@kici-dev/engine 0.3.0 → 0.5.0

package/dist/context/host-match.js

@@ -1,6 +1,7 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import { matcherMatches } from "../labels-match.js";
-import { assertSafeRegex, toLabelMatcher } from "../labels/compile.js";
+import { assertSafeRegex } from "../safe-regex.js";
+import { toLabelMatcher } from "../labels/compile.js";
 //#region src/context/host-match.ts
 /** `'**'`, empty, or absent means "matches every host". */
 function matchesAllHosts(pattern) {

package/dist/context/index.d.ts

@@ -11,4 +11,5 @@ export type { ResolvedSecretCandidate } from './scope-resolver.js';
 export type { HostFacts } from './host-match.js';
 export { mergeOrderedMaps, ContextGateRejectReason } from './multi-context.js';
 export { validateScopeName, assertValidScopeName, ScopeNameError, SCOPE_SEGMENT_PATTERN, SCOPE_NAME_MAX_LENGTH, } from './scope-name.js';
+export { validateSecretKey, assertValidSecretKey, SecretKeyError, SECRET_KEY_PATTERN, SECRET_KEY_MAX_LENGTH, } from './secret-key.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/context/index.js

@@ -9,4 +9,5 @@ import { DEFAULT_HOLD_EXPIRY_SECONDS } from "./hold-expiry.js";
 import { matchScopePattern, resolveSecretsForContext, resolveSecretsWithProvenance, stripScopePrefix } from "./scope-resolver.js";
 import { ContextGateRejectReason, mergeOrderedMaps } from "./multi-context.js";
 import { SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, ScopeNameError, assertValidScopeName, validateScopeName } from "./scope-name.js";
-export { ConcurrencyStrategy, ContextGateRejectReason, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, HeldRunStatus, HoldType, INSTALL_JOB_ID_PREFIX, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, ScopeNameError, TrustTierSchema, WORKFLOW_MODIFICATION_JOB_ID, assertValidScopeName, installGateJobId, matchScopePattern, mergeOrderedMaps, normalizePersistedHoldType, persistedHoldTypeSpellings, resolveSecretsForContext, resolveSecretsWithProvenance, stripScopePrefix, trustedContributorHoldReason, unknownContributorHoldReason, validateScopeName };
+import { SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SecretKeyError, assertValidSecretKey, validateSecretKey } from "./secret-key.js";
+export { ConcurrencyStrategy, ContextGateRejectReason, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, HeldRunStatus, HoldType, INSTALL_JOB_ID_PREFIX, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, ScopeNameError, SecretKeyError, TrustTierSchema, WORKFLOW_MODIFICATION_JOB_ID, assertValidScopeName, assertValidSecretKey, installGateJobId, matchScopePattern, mergeOrderedMaps, normalizePersistedHoldType, persistedHoldTypeSpellings, resolveSecretsForContext, resolveSecretsWithProvenance, stripScopePrefix, trustedContributorHoldReason, unknownContributorHoldReason, validateScopeName, validateSecretKey };

package/dist/context/secret-key.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Canonical secret-key-name validation, shared by the orchestrator write paths
+ * and the dashboard add-secret form.
+ *
+ * The rule exists to keep the at-rest encryption binding unambiguous. Every
+ * scoped secret is encrypted with AES-GCM under the additional authenticated
+ * data `${orgId}:${scope}:${key}`, which binds a ciphertext to the exact
+ * location it was written to. That binding only holds if the concatenation
+ * decomposes back to one triple: with a `:` allowed inside `key`, the pair
+ * (scope `b`, key `c:d`) and the pair (scope `b:c`, key `d`) render the same
+ * AAD, so a ciphertext written at one location authenticates at the other.
+ *
+ * `validateScopeName` already excludes `:` from every scope segment. Excluding
+ * it from the key as well makes the AAD's tail two colon-free fields, so the
+ * triple is recovered unambiguously by splitting from the right — regardless of
+ * what `orgId` contains. That is why this validator is the other half of the
+ * fix and shares the scope charset rather than defining a looser one.
+ *
+ * The AAD format itself is fixed: the same string decrypts stored values, so
+ * length-prefixing or JSON-encoding it would strand every existing secret.
+ * Constraining the inputs is what keeps the current format unambiguous.
+ *
+ * Enforced on WRITE paths only. Reads, deletes and listings deliberately stay
+ * unvalidated so a key stored before this rule existed remains readable and
+ * deletable — nothing already stored becomes unreachable.
+ *
+ * Kept dependency-free so the engine barrel stays browser-safe.
+ */
+/**
+ * Allowed characters in a secret key. Deliberately identical to
+ * `SCOPE_SEGMENT_PATTERN`: a key is a single segment, so it excludes both the
+ * AAD separator `:` and the scope path separator `/`.
+ */
+export declare const SECRET_KEY_PATTERN: RegExp;
+/** Maximum length of a secret key. */
+export declare const SECRET_KEY_MAX_LENGTH = 256;
+/**
+ * Validate a secret key name. Returns a human-readable error message, or
+ * `null` when the key is valid.
+ */
+export declare function validateSecretKey(key: string): string | null;
+/** Error thrown by {@link assertValidSecretKey} for an invalid secret key. */
+export declare class SecretKeyError extends Error {
+    constructor(message: string);
+}
+/** Throw {@link SecretKeyError} when `key` is not a valid secret key. */
+export declare function assertValidSecretKey(key: string): void;
+//# sourceMappingURL=secret-key.d.ts.map

