@kici-dev/engine 0.6.1 → 0.8.0

package/dist/protocol/dashboard-write-operations.js

@@ -216,7 +216,7 @@ const DASHBOARD_WRITE_OPERATIONS = Object.freeze([
 		category: "Held runs",
 		label: "Approve held run",
 		sensitivity: "dispatch",
-		cliEquivalent: "kici-admin runs approve"
+		cliEquivalent: "kici-admin held-run approve"
 	},
 	{
 		name: "held_runs.reject",
@@ -224,7 +224,7 @@ const DASHBOARD_WRITE_OPERATIONS = Object.freeze([
 		category: "Held runs",
 		label: "Reject held run",
 		sensitivity: "dispatch",
-		cliEquivalent: "kici-admin runs reject"
+		cliEquivalent: "kici-admin held-run reject"
 	},
 	{
 		name: "event_dlq.retry",
@@ -315,6 +315,23 @@ const DASHBOARD_WRITE_OPERATIONS = Object.freeze([
 		cliEquivalent: "kici-admin host remove"
 	}
 ]);
+/**
+* The operations whose `cliEquivalent` answers only on an **independent**
+* orchestrator.
+*
+* `kici-admin held-run approve` and `reject` refuse with a 409 wherever a
+* Platform is attached, because the Platform's own held-run trust gate is the
+* authority on who may answer a hold there. Every other operation's CLI
+* equivalent works in any mode.
+*
+* That makes these two the only operations a Platform-attached orchestrator
+* cannot move to the CLI layer: disabling one leaves no surface that can answer
+* a context or reviewer hold, so the orchestrator refuses the write. This list
+* is what the orchestrator's policy module and the `dashboard-writes` CLI
+* render both read, so the refusal and the warning can never name different
+* operations.
+*/
+const CLI_INDEPENDENT_ONLY_OPERATIONS = Object.freeze(["held_runs.approve", "held_runs.reject"]);
 /** O(1) lookup of a descriptor by operation name. */
 const DASHBOARD_WRITE_OPERATIONS_BY_NAME = new Map(DASHBOARD_WRITE_OPERATIONS.map((d) => [d.name, d]));
 /** O(1) lookup of a descriptor by wire-message type. */
@@ -435,6 +452,6 @@ function resolveFullPolicyStateView(policy) {
 	return out;
 }
 //#endregion
-export { DASHBOARD_WRITE_OPERATIONS, DASHBOARD_WRITE_OPERATIONS_BY_NAME, DASHBOARD_WRITE_OPERATIONS_BY_WIRE_TYPE, DASHBOARD_WRITE_OPERATION_VALUES, DashboardWriteCategory, DashboardWriteOperation, DashboardWritePolicyState, DashboardWriteSensitivity, coerceDashboardWritePolicyValue, dashboardWritePolicyMap, dashboardWritePolicyMapSchema, getDashboardWriteOperationDescriptor, getDashboardWriteOperationsByCategory, getDashboardWriteOperationsBySensitivity, isDashboardWriteOperationEnabled, isEncryptedState, resolveFullPolicyStateView, resolveFullPolicyView, resolvePolicyState };
+export { CLI_INDEPENDENT_ONLY_OPERATIONS, DASHBOARD_WRITE_OPERATIONS, DASHBOARD_WRITE_OPERATIONS_BY_NAME, DASHBOARD_WRITE_OPERATIONS_BY_WIRE_TYPE, DASHBOARD_WRITE_OPERATION_VALUES, DashboardWriteCategory, DashboardWriteOperation, DashboardWritePolicyState, DashboardWriteSensitivity, coerceDashboardWritePolicyValue, dashboardWritePolicyMap, dashboardWritePolicyMapSchema, getDashboardWriteOperationDescriptor, getDashboardWriteOperationsByCategory, getDashboardWriteOperationsBySensitivity, isDashboardWriteOperationEnabled, isEncryptedState, resolveFullPolicyStateView, resolveFullPolicyView, resolvePolicyState };
 
