@kici-dev/engine 0.2.0 → 0.4.0

package/dist/context/index.d.ts

@@ -11,4 +11,5 @@ export type { ResolvedSecretCandidate } from './scope-resolver.js';
 export type { HostFacts } from './host-match.js';
 export { mergeOrderedMaps, ContextGateRejectReason } from './multi-context.js';
 export { validateScopeName, assertValidScopeName, ScopeNameError, SCOPE_SEGMENT_PATTERN, SCOPE_NAME_MAX_LENGTH, } from './scope-name.js';
+export { validateSecretKey, assertValidSecretKey, SecretKeyError, SECRET_KEY_PATTERN, SECRET_KEY_MAX_LENGTH, } from './secret-key.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/context/index.js

@@ -9,4 +9,5 @@ import { DEFAULT_HOLD_EXPIRY_SECONDS } from "./hold-expiry.js";
 import { matchScopePattern, resolveSecretsForContext, resolveSecretsWithProvenance, stripScopePrefix } from "./scope-resolver.js";
 import { ContextGateRejectReason, mergeOrderedMaps } from "./multi-context.js";
 import { SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, ScopeNameError, assertValidScopeName, validateScopeName } from "./scope-name.js";
-export { ConcurrencyStrategy, ContextGateRejectReason, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, HeldRunStatus, HoldType, INSTALL_JOB_ID_PREFIX, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, ScopeNameError, TrustTierSchema, WORKFLOW_MODIFICATION_JOB_ID, assertValidScopeName, installGateJobId, matchScopePattern, mergeOrderedMaps, normalizePersistedHoldType, persistedHoldTypeSpellings, resolveSecretsForContext, resolveSecretsWithProvenance, stripScopePrefix, trustedContributorHoldReason, unknownContributorHoldReason, validateScopeName };
+import { SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SecretKeyError, assertValidSecretKey, validateSecretKey } from "./secret-key.js";
+export { ConcurrencyStrategy, ContextGateRejectReason, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, HeldRunStatus, HoldType, INSTALL_JOB_ID_PREFIX, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, ScopeNameError, SecretKeyError, TrustTierSchema, WORKFLOW_MODIFICATION_JOB_ID, assertValidScopeName, assertValidSecretKey, installGateJobId, matchScopePattern, mergeOrderedMaps, normalizePersistedHoldType, persistedHoldTypeSpellings, resolveSecretsForContext, resolveSecretsWithProvenance, stripScopePrefix, trustedContributorHoldReason, unknownContributorHoldReason, validateScopeName, validateSecretKey };

package/dist/context/secret-key.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Canonical secret-key-name validation, shared by the orchestrator write paths
+ * and the dashboard add-secret form.
+ *
+ * The rule exists to keep the at-rest encryption binding unambiguous. Every
+ * scoped secret is encrypted with AES-GCM under the additional authenticated
+ * data `${orgId}:${scope}:${key}`, which binds a ciphertext to the exact
+ * location it was written to. That binding only holds if the concatenation
+ * decomposes back to one triple: with a `:` allowed inside `key`, the pair
+ * (scope `b`, key `c:d`) and the pair (scope `b:c`, key `d`) render the same
+ * AAD, so a ciphertext written at one location authenticates at the other.
+ *
+ * `validateScopeName` already excludes `:` from every scope segment. Excluding
+ * it from the key as well makes the AAD's tail two colon-free fields, so the
+ * triple is recovered unambiguously by splitting from the right — regardless of
+ * what `orgId` contains. That is why this validator is the other half of the
+ * fix and shares the scope charset rather than defining a looser one.
+ *
+ * The AAD format itself is fixed: the same string decrypts stored values, so
+ * length-prefixing or JSON-encoding it would strand every existing secret.
+ * Constraining the inputs is what keeps the current format unambiguous.
+ *
+ * Enforced on WRITE paths only. Reads, deletes and listings deliberately stay
+ * unvalidated so a key stored before this rule existed remains readable and
+ * deletable — nothing already stored becomes unreachable.
+ *
+ * Kept dependency-free so the engine barrel stays browser-safe.
+ */
+/**
+ * Allowed characters in a secret key. Deliberately identical to
+ * `SCOPE_SEGMENT_PATTERN`: a key is a single segment, so it excludes both the
+ * AAD separator `:` and the scope path separator `/`.
+ */
+export declare const SECRET_KEY_PATTERN: RegExp;
+/** Maximum length of a secret key. */
+export declare const SECRET_KEY_MAX_LENGTH = 256;
+/**
+ * Validate a secret key name. Returns a human-readable error message, or
+ * `null` when the key is valid.
+ */
+export declare function validateSecretKey(key: string): string | null;
+/** Error thrown by {@link assertValidSecretKey} for an invalid secret key. */
+export declare class SecretKeyError extends Error {
+    constructor(message: string);
+}
+/** Throw {@link SecretKeyError} when `key` is not a valid secret key. */
+export declare function assertValidSecretKey(key: string): void;
+//# sourceMappingURL=secret-key.d.ts.map