package/dist/context/secret-key.js

@@ -0,0 +1,64 @@
+import "../rolldown-runtime-ClRpJifh.js";
+//#region src/context/secret-key.ts
+/**
+* Canonical secret-key-name validation, shared by the orchestrator write paths
+* and the dashboard add-secret form.
+*
+* The rule exists to keep the at-rest encryption binding unambiguous. Every
+* scoped secret is encrypted with AES-GCM under the additional authenticated
+* data `${orgId}:${scope}:${key}`, which binds a ciphertext to the exact
+* location it was written to. That binding only holds if the concatenation
+* decomposes back to one triple: with a `:` allowed inside `key`, the pair
+* (scope `b`, key `c:d`) and the pair (scope `b:c`, key `d`) render the same
+* AAD, so a ciphertext written at one location authenticates at the other.
+*
+* `validateScopeName` already excludes `:` from every scope segment. Excluding
+* it from the key as well makes the AAD's tail two colon-free fields, so the
+* triple is recovered unambiguously by splitting from the right — regardless of
+* what `orgId` contains. That is why this validator is the other half of the
+* fix and shares the scope charset rather than defining a looser one.
+*
+* The AAD format itself is fixed: the same string decrypts stored values, so
+* length-prefixing or JSON-encoding it would strand every existing secret.
+* Constraining the inputs is what keeps the current format unambiguous.
+*
+* Enforced on WRITE paths only. Reads, deletes and listings deliberately stay
+* unvalidated so a key stored before this rule existed remains readable and
+* deletable — nothing already stored becomes unreachable.
+*
+* Kept dependency-free so the engine barrel stays browser-safe.
+*/
+/**
+* Allowed characters in a secret key. Deliberately identical to
+* `SCOPE_SEGMENT_PATTERN`: a key is a single segment, so it excludes both the
+* AAD separator `:` and the scope path separator `/`.
+*/
+const SECRET_KEY_PATTERN = /^[A-Za-z0-9._-]+$/;
+/** Maximum length of a secret key. */
+const SECRET_KEY_MAX_LENGTH = 256;
+/**
+* Validate a secret key name. Returns a human-readable error message, or
+* `null` when the key is valid.
+*/
+function validateSecretKey(key) {
+	if (key.length === 0) return "Secret key must not be empty";
+	if (key.length > 256) return `Secret key must be at most 256 characters`;
+	if (!SECRET_KEY_PATTERN.test(key)) return "Secret key may only contain letters, digits, and _ . - characters";
+	return null;
+}
+/** Error thrown by {@link assertValidSecretKey} for an invalid secret key. */
+var SecretKeyError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "SecretKeyError";
+	}
+};
+/** Throw {@link SecretKeyError} when `key` is not a valid secret key. */
+function assertValidSecretKey(key) {
+	const error = validateSecretKey(key);
+	if (error !== null) throw new SecretKeyError(error);
+}
+//#endregion
+export { SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SecretKeyError, assertValidSecretKey, validateSecretKey };
+
+//# sourceMappingURL=secret-key.js.map

package/dist/index.d.ts

@@ -45,9 +45,11 @@ export * from './protocol/messages/log-stream.js';
 export * from './protocol/messages/orchestrator-agent.js';
 export * from './sandbox/capabilities.js';
 export * from './trigger/types.js';
+export * from './trigger/text-match.js';
 export * from './trigger/trigger-event-type.js';
 export * from './trigger/decision-trace.js';
 export * from './trigger/matcher.js';
+export { getRepoGlobMatcher } from './trigger/compiled-matchers.js';
 export * from './trigger/event-buckets.js';
 export { scheduleTriggerKey } from './trigger/schedule-key.js';
 export * from './inputs/index.js';
@@ -61,7 +63,7 @@ export type { RateLimiterConfig, RateLimitResult } from './ws/rate-limiter.js';
 export * from './env/environment-allowlist.js';
 export * from './secrets/index.js';
 export * from './context/index.js';
-export { deriveOsArchLabels, derivePlatformTaints, PLATFORM_TAINT_LABELS, ScalerOs, ScalerArch, scalerPlatformSchema, platformToOsArchLabels, platformToTaints, nodePlatformToScalerOs, nodeArchToScalerArch, hostToScalerPlatform, hostLabel, parseHostLabel, HOST_LABEL_PREFIX, agentTypeLabel, scalerLabel, mergeAutoLabels, normalizeRunsOn, KNOWN_ROLES, resolveRoleLabels, validateNoReservedLabels, scalerAgentLabels, isSelfReportedLabel, SELF_REPORTED_LABEL_PREFIXES, CAPABILITY_LABEL_PREFIX, capabilityLabel, SSH_TRANSPORT_CAPABILITY, INIT_LABEL, PRIVILEGED_ROOT_LABEL, } from './labels.js';
+export { deriveOsArchLabels, derivePlatformTaints, PLATFORM_TAINT_LABELS, ScalerOs, ScalerArch, scalerPlatformSchema, platformToOsArchLabels, platformToTaints, nodePlatformToScalerOs, nodeArchToScalerArch, hostToScalerPlatform, hostLabel, parseHostLabel, HOST_LABEL_PREFIX, agentTypeLabel, scalerLabel, mergeAutoLabels, normalizeRunsOn, KNOWN_ROLES, resolveRoleLabels, validateNoReservedLabels, scalerAgentLabels, isSelfReportedLabel, SELF_REPORTED_LABEL_PREFIXES, CAPABILITY_LABEL_PREFIX, capabilityLabel, SSH_TRANSPORT_CAPABILITY, INIT_LABEL, PRIVILEGED_ROOT_LABEL, INIT_RUNNER_ROLE_LABEL, } from './labels.js';
 export type { NormalizedRunsOn } from './labels.js';
 export type { AgentRole } from './labels.js';
 export type { ScalerPlatform } from './labels.js';

