerifiedIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        clusterJoinV2: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$loose>;
-}, z.core.$strip>;
-export type OrchCapabilitiesUpdate = z.infer<typeof orchCapabilitiesUpdateSchema>;
 /** All messages that flow from Platform to Orchestrator.
  *
  * The single-frame `webhookRelaySchema` is intentionally NOT a member of this
@@ -588,8 +486,7 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
             hold: "hold";
             ignore: "ignore";
         }>;
-        approvalExpiryHours: z.ZodNumber;
-        approvalExpirySeconds: z.ZodOptional<z.ZodNumber>;
+        approvalExpirySeconds: z.ZodNumber;
     }, z.core.$strict>;
     identityLinks: z.ZodArray<z.ZodObject<{
         userId: z.ZodString;
@@ -631,10 +528,9 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"auth.success">;
     connectionId: z.ZodString;
-    orgPublicAlias: z.ZodOptional<z.ZodString>;
-    orgId: z.ZodOptional<z.ZodString>;
-    provenanceIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    githubWebhookUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    orgPublicAlias: z.ZodString;
+    orgId: z.ZodString;
+    githubWebhookUrl: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"auth.failure">;
     reason: z.ZodString;
@@ -672,9 +568,7 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"platform.capabilities">;
-    capabilities: z.ZodObject<{
-        orchMetrics: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$loose>;
+    capabilities: z.ZodObject<{}, z.core.$loose>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"plan.headroom">;
     maxWorkerPeers: z.ZodNumber;
@@ -1126,7 +1020,7 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         component: z.ZodString;
     }, z.core.$strip>], "type">;
     runId: z.ZodString;
-    routingKey: z.ZodOptional<z.ZodString>;
+    routingKey: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"run.manual_schedule.request">;
     requestId: z.ZodString;
@@ -2963,6 +2857,7 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         "db.create_role": "db.create_role";
         "db.ensure": "db.ensure";
         "db.fresh": "db.fresh";
+        "db.migrate": "db.migrate";
         "db.refresh_collation_version": "db.refresh_collation_version";
         "db.reindex": "db.reindex";
         "diagnostics.read": "diagnostics.read";
@@ -3006,6 +2901,7 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         "scaler.capacity.read": "scaler.capacity.read";
         "scaler.orphan.stop": "scaler.orphan.stop";
         "scaler.orphans.read": "scaler.orphans.read";
+        "scaler.reload": "scaler.reload";
         "secret.delete": "secret.delete";
         "secret.list.read": "secret.list.read";
         "secret.reveal": "secret.reveal";
@@ -3273,13 +3169,13 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
     type: z.ZodLiteral<"webhook.ack">;
     messageId: z.ZodString;
     deliveryId: z.ZodString;
-    result: z.ZodOptional<z.ZodEnum<{
+    result: z.ZodEnum<{
         accepted: "accepted";
         rejected_misconfigured: "rejected_misconfigured";
         rejected_signature: "rejected_signature";
         rejected_unknown_source: "rejected_unknown_source";
         shed_retry_later: "shed_retry_later";
-    }>>;
+    }>;
     reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"execution.event">;
@@ -3301,10 +3197,10 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
     stepIndex: z.ZodNumber;
     lines: z.ZodArray<z.ZodString>;
     timestamp: z.ZodNumber;
-    stream: z.ZodOptional<z.ZodEnum<{
+    stream: z.ZodEnum<{
         stderr: "stderr";
         stdout: "stdout";
-    }>>;
+    }>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"orch-log.chunk">;
     runId: z.ZodString;
@@ -3384,7 +3280,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
         step_failure: "step_failure";
         timed_out: "timed_out";
     }>>;
-    statusEpoch: z.ZodOptional<z.ZodNumber>;
+    statusEpoch: z.ZodNumber;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"step.status.forward">;
     messageId: z.ZodString;
@@ -3506,7 +3402,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             step_failure: "step_failure";
             timed_out: "timed_out";
         }>>;
-        statusEpoch: z.ZodOptional<z.ZodNumber>;
+        statusEpoch: z.ZodNumber;
         jobs: z.ZodArray<z.ZodObject<{
             jobId: z.ZodString;
             jobName: z.ZodString;
@@ -3524,10 +3420,10 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"orch.capabilities.update">;
     capabilities: z.ZodObject<{
-        orchRole: z.ZodOptional<z.ZodEnum<{
+        orchRole: z.ZodEnum<{
             coordinator: "coordinator";
             worker: "worker";
