@kici-dev/engine 0.3.0 → 0.4.0

package/dist/context/index.d.ts

@@ -11,4 +11,5 @@ export type { ResolvedSecretCandidate } from './scope-resolver.js';
 export type { HostFacts } from './host-match.js';
 export { mergeOrderedMaps, ContextGateRejectReason } from './multi-context.js';
 export { validateScopeName, assertValidScopeName, ScopeNameError, SCOPE_SEGMENT_PATTERN, SCOPE_NAME_MAX_LENGTH, } from './scope-name.js';
+export { validateSecretKey, assertValidSecretKey, SecretKeyError, SECRET_KEY_PATTERN, SECRET_KEY_MAX_LENGTH, } from './secret-key.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/context/index.js

@@ -9,4 +9,5 @@ import { DEFAULT_HOLD_EXPIRY_SECONDS } from "./hold-expiry.js";
 import { matchScopePattern, resolveSecretsForContext, resolveSecretsWithProvenance, stripScopePrefix } from "./scope-resolver.js";
 import { ContextGateRejectReason, mergeOrderedMaps } from "./multi-context.js";
 import { SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, ScopeNameError, assertValidScopeName, validateScopeName } from "./scope-name.js";
-export { ConcurrencyStrategy, ContextGateRejectReason, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, HeldRunStatus, HoldType, INSTALL_JOB_ID_PREFIX, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, ScopeNameError, TrustTierSchema, WORKFLOW_MODIFICATION_JOB_ID, assertValidScopeName, installGateJobId, matchScopePattern, mergeOrderedMaps, normalizePersistedHoldType, persistedHoldTypeSpellings, resolveSecretsForContext, resolveSecretsWithProvenance, stripScopePrefix, trustedContributorHoldReason, unknownContributorHoldReason, validateScopeName };
+import { SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SecretKeyError, assertValidSecretKey, validateSecretKey } from "./secret-key.js";
+export { ConcurrencyStrategy, ContextGateRejectReason, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, HeldRunStatus, HoldType, INSTALL_JOB_ID_PREFIX, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, ScopeNameError, SecretKeyError, TrustTierSchema, WORKFLOW_MODIFICATION_JOB_ID, assertValidScopeName, assertValidSecretKey, installGateJobId, matchScopePattern, mergeOrderedMaps, normalizePersistedHoldType, persistedHoldTypeSpellings, resolveSecretsForContext, resolveSecretsWithProvenance, stripScopePrefix, trustedContributorHoldReason, unknownContributorHoldReason, validateScopeName, validateSecretKey };

package/dist/context/secret-key.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Canonical secret-key-name validation, shared by the orchestrator write paths
+ * and the dashboard add-secret form.
+ *
+ * The rule exists to keep the at-rest encryption binding unambiguous. Every
+ * scoped secret is encrypted with AES-GCM under the additional authenticated
+ * data `${orgId}:${scope}:${key}`, which binds a ciphertext to the exact
+ * location it was written to. That binding only holds if the concatenation
+ * decomposes back to one triple: with a `:` allowed inside `key`, the pair
+ * (scope `b`, key `c:d`) and the pair (scope `b:c`, key `d`) render the same
+ * AAD, so a ciphertext written at one location authenticates at the other.
+ *
+ * `validateScopeName` already excludes `:` from every scope segment. Excluding
+ * it from the key as well makes the AAD's tail two colon-free fields, so the
+ * triple is recovered unambiguously by splitting from the right — regardless of
+ * what `orgId` contains. That is why this validator is the other half of the
+ * fix and shares the scope charset rather than defining a looser one.
+ *
+ * The AAD format itself is fixed: the same string decrypts stored values, so
+ * length-prefixing or JSON-encoding it would strand every existing secret.
+ * Constraining the inputs is what keeps the current format unambiguous.
+ *
+ * Enforced on WRITE paths only. Reads, deletes and listings deliberately stay
+ * unvalidated so a key stored before this rule existed remains readable and
+ * deletable — nothing already stored becomes unreachable.
+ *
+ * Kept dependency-free so the engine barrel stays browser-safe.
+ */
+/**
+ * Allowed characters in a secret key. Deliberately identical to
+ * `SCOPE_SEGMENT_PATTERN`: a key is a single segment, so it excludes both the
+ * AAD separator `:` and the scope path separator `/`.
+ */
+export declare const SECRET_KEY_PATTERN: RegExp;
+/** Maximum length of a secret key. */
+export declare const SECRET_KEY_MAX_LENGTH = 256;
+/**
+ * Validate a secret key name. Returns a human-readable error message, or
+ * `null` when the key is valid.
+ */
+export declare function validateSecretKey(key: string): string | null;
+/** Error thrown by {@link assertValidSecretKey} for an invalid secret key. */
+export declare class SecretKeyError extends Error {
+    constructor(message: string);
+}
+/** Throw {@link SecretKeyError} when `key` is not a valid secret key. */
+export declare function assertValidSecretKey(key: string): void;
+//# sourceMappingURL=secret-key.d.ts.map