package/dist/index.js

@@ -21,7 +21,7 @@ import { OWN_INGRESS_MODES, OrchestratorMode, PLATFORM_CONNECTED_MODES, RELAY_IN
 import { ScalerBackendType } from "./scaler/scaler-backend-type.js";
 import { ApprovalDecision, HoldScope, TriggerSource, approvalRequirementSchema, approvalTimeoutSecondsSchema, approverClauseSchema } from "./approval/types.js";
 import { CANONICAL_STATUSES, LEGACY_STATUS_ALIASES, STATUS_FAILURE_CLASS, STATUS_PRECEDENCE, StatusFailureClass, isFailureStatus, toCanonicalStatus, worstStatus } from "./status/presentation.js";
-import { BREAKING_FLOOR, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, changedFilesStatusSchema, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, resolveWhenToRunOn } from "./trigger/types.js";
+import { BREAKING_FLOOR, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, changedFilesStatusSchema, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, resolveContentFormat, resolveWhenToRunOn } from "./trigger/types.js";
 import { HostTargetSelector, HostTargetValue, LabelMatcher, compileRegexMatcher, hostSatisfiesTarget, matcherMatches, matcherSatisfiedBy, partitionMatchers } from "./labels-match.js";
 import { ConcurrencyStrategy, DEFAULT_CONCURRENCY_STRATEGY } from "./context/concurrency-strategy.js";
 import { HostInventoryEntry, HostPropertyValue, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, coerceHostPropertyValue, parseHostPropertyAssignments } from "./inventory.js";
@@ -42,10 +42,12 @@ import { EVENT_LOG_PAYLOAD_CHUNK_BYTES } from "./protocol/event-log-payload.js";
 import { browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, platformToBrowserMessageSchema } from "./protocol/messages/browser.js";
 import { joinRequestSchema, joinResponseSchema } from "./protocol/messages/join.js";
 import { fleetSelectionSchema, jobProgressAckSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, workerClusterSettingsSchema } from "./protocol/messages/peer.js";
-import { ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactRejectReason, ArtifactUploadOutcome, CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema } from "./protocol/messages/orchestrator-agent.js";
+import { ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactRejectReason, ArtifactUploadOutcome, CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema } from "./protocol/messages/orchestrator-agent.js";
 import { KNOWN_LINUX_CAPABILITIES, canonicalizeCapability, isKnownCapability } from "./sandbox/capabilities.js";
+import { compileSafeRegex, describeTextMatch, evaluateTextMatch, textMatchHasQuery } from "./trigger/text-match.js";
 import { TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES } from "./trigger/trigger-event-type.js";
-import { createTraceEntry, createWorkflowDecision } from "./trigger/decision-trace.js";
+import { TraceCheck, TraceVerdict, appendChecks, createCommitMessageTraceEntry, createContentRequirementsTraceEntry, createGlobalFilterTraceEntry, createTraceEntry, createWorkflowDecision } from "./trigger/decision-trace.js";
+import { getRepoGlobMatcher } from "./trigger/compiled-matchers.js";
 import { matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchTrigger, matchWorkflowTriggers } from "./trigger/matcher.js";
 import { TRIGGER_TYPE_TO_EVENT_TYPES, matchWorkflowsForEvent, prepareEventBuckets } from "./trigger/event-buckets.js";
 import { scheduleTriggerKey } from "./trigger/schedule-key.js";
@@ -71,8 +73,9 @@ import { DEFAULT_HOLD_EXPIRY_SECONDS } from "./context/hold-expiry.js";
 import { matchScopePattern, resolveSecretsForContext, resolveSecretsWithProvenance, stripScopePrefix } from "./context/scope-resolver.js";
 import { ContextGateRejectReason, mergeOrderedMaps } from "./context/multi-context.js";
 import { SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, ScopeNameError, assertValidScopeName, validateScopeName } from "./context/scope-name.js";
+import { SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SecretKeyError, assertValidSecretKey, validateSecretKey } from "./context/secret-key.js";
 import "./context/index.js";
-import { CAPABILITY_LABEL_PREFIX, HOST_LABEL_PREFIX, INIT_LABEL, KNOWN_ROLES, PLATFORM_TAINT_LABELS, PRIVILEGED_ROOT_LABEL, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, ScalerArch, ScalerOs, agentTypeLabel, capabilityLabel, deriveOsArchLabels, derivePlatformTaints, hostLabel, hostToScalerPlatform, isSelfReportedLabel, mergeAutoLabels, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeRunsOn, parseHostLabel, platformToOsArchLabels, platformToTaints, resolveRoleLabels, scalerAgentLabels, scalerLabel, scalerPlatformSchema, validateNoReservedLabels } from "./labels.js";
+import { CAPABILITY_LABEL_PREFIX, HOST_LABEL_PREFIX, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, KNOWN_ROLES, PLATFORM_TAINT_LABELS, PRIVILEGED_ROOT_LABEL, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, ScalerArch, ScalerOs, agentTypeLabel, capabilityLabel, deriveOsArchLabels, derivePlatformTaints, hostLabel, hostToScalerPlatform, isSelfReportedLabel, mergeAutoLabels, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeRunsOn, parseHostLabel, platformToOsArchLabels, platformToTaints, resolveRoleLabels, scalerAgentLabels, scalerLabel, scalerPlatformSchema, validateNoReservedLabels } from "./labels.js";
 import { parseMemoryString, resourceRequestNestedSchema, resourceSpecSchema, validateResourceRequest } from "./scaler/resource-types.js";
 import { RegisterableTriggerType } from "./registration/registerable-trigger-type.js";
 import { createWorkflowBundleConfig } from "./bundler/rolldown-config.js";
@@ -83,4 +86,4 @@ import { FanoutCause, FanoutError, MAX_FANOUT_JOBS, MAX_MATRIX_MATERIALIZATION,
 import { ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, ArtifactNameSchema, artifactInvalidNameError, checkArtifactName } from "./artifacts/name.js";
 import { PLAN_TYPES, PaidPlanType, PlanType, isPaidTier, planRank } from "./billing/plan-type.js";
 import { INFRA_ALERT_TYPES, InfraAlertSeverity, InfraAlertType, normalizeInfraAlertSeverity } from "./diagnostics/infra-alert.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentFailureCategory, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactNameSchema, ArtifactRejectReason, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CAPABILITY_LABEL_PREFIX, CONTEXTS_MAX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, ConcurrencyStrategy, ContextDeleteErrorCode, ContextGateRejectReason, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DEAD_ORCH_FAILURE_REASON, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DEVELOPER_OPERATIONS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, HEARTBEAT_CLOSE_MS, HEARTBEAT_DEGRADED_MS, HEARTBEAT_FRESH_MS, HEARTBEAT_STALE_THRESHOLD_SECONDS, HEARTBEAT_UNHEALTHY_MARK_MS, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, INFRA_ALERT_TYPES, INIT_LABEL, INSTALL_JOB_ID_PREFIX, InfraAlertSeverity, InfraAlertType, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_LINUX_CAPABILITIES, KNOWN_ROLES, LEGACY_STATUS_ALIASES, LabelMatcher, LockFileParseError, LogStream, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MAX_MATRIX_MATERIALIZATION, MIN_PROTOCOL_VERSION, MatrixShapeError, NACK_EXEMPT_MESSAGE_TYPES, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OWN_INGRESS_MODES, OnUnreachableMode, OrchLogPhase, OrchRole, OrchestratorMode, PING_EVENT_TYPE, PLAN_TYPES, PLATFORM_CAPABILITIES, PLATFORM_CONNECTED_MODES, PLATFORM_TAINT_LABELS, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PaidPlanType, PatKind, PayloadOmittedReason, PlanType, RELAY_INGRESS_MODES, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RegisterableTriggerType, RunFailureClass, RunsOnPick, SANDBOX_DEFAULT_VARS, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_FAILURE_CLASS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, STATUS_PRECEDENCE, SUBSCRIBABLE_WEBHOOK_EVENT_TYPES, ScalerArch, ScalerBackendType, ScalerEventType, ScalerOs, ScopeNameError, SourceOrigin, SourceProvider, SourceSubtype, StatusFailureClass, StepApprovalOutcome, StepConcurrencyKind, SubscribableWebhookEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TRIGGER_TYPE_TO_EVENT_TYPES, TRUSTED_ENV_SCRUB_EXACT, TestRelayType, TimeoutReason, TriggerSource, TrustTierSchema, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WORKFLOW_MODIFICATION_JOB_ID, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookEventType, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentJobResultSchema, agentLabelOf, agentLogChunkSchema, agentMetricsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentRegisterSchema, agentRunListItemSchema, agentRunResultSchema, agentSecretScopeSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, agentWorkflowSummarySchema, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approvalTimeoutSecondsSchema, approveRunToolSchema, approverClauseSchema, artifactInvalidNameError, artifactListItemSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, assertScheduleInputsSatisfiable, assertValidScopeName, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, canonicalizeCapability, capabilityLabel, changedFilesStatusSchema, checkArtifactName, coerceDispatchInputs, coerceHostPropertyValue, collectDiscriminatorTypes, compileRegexMatcher, configAckSchema, connectionHealthStatusSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, derivePlatformTaints, developerOpsForEntrypoint, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogActivityCountsSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, findDuplicateCombination, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getDiagnosticsToolSchema, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubIngressPath, githubWebhookPath, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, installGateJobId, isFailureStatus, isInputSatisfiableFromDefaults, isKnownCapability, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, isPaidTier, isSelfReportedLabel, isTrustedEnvScrubbed, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchTrigger, matchWorkflowTriggers, matchWorkflowsForEvent, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixCombinationCount, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeInfraAlertSeverity, normalizeMatrixInput, normalizePersistedHoldType, normalizeRunsOn, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, persistedHoldTypeSpellings, planRank, platformCapabilitiesMessageSchema, platformCapabilitiesSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, prepareEventBuckets, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rejectRunToolSchema, renderFenced, rerunRunToolSchema, resolveHeldRunId, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForContext, resolveSecretsWithProvenance, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, scalerPlatformSchema, scheduleTriggerKey, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, toCanonicalStatus, triggerRunToolSchema, trustPolicyResponseSchema, trustPolicySchema, trustPolicyUpdateSchema, trustedContributorHoldReason, unknownContributorHoldReason, untrusted, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, validateScopeName, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, workerClusterSettingsSchema, worstStatus, wrapUntrusted };
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentFailureCategory, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactNameSchema, ArtifactRejectReason, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CAPABILITY_LABEL_PREFIX, CONTEXTS_MAX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, ConcurrencyStrategy, ContextDeleteErrorCode, ContextGateRejectReason, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DEAD_ORCH_FAILURE_REASON, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DEVELOPER_OPERATIONS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, HEARTBEAT_CLOSE_MS, HEARTBEAT_DEGRADED_MS, HEARTBEAT_FRESH_MS, HEARTBEAT_STALE_THRESHOLD_SECONDS, HEARTBEAT_UNHEALTHY_MARK_MS, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, INFRA_ALERT_TYPES, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, INSTALL_JOB_ID_PREFIX, InfraAlertSeverity, InfraAlertType, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_LINUX_CAPABILITIES, KNOWN_ROLES, LEGACY_STATUS_ALIASES, LabelMatcher, LockFileParseError, LogStream, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MAX_MATRIX_MATERIALIZATION, MIN_PROTOCOL_VERSION, MatrixShapeError, NACK_EXEMPT_MESSAGE_TYPES, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OWN_INGRESS_MODES, OnUnreachableMode, OrchLogPhase, OrchRole, OrchestratorMode, PING_EVENT_TYPE, PLAN_TYPES, PLATFORM_CAPABILITIES, PLATFORM_CONNECTED_MODES, PLATFORM_TAINT_LABELS, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PaidPlanType, PatKind, PayloadOmittedReason, PlanType, RELAY_INGRESS_MODES, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RegisterableTriggerType, RunFailureClass, RunsOnPick, SANDBOX_DEFAULT_VARS, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_FAILURE_CLASS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, STATUS_PRECEDENCE, SUBSCRIBABLE_WEBHOOK_EVENT_TYPES, ScalerArch, ScalerBackendType, ScalerEventType, ScalerOs, ScopeNameError, SecretKeyError, SourceOrigin, SourceProvider, SourceSubtype, StatusFailureClass, StepApprovalOutcome, StepConcurrencyKind, SubscribableWebhookEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TRIGGER_TYPE_TO_EVENT_TYPES, TRUSTED_ENV_SCRUB_EXACT, TestRelayType, TimeoutReason, TraceCheck, TraceVerdict, TriggerSource, TrustTierSchema, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WORKFLOW_MODIFICATION_JOB_ID, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookEventType, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentJobResultSchema, agentLabelOf, agentLogChunkSchema, agentMetricsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentRegisterSchema, agentRunListItemSchema, agentRunResultSchema, agentSecretScopeSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, agentWorkflowSummarySchema, apiKeyActorSchema, appendChecks, applyIncludeExclude, approvalRequirementSchema, approvalTimeoutSecondsSchema, approveRunToolSchema, approverClauseSchema, artifactInvalidNameError, artifactListItemSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, assertScheduleInputsSatisfiable, assertValidScopeName, assertValidSecretKey, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, canonicalizeCapability, capabilityLabel, changedFilesStatusSchema, checkArtifactName, coerceDispatchInputs, coerceHostPropertyValue, collectDiscriminatorTypes, compileRegexMatcher, compileSafeRegex, configAckSchema, connectionHealthStatusSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, createCommitMessageTraceEntry, createContentRequirementsTraceEntry, createGlobalFilterTraceEntry, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, derivePlatformTaints, describeTextMatch, developerOpsForEntrypoint, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, errorSchema, evaluateTextMatch, eventEmitResponseSchema, eventEmitSchema, eventLogActivityCountsSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, findDuplicateCombination, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getDiagnosticsToolSchema, getRepoGlobMatcher, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubIngressPath, githubWebhookPath, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, installGateJobId, isFailureStatus, isInputSatisfiableFromDefaults, isKnownCapability, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, isPaidTier, isSelfReportedLabel, isTrustedEnvScrubbed, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchTrigger, matchWorkflowTriggers, matchWorkflowsForEvent, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixCombinationCount, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeInfraAlertSeverity, normalizeMatrixInput, normalizePersistedHoldType, normalizeRunsOn, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, persistedHoldTypeSpellings, planRank, platformCapabilitiesMessageSchema, platformCapabilitiesSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, prepareEventBuckets, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rejectRunToolSchema, renderFenced, rerunRunToolSchema, resolveContentFormat, resolveHeldRunId, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForContext, resolveSecretsWithProvenance, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, scalerPlatformSchema, scheduleTriggerKey, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, textMatchHasQuery, toCanonicalStatus, triggerRunToolSchema, trustPolicyResponseSchema, trustPolicySchema, trustPolicyUpdateSchema, trustedContributorHoldReason, unknownContributorHoldReason, untrusted, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, validateScopeName, validateSecretKey, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, workerClusterSettingsSchema, worstStatus, wrapUntrusted };