package/dist/context/secret-key.js

@@ -0,0 +1,64 @@
+import "../rolldown-runtime-ClRpJifh.js";
+//#region src/context/secret-key.ts
+/**
+* Canonical secret-key-name validation, shared by the orchestrator write paths
+* and the dashboard add-secret form.
+*
+* The rule exists to keep the at-rest encryption binding unambiguous. Every
+* scoped secret is encrypted with AES-GCM under the additional authenticated
+* data `${orgId}:${scope}:${key}`, which binds a ciphertext to the exact
+* location it was written to. That binding only holds if the concatenation
+* decomposes back to one triple: with a `:` allowed inside `key`, the pair
+* (scope `b`, key `c:d`) and the pair (scope `b:c`, key `d`) render the same
+* AAD, so a ciphertext written at one location authenticates at the other.
+*
+* `validateScopeName` already excludes `:` from every scope segment. Excluding
+* it from the key as well makes the AAD's tail two colon-free fields, so the
+* triple is recovered unambiguously by splitting from the right — regardless of
+* what `orgId` contains. That is why this validator is the other half of the
+* fix and shares the scope charset rather than defining a looser one.
+*
+* The AAD format itself is fixed: the same string decrypts stored values, so
+* length-prefixing or JSON-encoding it would strand every existing secret.
+* Constraining the inputs is what keeps the current format unambiguous.
+*
+* Enforced on WRITE paths only. Reads, deletes and listings deliberately stay
+* unvalidated so a key stored before this rule existed remains readable and
+* deletable — nothing already stored becomes unreachable.
+*
+* Kept dependency-free so the engine barrel stays browser-safe.
+*/
+/**
+* Allowed characters in a secret key. Deliberately identical to
+* `SCOPE_SEGMENT_PATTERN`: a key is a single segment, so it excludes both the
+* AAD separator `:` and the scope path separator `/`.
+*/
+const SECRET_KEY_PATTERN = /^[A-Za-z0-9._-]+$/;
+/** Maximum length of a secret key. */
+const SECRET_KEY_MAX_LENGTH = 256;
+/**
+* Validate a secret key name. Returns a human-readable error message, or
+* `null` when the key is valid.
+*/
+function validateSecretKey(key) {
+	if (key.length === 0) return "Secret key must not be empty";
+	if (key.length > 256) return `Secret key must be at most 256 characters`;
+	if (!SECRET_KEY_PATTERN.test(key)) return "Secret key may only contain letters, digits, and _ . - characters";
+	return null;
+}
+/** Error thrown by {@link assertValidSecretKey} for an invalid secret key. */
+var SecretKeyError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "SecretKeyError";
+	}
+};
+/** Throw {@link SecretKeyError} when `key` is not a valid secret key. */
+function assertValidSecretKey(key) {
+	const error = validateSecretKey(key);
+	if (error !== null) throw new SecretKeyError(error);
+}
+//#endregion
+export { SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SecretKeyError, assertValidSecretKey, validateSecretKey };
+
+//# sourceMappingURL=secret-key.js.map