 //# sourceMappingURL=dashboard-write-operations.js.map

package/dist/protocol/messages/access-log.d.ts

@@ -56,6 +56,7 @@ export type AccessLogTargetType = z.infer<typeof AccessLogTargetType>;
  */
 export declare const AccessLogAction: z.ZodEnum<{
     "access_log.list.read": "access_log.list.read";
+    "admin_tokens.list.read": "admin_tokens.list.read";
     archive_chunk: "archive_chunk";
     "artifacts.read": "artifacts.read";
     "attestation.retry": "attestation.retry";
@@ -161,6 +162,7 @@ export declare const accessLogItemSchema: z.ZodObject<{
     actorDisplayName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     action: z.ZodEnum<{
         "access_log.list.read": "access_log.list.read";
+        "admin_tokens.list.read": "admin_tokens.list.read";
         archive_chunk: "archive_chunk";
         "artifacts.read": "artifacts.read";
         "attestation.retry": "attestation.retry";
@@ -293,6 +295,7 @@ export declare const accessLogFilterSchema: z.ZodObject<{
     actorId: z.ZodOptional<z.ZodString>;
     action: z.ZodOptional<z.ZodEnum<{
         "access_log.list.read": "access_log.list.read";
+        "admin_tokens.list.read": "admin_tokens.list.read";
         archive_chunk: "archive_chunk";
         "artifacts.read": "artifacts.read";
         "attestation.retry": "attestation.retry";
@@ -455,6 +458,7 @@ export declare const dashboardAccessLogListRequestSchema: z.ZodObject<{
     actorId: z.ZodOptional<z.ZodString>;
     action: z.ZodOptional<z.ZodEnum<{
         "access_log.list.read": "access_log.list.read";
+        "admin_tokens.list.read": "admin_tokens.list.read";
         archive_chunk: "archive_chunk";
         "artifacts.read": "artifacts.read";
         "attestation.retry": "attestation.retry";
@@ -598,6 +602,7 @@ export declare const dashboardAccessLogListResponseSchema: z.ZodObject<{
         actorDisplayName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         action: z.ZodEnum<{
             "access_log.list.read": "access_log.list.read";
+            "admin_tokens.list.read": "admin_tokens.list.read";
             archive_chunk: "archive_chunk";
             "artifacts.read": "artifacts.read";
             "attestation.retry": "attestation.retry";

package/dist/protocol/messages/access-log.js

@@ -60,6 +60,7 @@ const AccessLogAction = z.enum([
 	"runs.list.read",
 	"runs.filters.read",
 	"sources.list.read",
+	"admin_tokens.list.read",
 	"run.payload.read",
 	"run.orch_logs.read",
 	"step.logs.read",

package/dist/protocol/messages/config-paths.d.ts

@@ -0,0 +1,20 @@
+import { z } from 'zod';
+/**
+ * Where an orchestrator's own configuration lives on its host, so an operator
+ * reading the dashboard knows which files to inspect.
+ *
+ * Every value is an absolute HOST path, and every field is optional. An absent
+ * field means "not reported" and never "no such file": a `composeFile` that is
+ * missing does not imply the deployment is not compose, it implies the
+ * orchestrator did not say.
+ *
+ * Paths only — no layer ever carries the contents of these files, which hold
+ * the database URL and the Platform token.
+ */
+export declare const ConfigPathsSchema: z.ZodObject<{
+    envFile: z.ZodOptional<z.ZodString>;
+    scalerConfig: z.ZodOptional<z.ZodString>;
+    composeFile: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ConfigPaths = z.infer<typeof ConfigPathsSchema>;
+//# sourceMappingURL=config-paths.d.ts.map