package/dist/labels/compile.d.ts

@@ -1,11 +1,6 @@
 import type { LabelMatcher } from '../labels-match.js';
-/**
- * Reject a ReDoS-prone regex. `safe-regex` is a star-height heuristic — the
- * orchestrator is single-tenant, so a slipped-through pattern only stalls the
- * author's own orchestrator. Globs are linear by construction but pass through
- * here for uniformity.
- */
-export declare function assertSafeRegex(source: string, flags: string, ctx: string): void;
+import { assertSafeRegex } from '../safe-regex.js';
+export { assertSafeRegex };
 /**
  * Convert one author selector element into a `LabelMatcher`.
  * - `RegExp` → regex matcher (source + flags captured verbatim).

package/dist/labels/compile.js

@@ -1,17 +1,8 @@
 import "../rolldown-runtime-ClRpJifh.js";
+import { assertSafeRegex } from "../safe-regex.js";
 import picomatch from "picomatch";
-import safeRegex from "safe-regex";
 //#region src/labels/compile.ts
 /**
-* Reject a ReDoS-prone regex. `safe-regex` is a star-height heuristic — the
-* orchestrator is single-tenant, so a slipped-through pattern only stalls the
-* author's own orchestrator. Globs are linear by construction but pass through
-* here for uniformity.
-*/
-function assertSafeRegex(source, flags, ctx) {
-	if (!safeRegex(new RegExp(source, flags))) throw new Error(`${ctx}: regex /${source}/${flags} is ReDoS-prone — rejected`);
-}
-/**
 * Convert one author selector element into a `LabelMatcher`.
 * - `RegExp` → regex matcher (source + flags captured verbatim).
 * - string that picomatch detects as a glob → regex via `picomatch.makeRe`.