package/dist/context/secret-key.js

@@ -0,0 +1,64 @@
+import "../rolldown-runtime-ClRpJifh.js";
+//#region src/context/secret-key.ts
+/**
+* Canonical secret-key-name validation, shared by the orchestrator write paths
+* and the dashboard add-secret form.
+*
+* The rule exists to keep the at-rest encryption binding unambiguous. Every
+* scoped secret is encrypted with AES-GCM under the additional authenticated
+* data `${orgId}:${scope}:${key}`, which binds a ciphertext to the exact
+* location it was written to. That binding only holds if the concatenation
+* decomposes back to one triple: with a `:` allowed inside `key`, the pair
+* (scope `b`, key `c:d`) and the pair (scope `b:c`, key `d`) render the same
+* AAD, so a ciphertext written at one location authenticates at the other.
+*
+* `validateScopeName` already excludes `:` from every scope segment. Excluding
+* it from the key as well makes the AAD's tail two colon-free fields, so the
+* triple is recovered unambiguously by splitting from the right — regardless of
+* what `orgId` contains. That is why this validator is the other half of the
+* fix and shares the scope charset rather than defining a looser one.
+*
+* The AAD format itself is fixed: the same string decrypts stored values, so
+* length-prefixing or JSON-encoding it would strand every existing secret.
+* Constraining the inputs is what keeps the current format unambiguous.
+*
+* Enforced on WRITE paths only. Reads, deletes and listings deliberately stay
+* unvalidated so a key stored before this rule existed remains readable and
+* deletable — nothing already stored becomes unreachable.
+*
+* Kept dependency-free so the engine barrel stays browser-safe.
+*/
+/**
+* Allowed characters in a secret key. Deliberately identical to
+* `SCOPE_SEGMENT_PATTERN`: a key is a single segment, so it excludes both the
+* AAD separator `:` and the scope path separator `/`.
+*/
+const SECRET_KEY_PATTERN = /^[A-Za-z0-9._-]+$/;
+/** Maximum length of a secret key. */
+const SECRET_KEY_MAX_LENGTH = 256;
+/**
+* Validate a secret key name. Returns a human-readable error message, or
+* `null` when the key is valid.
+*/
+function validateSecretKey(key) {
+	if (key.length === 0) return "Secret key must not be empty";
+	if (key.length > 256) return `Secret key must be at most 256 characters`;
+	if (!SECRET_KEY_PATTERN.test(key)) return "Secret key may only contain letters, digits, and _ . - characters";
+	return null;
+}
+/** Error thrown by {@link assertValidSecretKey} for an invalid secret key. */
+var SecretKeyError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "SecretKeyError";
+	}
+};
+/** Throw {@link SecretKeyError} when `key` is not a valid secret key. */
+function assertValidSecretKey(key) {
+	const error = validateSecretKey(key);
+	if (error !== null) throw new SecretKeyError(error);
+}
+//#endregion
+export { SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SecretKeyError, assertValidSecretKey, validateSecretKey };
+
+//# sourceMappingURL=secret-key.js.map