package/dist/index.js

@@ -71,6 +71,7 @@ import { DEFAULT_HOLD_EXPIRY_SECONDS } from "./context/hold-expiry.js";
 import { matchScopePattern, resolveSecretsForContext, resolveSecretsWithProvenance, stripScopePrefix } from "./context/scope-resolver.js";
 import { ContextGateRejectReason, mergeOrderedMaps } from "./context/multi-context.js";
 import { SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, ScopeNameError, assertValidScopeName, validateScopeName } from "./context/scope-name.js";
+import { SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SecretKeyError, assertValidSecretKey, validateSecretKey } from "./context/secret-key.js";
 import "./context/index.js";
 import { CAPABILITY_LABEL_PREFIX, HOST_LABEL_PREFIX, INIT_LABEL, KNOWN_ROLES, PLATFORM_TAINT_LABELS, PRIVILEGED_ROOT_LABEL, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, ScalerArch, ScalerOs, agentTypeLabel, capabilityLabel, deriveOsArchLabels, derivePlatformTaints, hostLabel, hostToScalerPlatform, isSelfReportedLabel, mergeAutoLabels, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeRunsOn, parseHostLabel, platformToOsArchLabels, platformToTaints, resolveRoleLabels, scalerAgentLabels, scalerLabel, scalerPlatformSchema, validateNoReservedLabels } from "./labels.js";
 import { parseMemoryString, resourceRequestNestedSchema, resourceSpecSchema, validateResourceRequest } from "./scaler/resource-types.js";
@@ -83,4 +84,4 @@ import { FanoutCause, FanoutError, MAX_FANOUT_JOBS, MAX_MATRIX_MATERIALIZATION,
 import { ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, ArtifactNameSchema, artifactInvalidNameError, checkArtifactName } from "./artifacts/name.js";
 import { PLAN_TYPES, PaidPlanType, PlanType, isPaidTier, planRank } from "./billing/plan-type.js";
 import { INFRA_ALERT_TYPES, InfraAlertSeverity, InfraAlertType, normalizeInfraAlertSeverity } from "./diagnostics/infra-alert.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentFailureCategory, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactNameSchema, ArtifactRejectReason, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CAPABILITY_LABEL_PREFIX, CONTEXTS_MAX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, ConcurrencyStrategy, ContextDeleteErrorCode, ContextGateRejectReason, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DEAD_ORCH_FAILURE_REASON, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DEVELOPER_OPERATIONS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, HEARTBEAT_CLOSE_MS, HEARTBEAT_DEGRADED_MS, HEARTBEAT_FRESH_MS, HEARTBEAT_STALE_THRESHOLD_SECONDS, HEARTBEAT_UNHEALTHY_MARK_MS, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, INFRA_ALERT_TYPES, INIT_LABEL, INSTALL_JOB_ID_PREFIX, InfraAlertSeverity, InfraAlertType, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_LINUX_CAPABILITIES, KNOWN_ROLES, LEGACY_STATUS_ALIASES, LabelMatcher, LockFileParseError, LogStream, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MAX_MATRIX_MATERIALIZATION, MIN_PROTOCOL_VERSION, MatrixShapeError, NACK_EXEMPT_MESSAGE_TYPES, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OWN_INGRESS_MODES, OnUnreachableMode, OrchLogPhase, OrchRole, OrchestratorMode, PING_EVENT_TYPE, PLAN_TYPES, PLATFORM_CAPABILITIES, PLATFORM_CONNECTED_MODES, PLATFORM_TAINT_LABELS, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PaidPlanType, PatKind, PayloadOmittedReason, PlanType, RELAY_INGRESS_MODES, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RegisterableTriggerType, RunFailureClass, RunsOnPick, SANDBOX_DEFAULT_VARS, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_FAILURE_CLASS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, STATUS_PRECEDENCE, SUBSCRIBABLE_WEBHOOK_EVENT_TYPES, ScalerArch, ScalerBackendType, ScalerEventType, ScalerOs, ScopeNameError, SourceOrigin, SourceProvider, SourceSubtype, StatusFailureClass, StepApprovalOutcome, StepConcurrencyKind, SubscribableWebhookEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TRIGGER_TYPE_TO_EVENT_TYPES, TRUSTED_ENV_SCRUB_EXACT, TestRelayType, TimeoutReason, TriggerSource, TrustTierSchema, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WORKFLOW_MODIFICATION_JOB_ID, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookEventType, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentJobResultSchema, agentLabelOf, agentLogChunkSchema, agentMetricsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentRegisterSchema, agentRunListItemSchema, agentRunResultSchema, agentSecretScopeSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, agentWorkflowSummarySchema, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approvalTimeoutSecondsSchema, approveRunToolSchema, approverClauseSchema, artifactInvalidNameError, artifactListItemSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, assertScheduleInputsSatisfiable, assertValidScopeName, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, canonicalizeCapability, capabilityLabel, changedFilesStatusSchema, checkArtifactName, coerceDispatchInputs, coerceHostPropertyValue, collectDiscriminatorTypes, compileRegexMatcher, configAckSchema, connectionHealthStatusSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, derivePlatformTaints, developerOpsForEntrypoint, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogActivityCountsSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, findDuplicateCombination, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getDiagnosticsToolSchema, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubIngressPath, githubWebhookPath, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, installGateJobId, isFailureStatus, isInputSatisfiableFromDefaults, isKnownCapability, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, isPaidTier, isSelfReportedLabel, isTrustedEnvScrubbed, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchTrigger, matchWorkflowTriggers, matchWorkflowsForEvent, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixCombinationCount, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeInfraAlertSeverity, normalizeMatrixInput, normalizePersistedHoldType, normalizeRunsOn, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, persistedHoldTypeSpellings, planRank, platformCapabilitiesMessageSchema, platformCapabilitiesSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, prepareEventBuckets, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rejectRunToolSchema, renderFenced, rerunRunToolSchema, resolveHeldRunId, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForContext, resolveSecretsWithProvenance, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, scalerPlatformSchema, scheduleTriggerKey, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, toCanonicalStatus, triggerRunToolSchema, trustPolicyResponseSchema, trustPolicySchema, trustPolicyUpdateSchema, trustedContributorHoldReason, unknownContributorHoldReason, untrusted, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, validateScopeName, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, workerClusterSettingsSchema, worstStatus, wrapUntrusted };
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentFailureCategory, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactNameSchema, ArtifactRejectReason, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CAPABILITY_LABEL_PREFIX, CONTEXTS_MAX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, ConcurrencyStrategy, ContextDeleteErrorCode, ContextGateRejectReason, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DEAD_ORCH_FAILURE_REASON, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DEVELOPER_OPERATIONS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, HEARTBEAT_CLOSE_MS, HEARTBEAT_DEGRADED_MS, HEARTBEAT_FRESH_MS, HEARTBEAT_STALE_THRESHOLD_SECONDS, HEARTBEAT_UNHEALTHY_MARK_MS, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, INFRA_ALERT_TYPES, INIT_LABEL, INSTALL_JOB_ID_PREFIX, InfraAlertSeverity, InfraAlertType, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_LINUX_CAPABILITIES, KNOWN_ROLES, LEGACY_STATUS_ALIASES, LabelMatcher, LockFileParseError, LogStream, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MAX_MATRIX_MATERIALIZATION, MIN_PROTOCOL_VERSION, MatrixShapeError, NACK_EXEMPT_MESSAGE_TYPES, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OWN_INGRESS_MODES, OnUnreachableMode, OrchLogPhase, OrchRole, OrchestratorMode, PING_EVENT_TYPE, PLAN_TYPES, PLATFORM_CAPABILITIES, PLATFORM_CONNECTED_MODES, PLATFORM_TAINT_LABELS, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PaidPlanType, PatKind, PayloadOmittedReason, PlanType, RELAY_INGRESS_MODES, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RegisterableTriggerType, RunFailureClass, RunsOnPick, SANDBOX_DEFAULT_VARS, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_FAILURE_CLASS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, STATUS_PRECEDENCE, SUBSCRIBABLE_WEBHOOK_EVENT_TYPES, ScalerArch, ScalerBackendType, ScalerEventType, ScalerOs, ScopeNameError, SecretKeyError, SourceOrigin, SourceProvider, SourceSubtype, StatusFailureClass, StepApprovalOutcome, StepConcurrencyKind, SubscribableWebhookEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TRIGGER_TYPE_TO_EVENT_TYPES, TRUSTED_ENV_SCRUB_EXACT, TestRelayType, TimeoutReason, TriggerSource, TrustTierSchema, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WORKFLOW_MODIFICATION_JOB_ID, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookEventType, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentJobResultSchema, agentLabelOf, agentLogChunkSchema, agentMetricsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentRegisterSchema, agentRunListItemSchema, agentRunResultSchema, agentSecretScopeSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, agentWorkflowSummarySchema, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approvalTimeoutSecondsSchema, approveRunToolSchema, approverClauseSchema, artifactInvalidNameError, artifactListItemSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, assertScheduleInputsSatisfiable, assertValidScopeName, assertValidSecretKey, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, canonicalizeCapability, capabilityLabel, changedFilesStatusSchema, checkArtifactName, coerceDispatchInputs, coerceHostPropertyValue, collectDiscriminatorTypes, compileRegexMatcher, configAckSchema, connectionHealthStatusSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, derivePlatformTaints, developerOpsForEntrypoint, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogActivityCountsSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, findDuplicateCombination, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getDiagnosticsToolSchema, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubIngressPath, githubWebhookPath, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, installGateJobId, isFailureStatus, isInputSatisfiableFromDefaults, isKnownCapability, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, isPaidTier, isSelfReportedLabel, isTrustedEnvScrubbed, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchTrigger, matchWorkflowTriggers, matchWorkflowsForEvent, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixCombinationCount, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeInfraAlertSeverity, normalizeMatrixInput, normalizePersistedHoldType, normalizeRunsOn, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, persistedHoldTypeSpellings, planRank, platformCapabilitiesMessageSchema, platformCapabilitiesSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, prepareEventBuckets, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rejectRunToolSchema, renderFenced, rerunRunToolSchema, resolveHeldRunId, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForContext, resolveSecretsWithProvenance, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, scalerPlatformSchema, scheduleTriggerKey, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, toCanonicalStatus, triggerRunToolSchema, trustPolicyResponseSchema, trustPolicySchema, trustPolicyUpdateSchema, trustedContributorHoldReason, unknownContributorHoldReason, untrusted, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, validateScopeName, validateSecretKey, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, workerClusterSettingsSchema, worstStatus, wrapUntrusted };