package/dist/labels.d.ts

@@ -194,6 +194,14 @@ export declare const ROLE_LABEL_PREFIX = "kici:role:";
  * Convert a role name to its corresponding label.
  */
 export declare function roleToLabel(role: AgentRole): string;
+/**
+ * The label every pre-run evaluation job routes to.
+ *
+ * Exported because three dispatch sites and the global eval round all target
+ * it, and each had spelled the string out. Derived from {@link roleToLabel} so
+ * it cannot drift from the prefix or from `KNOWN_ROLES`.
+ */
+export declare const INIT_RUNNER_ROLE_LABEL: string;
 /**
  * Resolve a roles configuration into role labels.
  *

package/dist/labels.js

@@ -274,6 +274,14 @@ function roleToLabel(role) {
 	return `${ROLE_LABEL_PREFIX}${role}`;
 }
 /**
+* The label every pre-run evaluation job routes to.
+*
+* Exported because three dispatch sites and the global eval round all target
+* it, and each had spelled the string out. Derived from {@link roleToLabel} so
+* it cannot drift from the prefix or from `KNOWN_ROLES`.
+*/
+const INIT_RUNNER_ROLE_LABEL = roleToLabel("init-runner");
+/**
 * Resolve a roles configuration into role labels.
 *
 * - undefined → all roles (backward compat: existing agents get all capabilities)
@@ -352,6 +360,6 @@ function separateLabels(labels) {
 	};
 }
 //#endregion
-export { CAPABILITY_LABEL_PREFIX, HOST_LABEL_PREFIX, INIT_LABEL, KNOWN_ROLES, PLATFORM_TAINT_LABELS, PRIVILEGED_ROOT_LABEL, RESERVED_LABEL_PREFIX, ROLE_LABEL_PREFIX, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, ScalerArch, ScalerOs, agentTypeLabel, capabilityLabel, deriveOsArchLabels, derivePlatformTaints, hostLabel, hostToScalerPlatform, isAutoLabel, isSelfReportedLabel, mergeAutoLabels, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeRunsOn, parseHostLabel, platformToOsArchLabels, platformToTaints, resolveRoleLabels, roleToLabel, scalerAgentLabels, scalerLabel, scalerPlatformSchema, separateLabels, validateNoReservedLabels };
+export { CAPABILITY_LABEL_PREFIX, HOST_LABEL_PREFIX, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, KNOWN_ROLES, PLATFORM_TAINT_LABELS, PRIVILEGED_ROOT_LABEL, RESERVED_LABEL_PREFIX, ROLE_LABEL_PREFIX, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, ScalerArch, ScalerOs, agentTypeLabel, capabilityLabel, deriveOsArchLabels, derivePlatformTaints, hostLabel, hostToScalerPlatform, isAutoLabel, isSelfReportedLabel, mergeAutoLabels, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeRunsOn, parseHostLabel, platformToOsArchLabels, platformToTaints, resolveRoleLabels, roleToLabel, scalerAgentLabels, scalerLabel, scalerPlatformSchema, separateLabels, validateNoReservedLabels };
 
 //# sourceMappingURL=labels.js.map

package/dist/metrics/catalog-policy.d.ts

@@ -59,6 +59,17 @@ export declare const ORCH_PUSHED_METRIC_NAMES: ReadonlySet<MetricName>;
  * `AGENT_SCALER_VALUES`. Exported so the policy tests can assert against it.
  */
 export declare const ORCH_SCALER_VALUES: readonly ["__global__", "stateful", "container", "firecracker", "bare-metal"];
+/**
+ * Closed enum of the scheduled jobs the orchestrator runs. MUST mirror
+ * `OrchestratorScheduledJobName` (`packages/orchestrator/src/queue/scheduled-job.ts`)
+ * exactly — a job missing here has its whole `kici_orch_job_*` series
+ * dropped by the Platform filter with `reason="bad_label_value"`, so the
+ * job silently loses every health metric. The engine cannot import the
+ * orchestrator (dependency runs the other way), so the parity assertion
+ * lives on the orchestrator side in `scheduled-job.test.ts`. Exported so
+ * that test can assert against it.
+ */
+export declare const ORCH_JOB_VALUES: readonly ['cleanup', 'orphan-secret-cleanup', 'token-cleanup', 'cold-store-archive', 'cold-store-purge', 'unroutable-probe'];
 /**
  * Per-metric, per-label value policy. Missing entries (or missing label
  * keys within an entry) mean "no value-level constraint" — the label key

package/dist/metrics/catalog-policy.js

@@ -55,13 +55,23 @@ const AGENT_SCALER_VALUES = [
 * `AGENT_SCALER_VALUES`. Exported so the policy tests can assert against it.
 */
 const ORCH_SCALER_VALUES = ["__global__", ...AGENT_SCALER_VALUES];
-/** Closed enum of the five scheduled jobs the orchestrator runs (mirrors `OrchestratorScheduledJobName`). */
+/**
+* Closed enum of the scheduled jobs the orchestrator runs. MUST mirror
+* `OrchestratorScheduledJobName` (`packages/orchestrator/src/queue/scheduled-job.ts`)
+* exactly — a job missing here has its whole `kici_orch_job_*` series
+* dropped by the Platform filter with `reason="bad_label_value"`, so the
+* job silently loses every health metric. The engine cannot import the
+* orchestrator (dependency runs the other way), so the parity assertion
+* lives on the orchestrator side in `scheduled-job.test.ts`. Exported so
+* that test can assert against it.
+*/
 const ORCH_JOB_VALUES = [
 	"cleanup",
 	"orphan-secret-cleanup",
 	"token-cleanup",
 	"cold-store-archive",
-	"cold-store-purge"
+	"cold-store-purge",
+	"unroutable-probe"
 ];
 /**
 * Per-metric, per-label value policy. Missing entries (or missing label
@@ -277,6 +287,6 @@ const METRIC_LABEL_POLICY = {
 	}
 };
 //#endregion
-export { METRIC_LABEL_POLICY, ORCH_PUSHED_METRIC_NAMES, ORCH_SCALER_VALUES, OVERFLOW_LABEL_VALUE };
+export { METRIC_LABEL_POLICY, ORCH_JOB_VALUES, ORCH_PUSHED_METRIC_NAMES, ORCH_SCALER_VALUES, OVERFLOW_LABEL_VALUE };
 