-        }>>;
+        }>;
         dashboardWrites: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
             "attestations.retry": "attestations.retry";
             "backends.sync": "backends.sync";
@@ -3561,7 +3457,6 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             encrypted: "encrypted";
             permissive: "permissive";
         }>>>;
-        supportedDashboardRequests: z.ZodOptional<z.ZodArray<z.ZodString>>;
         dashboardEncryptionKey: z.ZodOptional<z.ZodObject<{
             kty: z.ZodLiteral<"OKP">;
             crv: z.ZodLiteral<"X25519">;
@@ -3570,7 +3465,6 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             use: z.ZodOptional<z.ZodLiteral<"enc">>;
         }, z.core.$loose>>;
         dashboardVerifiedIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        clusterJoinV2: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$loose>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"source.register">;
@@ -3642,11 +3536,11 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
     type: z.ZodLiteral<"auth.request">;
     token: z.ZodString;
     protocolVersion: z.ZodNumber;
-    capabilities: z.ZodOptional<z.ZodObject<{
-        orchRole: z.ZodOptional<z.ZodEnum<{
+    capabilities: z.ZodObject<{
+        orchRole: z.ZodEnum<{
             coordinator: "coordinator";
             worker: "worker";
-        }>>;
+        }>;
         dashboardWrites: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
             "attestations.retry": "attestations.retry";
             "backends.sync": "backends.sync";
@@ -3680,7 +3574,6 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             encrypted: "encrypted";
             permissive: "permissive";
         }>>>;
-        supportedDashboardRequests: z.ZodOptional<z.ZodArray<z.ZodString>>;
         dashboardEncryptionKey: z.ZodOptional<z.ZodObject<{
             kty: z.ZodLiteral<"OKP">;
             crv: z.ZodLiteral<"X25519">;
@@ -3689,8 +3582,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             use: z.ZodOptional<z.ZodLiteral<"enc">>;
         }, z.core.$loose>>;
         dashboardVerifiedIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        clusterJoinV2: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$loose>>;
+    }, z.core.$loose>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"heartbeat">;
     timestamp: z.ZodNumber;
@@ -3812,7 +3704,6 @@ export declare const ORCH_TO_PLATFORM_RECOGNIZED_TYPES: ReadonlySet<string>;
 export declare const PLATFORM_TO_ORCH_RECOGNIZED_TYPES: ReadonlySet<string>;
 export type WebhookRelay = z.infer<typeof webhookRelaySchema>;
 export type WebhookAck = z.infer<typeof webhookAckSchema>;
-export type ExecutionEvent = z.infer<typeof executionEventSchema>;
 export type LogChunk = z.infer<typeof logChunkSchema>;
 export type PeerDiscover = z.infer<typeof peerDiscoverSchema>;
 export type PeerUpdate = z.infer<typeof peerUpdateSchema>;

package/dist/protocol/messages/platform-orchestrator.js

@@ -1,12 +1,12 @@
 import "../../rolldown-runtime-ClRpJifh.js";
 import { heartbeatSchema, nackSchema } from "./common.js";
-import { executionStatusSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema } from "./execution-status.js";
-import { jobContextMessageSchema, runEventMessageSchema } from "./run-events.js";
-import { sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema } from "./source-registration.js";
-import { dashboardPlatformToOrchSchema } from "./dashboard.js";
 import { OrchRole, orchCapabilitiesSchema, platformCapabilitiesSchema } from "./capabilities.js";
 import { authFailureSchema, authRequestSchema, authSuccessSchema } from "./auth.js";
 import { LogStream } from "./log-stream.js";
+import { executionStatusSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema } from "./execution-status.js";
+import { sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema } from "./source-registration.js";
+import { jobContextMessageSchema, runEventMessageSchema } from "./run-events.js";
+import { dashboardPlatformToOrchSchema } from "./dashboard.js";
 import { z } from "zod";
 //#region src/protocol/messages/platform-orchestrator.ts
 /**
@@ -15,20 +15,15 @@ import { z } from "zod";
 * from the enclosing message so the orchestrator's evaluator and cache can type
 * against the policy alone.
 */
+/** Seconds in an hour. */
+const SECONDS_PER_HOUR = 3600;
 /**
-* Documented default hours a security hold stays open.
+* Documented default window a security hold stays open: 72 hours.
 *
 * The single owner of the value: the fail-closed policy, the orchestrator's
 * stored-policy default, and the hold-sizing fallback all read it, so the
 * number cannot drift between the two packages that enforce it.