package/dist/metrics/metric-catalog.generated.d.ts

@@ -93,6 +93,7 @@ export declare const MetricNames: {
     readonly KICI_ORCH_TRIGGER_MATCH_DURATION_SECONDS: 'kici_orch_trigger_match_duration_seconds';
     readonly KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: 'kici_orch_trust_match_refused_no_id_total';
     readonly KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: 'kici_orch_trust_policy_decisions_total';
+    readonly KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: 'kici_orch_unroutable_fast_failed_total';
     readonly KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: 'kici_orch_webhooks_processed_total';
     readonly KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: 'kici_orch_webhooks_received_total';
     readonly KICI_ORCH_WS_NACK_RECEIVED_TOTAL: 'kici_orch_ws_nack_received_total';
@@ -294,6 +295,7 @@ export declare const MetricLabels: {
     readonly KICI_ORCH_TRIGGER_MATCH_DURATION_SECONDS: readonly [];
     readonly KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: readonly ['reason'];
     readonly KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: readonly ['arm', 'action'];
+    readonly KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: readonly [];
     readonly KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: readonly ['result'];
     readonly KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: readonly ['source', 'event'];
     readonly KICI_ORCH_WS_NACK_RECEIVED_TOTAL: readonly [];
@@ -494,6 +496,7 @@ export declare const MetricKind: {
     readonly KICI_ORCH_TRIGGER_MATCH_DURATION_SECONDS: 'histogram';
     readonly KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: 'counter';
     readonly KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: 'counter';
+    readonly KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: 'counter';
     readonly KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: 'counter';
     readonly KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: 'counter';
     readonly KICI_ORCH_WS_NACK_RECEIVED_TOTAL: 'counter';
@@ -694,6 +697,7 @@ export declare const MetricDescription: {
     readonly KICI_ORCH_TRIGGER_MATCH_DURATION_SECONDS: 'Duration of trigger matching operations in seconds';
     readonly KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: 'Trust-resolution attempts refused because the provider numeric id was missing or did not match';
     readonly KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: 'Total org trust-policy gate decisions by arm and action';
+    readonly KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: 'Jobs terminalized as unroutable by the fast-fail probe (not the queue timeout)';
     readonly KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: 'Total number of webhooks processed';
     readonly KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: 'Total number of webhooks received';
     readonly KICI_ORCH_WS_NACK_RECEIVED_TOTAL: 'NACKs received from the Platform for a message it could not process (version skew)';
@@ -901,6 +905,7 @@ export declare const MetricService: {
     readonly KICI_ORCH_TRIGGER_MATCH_DURATION_SECONDS: 'orchestrator';
     readonly KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: 'orchestrator';
     readonly KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: 'orchestrator';
+    readonly KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: 'orchestrator';
     readonly KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: 'orchestrator';
     readonly KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: 'orchestrator';
     readonly KICI_ORCH_WS_NACK_RECEIVED_TOTAL: 'orchestrator';

package/dist/metrics/metric-catalog.generated.js

@@ -95,6 +95,7 @@ const MetricNames = {
 	KICI_ORCH_TRIGGER_MATCH_DURATION_SECONDS: "kici_orch_trigger_match_duration_seconds",
 	KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: "kici_orch_trust_match_refused_no_id_total",
 	KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: "kici_orch_trust_policy_decisions_total",
+	KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: "kici_orch_unroutable_fast_failed_total",
 	KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: "kici_orch_webhooks_processed_total",
 	KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: "kici_orch_webhooks_received_total",
 	KICI_ORCH_WS_NACK_RECEIVED_TOTAL: "kici_orch_ws_nack_received_total",
@@ -307,6 +308,7 @@ const MetricLabels = {
 	KICI_ORCH_TRIGGER_MATCH_DURATION_SECONDS: [],
 	KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: ["reason"],
 	KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: ["arm", "action"],
+	KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: [],
 	KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: ["result"],
 	KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: ["source", "event"],
 	KICI_ORCH_WS_NACK_RECEIVED_TOTAL: [],
@@ -511,6 +513,7 @@ const MetricKind = {
 	KICI_ORCH_TRIGGER_MATCH_DURATION_SECONDS: "histogram",
 	KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: "counter",
 	KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: "counter",
+	KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: "counter",
 	KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: "counter",
 	KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: "counter",
 	KICI_ORCH_WS_NACK_RECEIVED_TOTAL: "counter",
@@ -711,6 +714,7 @@ const MetricDescription = {
 	KICI_ORCH_TRIGGER_MATCH_DURATION_SECONDS: "Duration of trigger matching operations in seconds",
 	KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: "Trust-resolution attempts refused because the provider numeric id was missing or did not match",
 	KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: "Total org trust-policy gate decisions by arm and action",
+	KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: "Jobs terminalized as unroutable by the fast-fail probe (not the queue timeout)",
 	KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: "Total number of webhooks processed",
 	KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: "Total number of webhooks received",
 	KICI_ORCH_WS_NACK_RECEIVED_TOTAL: "NACKs received from the Platform for a message it could not process (version skew)",
@@ -918,6 +922,7 @@ const MetricService = {
 	KICI_ORCH_TRIGGER_MATCH_DURATION_SECONDS: "orchestrator",
 	KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: "orchestrator",
 	KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: "orchestrator",
+	KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: "orchestrator",
 	KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: "orchestrator",
 	KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: "orchestrator",
 	KICI_ORCH_WS_NACK_RECEIVED_TOTAL: "orchestrator",
@@ -1119,6 +1124,7 @@ const ALL_METRIC_NAMES = [
 	"kici_orch_trigger_match_duration_seconds",
 	"kici_orch_trust_match_refused_no_id_total",
 	"kici_orch_trust_policy_decisions_total",
+	"kici_orch_unroutable_fast_failed_total",
 	"kici_orch_webhooks_processed_total",
 	"kici_orch_webhooks_received_total",
 	"kici_orch_ws_nack_received_total",