package/dist/index.js

@@ -71,6 +71,7 @@ import { DEFAULT_HOLD_EXPIRY_SECONDS } from "./context/hold-expiry.js";
 import { matchScopePattern, resolveSecretsForContext, resolveSecretsWithProvenance, stripScopePrefix } from "./context/scope-resolver.js";
 import { ContextGateRejectReason, mergeOrderedMaps } from "./context/multi-context.js";
 import { SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, ScopeNameError, assertValidScopeName, validateScopeName } from "./context/scope-name.js";
+import { SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SecretKeyError, assertValidSecretKey, validateSecretKey } from "./context/secret-key.js";
 import "./context/index.js";
 import { CAPABILITY_LABEL_PREFIX, HOST_LABEL_PREFIX, INIT_LABEL, KNOWN_ROLES, PLATFORM_TAINT_LABELS, PRIVILEGED_ROOT_LABEL, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, ScalerArch, ScalerOs, agentTypeLabel, capabilityLabel, deriveOsArchLabels, derivePlatformTaints, hostLabel, hostToScalerPlatform, isSelfReportedLabel, mergeAutoLabels, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeRunsOn, parseHostLabel, platformToOsArchLabels, platformToTaints, resolveRoleLabels, scalerAgentLabels, scalerLabel, scalerPlatformSchema, validateNoReservedLabels } from "./labels.js";
 import { parseMemoryString, resourceRequestNestedSchema, resourceSpecSchema, validateResourceRequest } from "./scaler/resource-types.js";
@@ -83,4 +84,4 @@ import { FanoutCause, FanoutError, MAX_FANOUT_JOBS, MAX_MATRIX_MATERIALIZATION,
 import { ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, ArtifactNameSchema, artifactInvalidNameError, checkArtifactName } from "./artifacts/name.js";
 import { PLAN_TYPES, PaidPlanType, PlanType, isPaidTier, planRank } from "./billing/plan-type.js";
 import { INFRA_ALERT_TYPES, InfraAlertSeverity, InfraAlertType, normalizeInfraAlertSeverity } from "./diagnostics/infra-alert.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentFailureCategory, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactNameSchema, ArtifactRejectReason, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CAPABILITY_LABEL_PREFIX, CONTEXTS_MAX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, ConcurrencyStrategy, ContextDeleteErrorCode, ContextGateRejectReason, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DEAD_ORCH_FAILURE_REASON, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DEVELOPER_OPERATIONS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, HEARTBEAT_CLOSE_MS, HEARTBEAT_DEGRADED_MS, HEARTBEAT_FRESH_MS, HEARTBEAT_STALE_THRESHOLD_SECONDS, HEARTBEAT_UNHEALTHY_MARK_MS, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, INFRA_ALERT_TYPES, INIT_LABEL, INSTALL_JOB_ID_PREFIX, InfraAlertSeverity, InfraAlertType, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_LINUX_CAPABILITIES, KNOWN_ROLES, LEGACY_STATUS_ALIASES, LabelMatcher, LockFileParseError, LogStream, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MAX_MATRIX_MATERIALIZATION, MIN_PROTOCOL_VERSION, MatrixShapeError, NACK_EXEMPT_MESSAGE_TYPES, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OWN_INGRESS_MODES, OnUnreachableMode, OrchLogPhase, OrchRole, OrchestratorMode, PING_EVENT_TYPE, PLAN_TYPES, PLATFORM_CAPABILITIES, PLATFORM_CONNECTED_MODES, PLATFORM_TAINT_LABELS, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PaidPlanType, PatKind, PayloadOmittedReason, PlanType, RELAY_INGRESS_MODES, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RegisterableTriggerType, RunFailureClass, RunsOnPick, SANDBOX_DEFAULT_VARS, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_FAILURE_CLASS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, STATUS_PRECEDENCE, SUBSCRIBABLE_WEBHOOK_EVENT_TYPES, ScalerArch, ScalerBackendType, ScalerEventType, ScalerOs, ScopeNameError, SourceOrigin, SourceProvider, SourceSubtype, StatusFailureClass, StepApprovalOutcome, StepConcurrencyKind, SubscribableWebhookEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TRIGGER_TYPE_TO_EVENT_TYPES, TRUSTED_ENV_SCRUB_EXACT, TestRelayType, TimeoutReason, TriggerSource, TrustTierSchema, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WORKFLOW_MODIFICATION_JOB_ID, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookEventType, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentJobResultSchema, agentLabelOf, agentLogChunkSchema, agentMetricsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentRegisterSchema, agentRunListItemSchema, agentRunResultSchema, agentSecretScopeSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, agentWorkflowSummarySchema, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approvalTimeoutSecondsSchema, approveRunToolSchema, approverClauseSchema, artifactInvalidNameError, artifactListItemSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, assertScheduleInputsSatisfiable, assertValidScopeName, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, canonicalizeCapability, capabilityLabel, changedFilesStatusSchema, checkArtifactName, coerceDispatchInputs, coerceHostPropertyValue, collectDiscriminatorTypes, compileRegexMatcher, configAckSchema, connectionHealthStatusSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, derivePlatformTaints, developerOpsForEntrypoint, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogActivityCountsSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, findDuplicateCombination, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getDiagnosticsToolSchema, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubIngressPath, githubWebhookPath, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, installGateJobId, isFailureStatus, isInputSatisfiableFromDefaults, isKnownCapability, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, isPaidTier, isSelfReportedLabel, isTrustedEnvScrubbed, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchTrigger, matchWorkflowTriggers, matchWorkflowsForEvent, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixCombinationCount, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeInfraAlertSeverity, normalizeMatrixInput, normalizePersistedHoldType, normalizeRunsOn, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, persistedHoldTypeSpellings, planRank, platformCapabilitiesMessageSchema, platformCapabilitiesSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, prepareEventBuckets, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rejectRunToolSchema, renderFenced, rerunRunToolSchema, resolveHeldRunId, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForContext, resolveSecretsWithProvenance, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, scalerPlatformSchema, scheduleTriggerKey, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, toCanonicalStatus, triggerRunToolSchema, trustPolicyResponseSchema, trustPolicySchema, trustPolicyUpdateSchema, trustedContributorHoldReason, unknownContributorHoldReason, untrusted, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, validateScopeName, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, workerClusterSettingsSchema, worstStatus, wrapUntrusted };
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentFailureCategory, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactNameSchema, ArtifactRejectReason, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CAPABILITY_LABEL_PREFIX, CONTEXTS_MAX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, ConcurrencyStrategy, ContextDeleteErrorCode, ContextGateRejectReason, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DEAD_ORCH_FAILURE_REASON, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DEVELOPER_OPERATIONS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, HEARTBEAT_CLOSE_MS, HEARTBEAT_DEGRADED_MS, HEARTBEAT_FRESH_MS, HEARTBEAT_STALE_THRESHOLD_SECONDS, HEARTBEAT_UNHEALTHY_MARK_MS, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, INFRA_ALERT_TYPES, INIT_LABEL, INSTALL_JOB_ID_PREFIX, InfraAlertSeverity, InfraAlertType, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_LINUX_CAPABILITIES, KNOWN_ROLES, LEGACY_STATUS_ALIASES, LabelMatcher, LockFileParseError, LogStream, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MAX_MATRIX_MATERIALIZATION, MIN_PROTOCOL_VERSION, MatrixShapeError, NACK_EXEMPT_MESSAGE_TYPES, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OWN_INGRESS_MODES, OnUnreachableMode, OrchLogPhase, OrchRole, OrchestratorMode, PING_EVENT_TYPE, PLAN_TYPES, PLATFORM_CAPABILITIES, PLATFORM_CONNECTED_MODES, PLATFORM_TAINT_LABELS, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PaidPlanType, PatKind, PayloadOmittedReason, PlanType, RELAY_INGRESS_MODES, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RegisterableTriggerType, RunFailureClass, RunsOnPick, SANDBOX_DEFAULT_VARS, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_FAILURE_CLASS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