 */
-const DEFAULT_APPROVAL_EXPIRY_HOURS = 72;
-/** Seconds in an hour — the one conversion between the two expiry spellings. */
-const SECONDS_PER_HOUR = 3600;
-/**
-* The same documented default as {@link DEFAULT_APPROVAL_EXPIRY_HOURS}, in the
-* granularity the policy actually stores.
-*/
 const DEFAULT_APPROVAL_EXPIRY_SECONDS = 72 * SECONDS_PER_HOUR;
 /**
 * The shortest expressible security-hold window.
@@ -39,37 +34,8 @@ const DEFAULT_APPROVAL_EXPIRY_SECONDS = 72 * SECONDS_PER_HOUR;
 * opinion that also puts the window back out of reach of a test.
 */
 const MIN_APPROVAL_EXPIRY_SECONDS = 1;
-/** The longest window the Platform accepts: one year, the bound already applied to hours. */
-const MAX_APPROVAL_EXPIRY_HOURS = 8760;
-/** {@link MAX_APPROVAL_EXPIRY_HOURS} in seconds, so neither spelling outranges the other. */
-const MAX_APPROVAL_EXPIRY_SECONDS = MAX_APPROVAL_EXPIRY_HOURS * SECONDS_PER_HOUR;
-/**
-* The window a policy actually means, in seconds.
-*
-* `approvalExpirySeconds` is the authority and `approvalExpiryHours` its coarse
-* spelling, so the more specific field wins whenever both are present — the
-* only rule that never discards what an operator asked for. A policy carrying
-* neither (an older peer that sent no window at all) falls back to the
-* documented default.
-*/
-function approvalExpirySecondsOf(policy) {
-	if (policy.approvalExpirySeconds != null) return policy.approvalExpirySeconds;
-	if (policy.approvalExpiryHours != null) return policy.approvalExpiryHours * SECONDS_PER_HOUR;
-	return DEFAULT_APPROVAL_EXPIRY_SECONDS;
-}
-/**
-* The coarse `approvalExpiryHours` view of a window stored in seconds.
-*
-* Rounds UP, and never below one hour. A sub-hour window has no exact hours
-* spelling, and the peer reading this field is one that cannot express the real
-* value anyway — so the choice is which way to be wrong. Rounding up yields a
-* longer hold than asked for, which stays approvable; rounding down yields zero,
-* which is the already-expired hold `MIN_APPROVAL_EXPIRY_SECONDS` exists to
-* prevent.
-*/
-function approvalExpiryHoursOf(seconds) {
-	return Math.max(1, Math.ceil(seconds / SECONDS_PER_HOUR));
-}
+/** The longest window the Platform accepts: one year. */
+const MAX_APPROVAL_EXPIRY_SECONDS = 8760 * SECONDS_PER_HOUR;
 /**
 * The org-level fork switch: the setting an org's trust policy carries for how
 * fork pull requests are treated. Each value names what the operator is
@@ -110,31 +76,14 @@ const CiTrustLevel = z.enum([
 const trustPolicySchema = z.object({
 	forkPolicy: ForkPolicy,
 	/**
-	* Hours a security hold stays open — the coarse spelling of
-	* `approvalExpirySeconds`, kept required so an orchestrator or CLI on an
-	* older build still receives a window it can read. Not deprecated: it is read,
-	* enforced whenever no seconds value accompanies it, and remains the
-	* ergonomic way to say "72 hours".
-	*
-	* Integer and positive: the column is INTEGER NOT NULL, so a fractional value
-	* throws inside the fire-and-forget persist and the policy is then silently
-	* never stored, and a zero or negative value mints an already-expired hold.
-	*/
-	approvalExpiryHours: z.number().int().min(1),
-	/**
-	* Seconds a security hold stays open — the authoritative window, and the one
-	* granularity that can express a sub-hour hold.
+	* Seconds a security hold stays open.
 	*
-	* Optional because an older Platform sends only the hours field; a frame
-	* without it resolves through {@link approvalExpirySecondsOf}, which falls
-	* back to `approvalExpiryHours * SECONDS_PER_HOUR`. When both are present this
-	* one wins, at every layer.
-	*
-	* Integer and at least {@link MIN_APPROVAL_EXPIRY_SECONDS} for the same two
-	* reasons the hours field is: the column is INTEGER, and a non-positive window
+	* Integer and at least {@link MIN_APPROVAL_EXPIRY_SECONDS}: the column is
+	* INTEGER, so a fractional value throws inside the fire-and-forget persist
+	* and the policy is then silently never stored, and a non-positive window
 	* mints an already-expired hold.