package/dist/protocol/messages/config-paths.js

@@ -0,0 +1,27 @@
+import "../../rolldown-runtime-ClRpJifh.js";
+import { z } from "zod";
+//#region src/protocol/messages/config-paths.ts
+/**
+* Where an orchestrator's own configuration lives on its host, so an operator
+* reading the dashboard knows which files to inspect.
+*
+* Every value is an absolute HOST path, and every field is optional. An absent
+* field means "not reported" and never "no such file": a `composeFile` that is
+* missing does not imply the deployment is not compose, it implies the
+* orchestrator did not say.
+*
+* Paths only — no layer ever carries the contents of these files, which hold
+* the database URL and the Platform token.
+*/
+const ConfigPathsSchema = z.object({
+	/** The env file the service manager loads (`EnvironmentFile=` / `env_file:`). */
+	envFile: z.string().min(1).optional(),
+	/** The scaler YAML file, or the directory when only a directory is configured. */
+	scalerConfig: z.string().min(1).optional(),
+	/** The generated compose file, for a compose deployment. */
+	composeFile: z.string().min(1).optional()
+});
+//#endregion
+export { ConfigPathsSchema };
+
+//# sourceMappingURL=config-paths.js.map

package/dist/protocol/messages/dashboard.d.ts

@@ -1322,6 +1322,77 @@ export declare const dashboardSourcesListResponseSchema: z.ZodObject<{
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type DashboardSourcesListResponse = z.infer<typeof dashboardSourcesListResponseSchema>;
+/**
+ * One orchestrator admin token, as the dashboard plane sees it.
+ *
+ * The projection deliberately carries NO `token_hash` / `tokenHash` field. A
+ * hash is a credential verifier: relaying it would put an offline-crackable
+ * value on the dashboard plane for a report that has no use for it.
+ * `dashboard.test.ts` asserts the absence so a later field addition cannot
+ * reintroduce it by accident.
+ */
+export declare const dashboardAdminTokenSummarySchema: z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodString;
+    role: z.ZodString;
+    subject: z.ZodNullable<z.ZodString>;
+    routingKey: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    expiresAt: z.ZodNullable<z.ZodString>;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+    revoked: z.ZodBoolean;
+}, z.core.$strip>;
+export type DashboardAdminTokenSummary = z.infer<typeof dashboardAdminTokenSummarySchema>;
+/** Request the orchestrator's admin-token inventory. */
+export declare const dashboardAdminTokensListRequestSchema: z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.admin-tokens.list">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+        agent: z.ZodOptional<z.ZodObject<{
+            patId: z.ZodString;
+            label: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+        agent: z.ZodOptional<z.ZodObject<{
+            label: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+}, z.core.$strip>;
+export type DashboardAdminTokensListRequest = z.infer<typeof dashboardAdminTokensListRequestSchema>;
+/** Response with the admin-token inventory. */
+export declare const dashboardAdminTokensListResponseSchema: z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.admin-tokens.list.response">;
+    requestId: z.ZodString;
+    tokens: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+        role: z.ZodString;
+        subject: z.ZodNullable<z.ZodString>;
+        routingKey: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+        expiresAt: z.ZodNullable<z.ZodString>;
+        lastUsedAt: z.ZodNullable<z.ZodString>;
+        revoked: z.ZodBoolean;
+    }, z.core.$strip>>;
+    error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type DashboardAdminTokensListResponse = z.infer<typeof dashboardAdminTokensListResponseSchema>;
 /** Request to re-run a completed run. */
 export declare const runRerunRequestSchema: z.ZodObject<{
     type: z.ZodLiteral<"run.rerun.request">;
@@ -1481,6 +1552,7 @@ export declare const eventLogListItemSchema: z.ZodObject<{
         lockfile_missing: "lockfile_missing";
         processed: "processed";
         received: "received";
+        shed: "shed";
     }>;
     matchedCount: z.ZodNumber;
     runId: z.ZodNullable<z.ZodString>;
@@ -1534,6 +1606,7 @@ export declare const dashboardEventLogListRequestSchema: z.ZodObject<{
         lockfile_missing: "lockfile_missing";
         processed: "processed";
         received: "received";
+        shed: "shed";
     }>>;
     fromTimestamp: z.ZodOptional<z.ZodString>;
     toTimestamp: z.ZodOptional<z.ZodString>;
@@ -1564,6 +1637,7 @@ declare const dashboardEventLogListResponseSchema: z.ZodObject<{
             lockfile_missing: "lockfile_missing";
             processed: "processed";
             received: "received";
+            shed: "shed";
         }>;
         matchedCount: z.ZodNumber;
         runId: z.ZodNullable<z.ZodString>;
@@ -1642,6 +1716,7 @@ declare const dashboardEventLogDetailResponseSchema: z.ZodObject<{
             lockfile_missing: "lockfile_missing";
             processed: "processed";
             received: "received";
+            shed: "shed";
         }>;
         matchedCount: z.ZodNumber;
         runId: z.ZodNullable<z.ZodString>;