package/dist/protocol/messages/dashboard.d.ts

@@ -386,6 +386,7 @@ export declare const dashboardJobDetailSchema: z.ZodObject<{
     agentId: z.ZodNullable<z.ZodString>;
     orchestratorId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     errorMessage: z.ZodNullable<z.ZodString>;
+    routingReason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     runsOnLabels: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
     contexts: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
     skippedContexts: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
@@ -475,6 +476,7 @@ export declare const dashboardRunDetailResponseSchema: z.ZodObject<{
         agentId: z.ZodNullable<z.ZodString>;
         orchestratorId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         errorMessage: z.ZodNullable<z.ZodString>;
+        routingReason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         runsOnLabels: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
         contexts: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
         skippedContexts: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
@@ -7005,6 +7007,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
         agentId: z.ZodNullable<z.ZodString>;
         orchestratorId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         errorMessage: z.ZodNullable<z.ZodString>;
+        routingReason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         runsOnLabels: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
         contexts: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
         skippedContexts: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
@@ -8638,6 +8641,7 @@ export declare const dashboardRunDetailApiResponseSchema: z.ZodObject<{
         agentId: z.ZodNullable<z.ZodString>;
         orchestratorId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         errorMessage: z.ZodNullable<z.ZodString>;
+        routingReason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         runsOnLabels: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
         contexts: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
         skippedContexts: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;

package/dist/protocol/messages/dashboard.js

@@ -132,6 +132,16 @@ const dashboardJobDetailSchema = z.object({
 	agentId: z.string().nullable(),
 	orchestratorId: z.string().nullable().optional(),
 	errorMessage: z.string().nullable(),
+	/**
+	* Why this job cannot currently be routed to any agent, present only while it
+	* is still queued and nothing in the fleet matches its `runsOn`; cleared once
+	* a matching agent or scaler backend appears.
+	*
+	* OPTIONAL, and must stay optional: the wire protocol is compatibility-
+	* protected, so an orchestrator that predates the unroutable probe simply
+	* omits it.
+	*/
+	routingReason: z.string().nullable().optional(),
 	/** Labels used for agent routing (e.g. ["kici:os:linux", "kici:arch:x64"]). */
 	runsOnLabels: z.array(z.string()).nullable().optional(),
 	/**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/engine",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
   "keywords": [
     "ci",

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/engine@0.2.0",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.2.0/542cdb3d-4979-42ab-ac13-1e4b9c793893",
+  "name": "@kici-dev/engine@0.4.0",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.4.0/9e27a29f-2dd8-4cc5-9c0f-4e6591fd02e7",
   "creationInfo": {
-    "created": "2026-08-08T04:27:05Z",
+    "created": "2026-08-09T16:02:43Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -54,7 +54,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.2.0",
+      "versionInfo": "0.4.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -65,7 +65,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.2.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.4.0"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",