 	*/
-	approvalExpirySeconds: z.number().int().min(1).optional()
+	approvalExpirySeconds: z.number().int().min(1)
 }).strict();
 /** Trust policy update pushed from Platform to orchestrator when policy or identity links change. */
 const trustPolicyUpdateSchema = z.object({
@@ -345,12 +294,8 @@ const staleCheckrunCleanupSchema = z.object({
 });
 /**
 * Platform capability advertisement, sent once by the Platform after the
-* orchestrator authenticates. The orchestrator caches it per connection and
-* pre-flight-checks its own feature-gated sends against it, so a self-hosted
-* orchestrator running ahead of the hosted Platform surfaces a diagnosable
-* capability gap instead of firing a frame the Platform would silently drop.
-* Payload is `platformCapabilitiesSchema` (`.passthrough()`, absent =
-* unsupported).
+* orchestrator authenticates. Payload is `platformCapabilitiesSchema`, which
+* defines no flag at protocol 4.
 */
 const platformCapabilitiesMessageSchema = z.object({
 	type: z.literal("platform.capabilities"),
@@ -436,20 +381,16 @@ const planHeadroomSchema = z.object({
 /**
 * Acknowledgment that a webhook was received and processing started.
 *
-* Under the chunked relay protocol the orchestrator also reports the HMAC
-* verification outcome here via `result`, and may include a non-secret-bearing
-* diagnostic in `reason` when result is a rejection. Both fields are optional
-* for backward compatibility during the rollout: pre-cutover senders omit them.
+* The orchestrator reports the HMAC verification outcome via `result`, and may
+* include a non-secret-bearing diagnostic in `reason` when result is a
+* rejection.
 */
 const webhookAckSchema = z.object({
 	type: z.literal("webhook.ack"),
 	messageId: z.string(),
 	deliveryId: z.string(),
-	/**
-	* Verification + processing outcome. Required from the chunked relay path
-	* (commit 3 onwards on the orch side); pre-chunked acks omit this.
-	*/
-	result: WebhookRelayResult.optional(),
+	/** Verification + processing outcome. */
+	result: WebhookRelayResult,
 	/**
 	* Optional non-secret-bearing diagnostic for rejection cases. MUST NOT
 	* include any secret material (HMAC keys, bearer tokens, computed signatures).
@@ -479,11 +420,8 @@ const logChunkSchema = z.object({
 	stepIndex: z.number(),
 	lines: z.array(z.string()),
 	timestamp: z.number(),
-	/**
-	* Which stream these lines came from. Optional for backward compatibility
-	* with orchestrators that do not send it; absent is read as `stdout`.
-	*/
-	stream: LogStream.optional()
+	/** Which stream these lines came from. */
+	stream: LogStream
 });
 /**
 * Phase of an orchestration/provisioning log line. Mirrors the phases the
@@ -620,6 +558,6 @@ const ORCH_TO_PLATFORM_RECOGNIZED_TYPES = new Set(collectDiscriminatorTypes(orch
 */
 const PLATFORM_TO_ORCH_RECOGNIZED_TYPES = new Set(collectDiscriminatorTypes(platformToOrchestratorMessageSchema));
 //#endregion
-export { CLUSTER_MEMBERSHIP_MAX_WORKERS, CiTrustLevel, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_APPROVAL_EXPIRY_SECONDS, ForkPolicy, MAX_APPROVAL_EXPIRY_HOURS, MAX_APPROVAL_EXPIRY_SECONDS, MIN_APPROVAL_EXPIRY_SECONDS, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OrchLogPhase, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, SECONDS_PER_HOUR, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, approvalExpiryHoursOf, approvalExpirySecondsOf, cacheStatsSchema, clusterMembershipSchema, collectDiscriminatorTypes, executionEventSchema, logChunkSchema, orchCapabilitiesUpdateSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, planHeadroomSchema, platformCapabilitiesMessageSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicySchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };
+export { CLUSTER_MEMBERSHIP_MAX_WORKERS, CiTrustLevel, DEFAULT_APPROVAL_EXPIRY_SECONDS, ForkPolicy, MAX_APPROVAL_EXPIRY_SECONDS, MIN_APPROVAL_EXPIRY_SECONDS, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OrchLogPhase, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, SECONDS_PER_HOUR, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, cacheStatsSchema, clusterMembershipSchema, collectDiscriminatorTypes, executionEventSchema, logChunkSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, planHeadroomSchema, platformCapabilitiesMessageSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicySchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };
 
 //# sourceMappingURL=platform-orchestrator.js.map

package/dist/protocol/messages/source-registration.d.ts

@@ -134,19 +134,6 @@ export declare const sourceRegistrationSchema: z.ZodObject<{
     s3LogAccess: z.ZodOptional<z.ZodBoolean>;
     queueTimeoutMs: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
-/**
- * One accepted source in a {@link sourceRegistrationAckSchema}. Carries the
- * public webhook URL the Platform computed for this routing key so the
- * orchestrator (which only knows its org *alias*, never the canonical org id)
- * can surface it to the operator — e.g. `kici-admin source add` printing the
- * URL to paste into a GitHub App. `webhookUrl` is null when the Platform has
- * no public webhook base configured (`config.webhookPublicUrl` unset).