@@ -4367,6 +4442,7 @@ export declare const testRelayRunStatusResponseSchema: z.ZodObject<{
         status: z.ZodString;
         exitCode: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
         errorMessage: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        durationMs: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
     }, z.core.$strip>>>;
     done: z.ZodOptional<z.ZodBoolean>;
     error: z.ZodOptional<z.ZodString>;
@@ -4842,6 +4918,35 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
     }, z.core.$strip>], "type">;
     limit: z.ZodOptional<z.ZodNumber>;
     cursor: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.admin-tokens.list">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+        agent: z.ZodOptional<z.ZodObject<{
+            patId: z.ZodString;
+            label: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+        agent: z.ZodOptional<z.ZodObject<{
+            label: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"run.rerun.request">;
     requestId: z.ZodString;
@@ -6348,6 +6453,7 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
         lockfile_missing: "lockfile_missing";
         processed: "processed";
         received: "received";
+        shed: "shed";
     }>>;
     fromTimestamp: z.ZodOptional<z.ZodString>;
     toTimestamp: z.ZodOptional<z.ZodString>;
@@ -6684,6 +6790,7 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
     actorId: z.ZodOptional<z.ZodString>;
     action: z.ZodOptional<z.ZodEnum<{
         "access_log.list.read": "access_log.list.read";
+        "admin_tokens.list.read": "admin_tokens.list.read";
         archive_chunk: "archive_chunk";
         "artifacts.read": "artifacts.read";
         "attestation.retry": "attestation.retry";
@@ -7582,6 +7689,21 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
     }, z.core.$strip>>;
     nextCursor: z.ZodOptional<z.ZodString>;
     error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.admin-tokens.list.response">;
+    requestId: z.ZodString;
+    tokens: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+        role: z.ZodString;
+        subject: z.ZodNullable<z.ZodString>;
+        routingKey: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+        expiresAt: z.ZodNullable<z.ZodString>;
+        lastUsedAt: z.ZodNullable<z.ZodString>;
+        revoked: z.ZodBoolean;
+    }, z.core.$strip>>;
+    error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"run.rerun.response">;
     requestId: z.ZodString;
@@ -8237,6 +8359,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             lockfile_missing: "lockfile_missing";
             processed: "processed";
             received: "received";
+            shed: "shed";
         }>;
         matchedCount: z.ZodNumber;
         runId: z.ZodNullable<z.ZodString>;
@@ -8286,6 +8409,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             lockfile_missing: "lockfile_missing";
             processed: "processed";
             received: "received";
+            shed: "shed";
         }>;
         matchedCount: z.ZodNumber;
         runId: z.ZodNullable<z.ZodString>;
@@ -8414,6 +8538,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
         actorDisplayName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         action: z.ZodEnum<{
             "access_log.list.read": "access_log.list.read";
+            "admin_tokens.list.read": "admin_tokens.list.read";
             archive_chunk: "archive_chunk";
             "artifacts.read": "artifacts.read";
             "attestation.retry": "attestation.retry";
@@ -8566,6 +8691,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
         status: z.ZodString;
         exitCode: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
         errorMessage: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        durationMs: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
     }, z.core.$strip>>>;
     done: z.ZodOptional<z.ZodBoolean>;
     error: z.ZodOptional<z.ZodString>;
@@ -9015,6 +9141,11 @@ declare const diagnosticsInfraOrchestratorSchema: z.ZodObject<{
         adminInvocation: z.ZodNullable<z.ZodString>;
         adminPath: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>;
+    configPaths: z.ZodOptional<z.ZodObject<{
+        envFile: z.ZodNullable<z.ZodString>;
+        scalerConfig: z.ZodNullable<z.ZodString>;
+        composeFile: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
     s3LogAccess: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
     agentCount: z.ZodNumber;
     runningJobs: z.ZodNumber;
@@ -9125,6 +9256,11 @@ export declare const diagnosticsInfrastructureResponseSchema: z.ZodObject<{
             adminInvocation: z.ZodNullable<z.ZodString>;
             adminPath: z.ZodNullable<z.ZodString>;
         }, z.core.$strip>;
+        configPaths: z.ZodOptional<z.ZodObject<{
+            envFile: z.ZodNullable<z.ZodString>;
+            scalerConfig: z.ZodNullable<z.ZodString>;
+            composeFile: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
         s3LogAccess: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
         agentCount: z.ZodNumber;
         runningJobs: z.ZodNumber;