 //# sourceMappingURL=catalog-policy.js.map

package/dist/metrics/metric-catalog.generated.d.ts

@@ -44,6 +44,11 @@ export declare const MetricNames: {
     readonly KICI_ORCH_EXECUTION_DURATION_SECONDS: 'kici_orch_execution_duration_seconds';
     readonly KICI_ORCH_EXECUTIONS_TOTAL: 'kici_orch_executions_total';
     readonly KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: 'kici_orch_github_check_run_total';
+    readonly KICI_ORCH_GLOBAL_EVAL_CACHE_LOOKUPS_TOTAL: 'kici_orch_global_eval_cache_lookups_total';
+    readonly KICI_ORCH_GLOBAL_EVAL_CANDIDATES_TOTAL: 'kici_orch_global_eval_candidates_total';
+    readonly KICI_ORCH_GLOBAL_EVAL_JOBS_GENERATED: 'kici_orch_global_eval_jobs_generated';
+    readonly KICI_ORCH_GLOBAL_EVAL_ROUND_DURATION_SECONDS: 'kici_orch_global_eval_round_duration_seconds';
+    readonly KICI_ORCH_GLOBAL_EVAL_VERDICTS_TOTAL: 'kici_orch_global_eval_verdicts_total';
     readonly KICI_ORCH_INGEST_ADMITTED_TOTAL: 'kici_orch_ingest_admitted_total';
     readonly KICI_ORCH_INGEST_EVENT_LOOP_DELAY_MAX_MS: 'kici_orch_ingest_event_loop_delay_max_ms';
     readonly KICI_ORCH_INGEST_EVENT_LOOP_DELAY_P99_MS: 'kici_orch_ingest_event_loop_delay_p99_ms';
@@ -94,6 +99,7 @@ export declare const MetricNames: {
     readonly KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: 'kici_orch_trust_match_refused_no_id_total';
     readonly KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: 'kici_orch_trust_policy_decisions_total';
     readonly KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: 'kici_orch_unroutable_fast_failed_total';
+    readonly KICI_ORCH_WEBHOOK_PIPELINE_FAILURES_TOTAL: 'kici_orch_webhook_pipeline_failures_total';
     readonly KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: 'kici_orch_webhooks_processed_total';
     readonly KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: 'kici_orch_webhooks_received_total';
     readonly KICI_ORCH_WS_NACK_RECEIVED_TOTAL: 'kici_orch_ws_nack_received_total';
@@ -246,6 +252,11 @@ export declare const MetricLabels: {
     readonly KICI_ORCH_EXECUTION_DURATION_SECONDS: readonly [];
     readonly KICI_ORCH_EXECUTIONS_TOTAL: readonly ['status'];
     readonly KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: readonly ['operation'];
+    readonly KICI_ORCH_GLOBAL_EVAL_CACHE_LOOKUPS_TOTAL: readonly ['result'];
+    readonly KICI_ORCH_GLOBAL_EVAL_CANDIDATES_TOTAL: readonly [];
+    readonly KICI_ORCH_GLOBAL_EVAL_JOBS_GENERATED: readonly [];
+    readonly KICI_ORCH_GLOBAL_EVAL_ROUND_DURATION_SECONDS: readonly ['result'];
+    readonly KICI_ORCH_GLOBAL_EVAL_VERDICTS_TOTAL: readonly ['outcome'];
     readonly KICI_ORCH_INGEST_ADMITTED_TOTAL: readonly [];
     readonly KICI_ORCH_INGEST_EVENT_LOOP_DELAY_MAX_MS: readonly [];
     readonly KICI_ORCH_INGEST_EVENT_LOOP_DELAY_P99_MS: readonly [];
@@ -296,6 +307,7 @@ export declare const MetricLabels: {
     readonly KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: readonly ['reason'];
     readonly KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: readonly ['arm', 'action'];
     readonly KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: readonly [];
+    readonly KICI_ORCH_WEBHOOK_PIPELINE_FAILURES_TOTAL: readonly ['phase'];
     readonly KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: readonly ['result'];
     readonly KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: readonly ['source', 'event'];
     readonly KICI_ORCH_WS_NACK_RECEIVED_TOTAL: readonly [];
@@ -447,6 +459,11 @@ export declare const MetricKind: {
     readonly KICI_ORCH_EXECUTION_DURATION_SECONDS: 'histogram';
     readonly KICI_ORCH_EXECUTIONS_TOTAL: 'counter';
     readonly KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: 'counter';
+    readonly KICI_ORCH_GLOBAL_EVAL_CACHE_LOOKUPS_TOTAL: 'counter';
+    readonly KICI_ORCH_GLOBAL_EVAL_CANDIDATES_TOTAL: 'counter';
+    readonly KICI_ORCH_GLOBAL_EVAL_JOBS_GENERATED: 'histogram';
+    readonly KICI_ORCH_GLOBAL_EVAL_ROUND_DURATION_SECONDS: 'histogram';
+    readonly KICI_ORCH_GLOBAL_EVAL_VERDICTS_TOTAL: 'counter';
     readonly KICI_ORCH_INGEST_ADMITTED_TOTAL: 'counter';
     readonly KICI_ORCH_INGEST_EVENT_LOOP_DELAY_MAX_MS: 'observableGauge';
     readonly KICI_ORCH_INGEST_EVENT_LOOP_DELAY_P99_MS: 'observableGauge';