- */
-export declare const acceptedSourceSchema: z.ZodObject<{
-    routingKey: z.ZodString;
-    webhookUrl: z.ZodNullable<z.ZodString>;
-}, z.core.$strip>;
-export type AcceptedSource = z.infer<typeof acceptedSourceSchema>;
 /** Platform acknowledgment of source registration. */
 export declare const sourceRegistrationAckSchema: z.ZodObject<{
     type: z.ZodLiteral<"source.register.ack">;

package/dist/protocol/messages/source-registration.js

@@ -131,30 +131,29 @@ const sourceRegistrationSchema = z.object({
 	* different orchestrator clusters that accidentally share the same
 	* `clusterName` in one org: every coord in an HA cluster shares the
 	* same orch DB and therefore the same `clusterId`, while two unrelated
-	* clusters carry distinct UUIDs. Optional — older orchestrators that
-	* haven't been redeployed yet won't publish it, in which case Platform
-	* skips the cross-cluster collision warn for that connection.
+	* clusters carry distinct UUIDs. Absent when the orchestrator could not
+	* read its cluster id, in which case Platform skips the cross-cluster
+	* collision warn for that connection.
 	*/
 	clusterId: z.string().uuid().optional(),
 	/** Reachable address for peer-to-peer connections (from KICI_CLUSTER_ADDRESS env var). */
 	address: z.string().nullable().optional(),
-	/** Orchestrator version (e.g. "0.0.1"). Optional for backward compatibility with older orchestrators. */
+	/** Orchestrator version (e.g. "0.0.1"). Absent when the orchestrator cannot read its own version. */
 	version: z.string().optional(),
-	/** Orchestrator config mode. Optional for backward compatibility. */
+	/** Orchestrator config mode. */
 	mode: OrchestratorMode.optional(),
 	/** Scaler backends configured on this orchestrator (e.g. ["container", "firecracker"]). */
 	scalerBackends: z.array(z.string()).optional(),
 	/**
 	* How the orchestrator process itself was deployed (systemd/launchd/windows/
 	* compose/unknown), used by the dashboard to build the correct kici-admin
-	* invocation. Optional: older orchestrators that haven't been redeployed don't
-	* publish it, in which case the dashboard treats the shape as `unknown`.
+	* invocation. Absent when the orchestrator cannot detect it, in which case
+	* the dashboard treats the shape as `unknown`.
 	*/
 	deployment: DeploymentIdentitySchema.optional(),
 	/**
 	* Where this orchestrator's own config files live on its host, so the
-	* dashboard can point an operator straight at them. Optional: an
-	* orchestrator that predates the field omits it, and each member is omitted
+	* dashboard can point an operator straight at them. Each member is omitted
 	* independently when that path is not knowable.
 	*/
 	configPaths: ConfigPathsSchema.optional(),
@@ -205,6 +204,6 @@ const sourceDeregisterAckSchema = z.object({
 	removed: z.array(z.string())
 });
 //#endregion
-export { OWN_INGRESS_MODES, OrchestratorMode, PLATFORM_CONNECTED_MODES, RELAY_INGRESS_MODES, SourceProvider, SourceSubtype, acceptedSourceSchema, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema };
+export { OWN_INGRESS_MODES, OrchestratorMode, PLATFORM_CONNECTED_MODES, RELAY_INGRESS_MODES, SourceProvider, SourceSubtype, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema };
 
 //# sourceMappingURL=source-registration.js.map