package/dist/protocol/messages/dashboard.js

@@ -550,6 +550,51 @@ const dashboardSourcesListResponseSchema = z.object({
 	nextCursor: z.string().optional(),
 	error: z.string().optional()
 });
+/**
+* One orchestrator admin token, as the dashboard plane sees it.
+*
+* The projection deliberately carries NO `token_hash` / `tokenHash` field. A
+* hash is a credential verifier: relaying it would put an offline-crackable
+* value on the dashboard plane for a report that has no use for it.
+* `dashboard.test.ts` asserts the absence so a later field addition cannot
+* reintroduce it by accident.
+*/
+const dashboardAdminTokenSummarySchema = z.object({
+	id: z.string(),
+	label: z.string(),
+	/** `owner`, `admin` or `auditor` — the orchestrator's three fixed roles. */
+	role: z.string(),
+	/**
+	* The intended holder the operator recorded at `token create --subject` (an
+	* OIDC `sub` or an email), or null when nobody did. Null is the report's
+	* `unlinked` finding.
+	*/
+	subject: z.string().nullable(),
+	/**
+	* The single routing key this token is restricted to, or null for an
+	* unscoped token. Load-bearing for the report: a routing-key-scoped token is
+	* refused outright on the secret, context, org-settings and trust-policy
+	* routes, so it is materially less privileged than its role alone suggests.
+	*/
+	routingKey: z.string().nullable(),
+	createdAt: z.string(),
+	expiresAt: z.string().nullable(),
+	lastUsedAt: z.string().nullable(),
+	revoked: z.boolean()
+});
+/** Request the orchestrator's admin-token inventory. */
+const dashboardAdminTokensListRequestSchema = z.object({
+	type: z.literal("dashboard.admin-tokens.list"),
+	requestId: z.string(),
+	actor: actorPrincipalSchema
+});
+/** Response with the admin-token inventory. */
+const dashboardAdminTokensListResponseSchema = z.object({
+	type: z.literal("dashboard.admin-tokens.list.response"),
+	requestId: z.string(),
+	tokens: z.array(dashboardAdminTokenSummarySchema),
+	error: z.string().optional()
+});
 /** Request to re-run a completed run. */
 const runRerunRequestSchema = z.object({
 	type: z.literal("run.rerun.request"),
@@ -1995,7 +2040,8 @@ const testRelayRunStatusResponseSchema = z.object({
 		jobName: z.string(),
 		status: z.string(),
 		exitCode: z.number().nullable().optional(),
-		errorMessage: z.string().nullable().optional()
+		errorMessage: z.string().nullable().optional(),
+		durationMs: z.number().nullable().optional()
 	})).optional(),
 	done: z.boolean().optional(),
 	error: z.string().optional()
@@ -2046,6 +2092,7 @@ const dashboardPlatformToOrchSchema = z.discriminatedUnion("type", [
 	dashboardRunsListRequestSchema,
 	dashboardRunsFiltersRequestSchema,
 	dashboardSourcesListRequestSchema,
+	dashboardAdminTokensListRequestSchema,
 	runRerunRequestSchema,
 	manualScheduleRequestSchema,
 	runCancelRequestSchema,
@@ -2123,6 +2170,7 @@ const dashboardOrchToPlatformSchema = z.discriminatedUnion("type", [
 	dashboardRunsListResponseSchema,
 	dashboardRunsFiltersResponseSchema,
 	dashboardSourcesListResponseSchema,
+	dashboardAdminTokensListResponseSchema,
 	runRerunResponseSchema,
 	manualScheduleResponseSchema,
 	runCancelResponseSchema,
@@ -2369,6 +2417,26 @@ const diagnosticsInfraOrchestratorSchema = z.object({
 		adminInvocation: z.string().nullable(),
 		adminPath: z.string().nullable()
 	}),
+	/**
+	* Absolute host paths of this orchestrator's own config files, for an
+	* operator who wants to inspect them.
+	*
+	* Optional, and every member nullable. The Platform always emits the object
+	* — all-nulls when nothing is known — but the field is declared optional
+	* because a customer-installed `kici` CLI validates this same schema and may
+	* be pointed at a Platform that predates the field. Members are null rather
+	* than absent so a reader never has to distinguish "not sent" from "not
+	* known".
+	*
+	* Null for every connection served from the database rather than from a live
+	* in-memory registry entry: these are live-host runtime paths and are not
+	* persisted, the same treatment `deployment.adminInvocation` already gets.
+	*/
+	configPaths: z.object({
+		envFile: z.string().nullable(),
+		scalerConfig: z.string().nullable(),
+		composeFile: z.string().nullable()
+	}).optional(),
 	s3LogAccess: z.boolean().nullable().optional(),
 	agentCount: z.number(),
 	runningJobs: z.number(),
@@ -2529,6 +2597,6 @@ const DashboardResponseErrorCode = z.enum([
 	"internal_error"
 ]);
 //#endregion
-export { ContextDeleteErrorCode, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, HeldRunStatus, TestRelayType, artifactListItemSchema, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, eventLogActivityCountsSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema };
+export { ContextDeleteErrorCode, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, HeldRunStatus, TestRelayType, artifactListItemSchema, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, eventLogActivityCountsSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema };
 