@@ -497,6 +514,7 @@ export declare const MetricKind: {
     readonly KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: 'counter';
     readonly KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: 'counter';
     readonly KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: 'counter';
+    readonly KICI_ORCH_WEBHOOK_PIPELINE_FAILURES_TOTAL: 'counter';
     readonly KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: 'counter';
     readonly KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: 'counter';
     readonly KICI_ORCH_WS_NACK_RECEIVED_TOTAL: 'counter';
@@ -648,6 +666,11 @@ export declare const MetricDescription: {
     readonly KICI_ORCH_EXECUTION_DURATION_SECONDS: 'Duration of execution runs in seconds';
     readonly KICI_ORCH_EXECUTIONS_TOTAL: 'Total number of execution runs';
     readonly KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: 'Total number of GitHub check run API calls';
+    readonly KICI_ORCH_GLOBAL_EVAL_CACHE_LOOKUPS_TOTAL: 'Tier-2 global eval round cache lookups by outcome';
+    readonly KICI_ORCH_GLOBAL_EVAL_CANDIDATES_TOTAL: 'Global workflow candidates handed to a Tier-2 eval round';
+    readonly KICI_ORCH_GLOBAL_EVAL_JOBS_GENERATED: 'Jobs generated by a Tier-2 global eval round';
+    readonly KICI_ORCH_GLOBAL_EVAL_ROUND_DURATION_SECONDS: 'Duration of one dispatched Tier-2 global eval round in seconds';
+    readonly KICI_ORCH_GLOBAL_EVAL_VERDICTS_TOTAL: 'Per-candidate verdicts produced by a Tier-2 global eval round';
     readonly KICI_ORCH_INGEST_ADMITTED_TOTAL: 'Total webhook ingest admissions granted by the admission controller';
     readonly KICI_ORCH_INGEST_EVENT_LOOP_DELAY_MAX_MS: 'Event-loop delay max (ms) observed by the ingest admission sampler';
     readonly KICI_ORCH_INGEST_EVENT_LOOP_DELAY_P99_MS: 'Event-loop delay p99 (ms) observed by the ingest admission sampler';
@@ -698,6 +721,7 @@ export declare const MetricDescription: {
     readonly KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: 'Trust-resolution attempts refused because the provider numeric id was missing or did not match';
     readonly KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: 'Total org trust-policy gate decisions by arm and action';
     readonly KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: 'Jobs terminalized as unroutable by the fast-fail probe (not the queue timeout)';
+    readonly KICI_ORCH_WEBHOOK_PIPELINE_FAILURES_TOTAL: 'Webhook match-and-dispatch pipelines that threw. Labels: phase (post_ack — failed after the delivery was acknowledged)';
     readonly KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: 'Total number of webhooks processed';
     readonly KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: 'Total number of webhooks received';
     readonly KICI_ORCH_WS_NACK_RECEIVED_TOTAL: 'NACKs received from the Platform for a message it could not process (version skew)';
@@ -856,6 +880,11 @@ export declare const MetricService: {
     readonly KICI_ORCH_EXECUTION_DURATION_SECONDS: 'orchestrator';
     readonly KICI_ORCH_EXECUTIONS_TOTAL: 'orchestrator';
     readonly KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: 'orchestrator';
+    readonly KICI_ORCH_GLOBAL_EVAL_CACHE_LOOKUPS_TOTAL: 'orchestrator';
+    readonly KICI_ORCH_GLOBAL_EVAL_CANDIDATES_TOTAL: 'orchestrator';
+    readonly KICI_ORCH_GLOBAL_EVAL_JOBS_GENERATED: 'orchestrator';
+    readonly KICI_ORCH_GLOBAL_EVAL_ROUND_DURATION_SECONDS: 'orchestrator';
+    readonly KICI_ORCH_GLOBAL_EVAL_VERDICTS_TOTAL: 'orchestrator';
     readonly KICI_ORCH_INGEST_ADMITTED_TOTAL: 'orchestrator';
     readonly KICI_ORCH_INGEST_EVENT_LOOP_DELAY_MAX_MS: 'orchestrator';
     readonly KICI_ORCH_INGEST_EVENT_LOOP_DELAY_P99_MS: 'orchestrator';
@@ -906,6 +935,7 @@ export declare const MetricService: {
     readonly KICI_ORCH_TRUST_MATCH_REFUSED_NO_ID_TOTAL: 'orchestrator';
     readonly KICI_ORCH_TRUST_POLICY_DECISIONS_TOTAL: 'orchestrator';
     readonly KICI_ORCH_UNROUTABLE_FAST_FAILED_TOTAL: 'orchestrator';
+    readonly KICI_ORCH_WEBHOOK_PIPELINE_FAILURES_TOTAL: 'orchestrator';
     readonly KICI_ORCH_WEBHOOKS_PROCESSED_TOTAL: 'orchestrator';
     readonly KICI_ORCH_WEBHOOKS_RECEIVED_TOTAL: 'orchestrator';
     readonly KICI_ORCH_WS_NACK_RECEIVED_TOTAL: 'orchestrator';