, STATUS_PRECEDENCE, SUBSCRIBABLE_WEBHOOK_EVENT_TYPES, ScalerArch, ScalerBackendType, ScalerEventType, ScalerOs, ScopeNameError, SecretKeyError, SourceOrigin, SourceProvider, SourceSubtype, StatusFailureClass, StepApprovalOutcome, StepConcurrencyKind, SubscribableWebhookEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TRIGGER_TYPE_TO_EVENT_TYPES, TRUSTED_ENV_SCRUB_EXACT, TestRelayType, TimeoutReason, TriggerSource, TrustTierSchema, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WORKFLOW_MODIFICATION_JOB_ID, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookEventType, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentJobResultSchema, agentLabelOf, agentLogChunkSchema, agentMetricsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentRegisterSchema, agentRunListItemSchema, agentRunResultSchema, agentSecretScopeSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, agentWorkflowSummarySchema, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approvalTimeoutSecondsSchema, approveRunToolSchema, approverClauseSchema, artifactInvalidNameError, artifactListItemSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, assertScheduleInputsSatisfiable, assertValidScopeName, assertValidSecretKey, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, canonicalizeCapability, capabilityLabel, changedFilesStatusSchema, checkArtifactName, coerceDispatchInputs, coerceHostPropertyValue, collectDiscriminatorTypes, compileRegexMatcher, configAckSchema, connectionHealthStatusSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, derivePlatformTaints, developerOpsForEntrypoint, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogActivityCountsSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, findDuplicateCombination, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getDiagnosticsToolSchema, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubIngressPath, githubWebhookPath, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, installGateJobId, isFailureStatus, isInputSatisfiableFromDefaults, isKnownCapability, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, isPaidTier, isSelfReportedLabel, isTrustedEnvScrubbed, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchTrigger, matchWorkflowTriggers, matchWorkflowsForEvent, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixCombinationCount, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeInfraAlertSeverity, normalizeMatrixInput, normalizePersistedHoldType, normalizeRunsOn, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, persistedHoldTypeSpellings, planRank, platformCapabilitiesMessageSchema, platformCapabilitiesSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, prepareEventBuckets, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rejectRunToolSchema, renderFenced, rerunRunToolSchema, resolveHeldRunId, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForContext, resolveSecretsWithProvenance, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, scalerPlatformSchema, scheduleTriggerKey, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, toCanonicalStatus, triggerRunToolSchema, trustPolicyResponseSchema, trustPolicySchema, trustPolicyUpdateSchema, trustedContributorHoldReason, unknownContributorHoldReason, untrusted, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, validateScopeName, validateSecretKey, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, workerClusterSettingsSchema, worstStatus, wrapUntrusted };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/engine",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
   "keywords": [
     "ci",

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/engine@0.3.0",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.3.0/efa4dc6e-9041-4801-bb71-cb5f0e5d0cc2",
+  "name": "@kici-dev/engine@0.4.0",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.4.0/9e27a29f-2dd8-4cc5-9c0f-4e6591fd02e7",
   "creationInfo": {
-    "created": "2026-08-09T01:30:10Z",
+    "created": "2026-08-09T16:02:43Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -54,7 +54,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.3.0",
+      "versionInfo": "0.4.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -65,7 +65,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.3.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.4.0"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",