 //# sourceMappingURL=dashboard.js.map

package/dist/protocol/messages/event-log.d.ts

@@ -4,6 +4,11 @@ import { z } from 'zod';
  *
  * - `received` — row written before processing started (e.g. oversized payload
  *   path that records the row but defers further work to the standard pipeline).
+ * - `shed` — the ingest admission controller refused the delivery under load
+ *   before it reached the pipeline. `error_message` names the shed reason. The
+ *   row is a breadcrumb written at shed time so a shed delivery is telling
+ *   apart from one that never arrived; a later successful overflow replay
+ *   upgrades the same row to its real outcome.
  * - `processed` — webhook was processed and at least one workflow was
  *   evaluated. `matched_count` carries how many actually matched.
  * - `duplicate` — dedup cache rejected the delivery.
@@ -22,6 +27,7 @@ export declare const EventLogStatus: z.ZodEnum<{
     lockfile_missing: "lockfile_missing";
     processed: "processed";
     received: "received";
+    shed: "shed";
 }>;
 export type EventLogStatus = z.infer<typeof EventLogStatus>;
 /**

package/dist/protocol/messages/event-log.js

@@ -6,6 +6,11 @@ import { z } from "zod";
 *
 * - `received` — row written before processing started (e.g. oversized payload
 *   path that records the row but defers further work to the standard pipeline).
+* - `shed` — the ingest admission controller refused the delivery under load
+*   before it reached the pipeline. `error_message` names the shed reason. The
+*   row is a breadcrumb written at shed time so a shed delivery is telling
+*   apart from one that never arrived; a later successful overflow replay
+*   upgrades the same row to its real outcome.
 * - `processed` — webhook was processed and at least one workflow was
 *   evaluated. `matched_count` carries how many actually matched.
 * - `duplicate` — dedup cache rejected the delivery.
@@ -19,6 +24,7 @@ import { z } from "zod";
 */
 const EventLogStatus = z.enum([
 	"received",
+	"shed",
 	"processed",
 	"duplicate",
 	"lockfile_missing",

package/dist/protocol/messages/orchestrator-agent.d.ts

@@ -109,10 +109,24 @@ export declare const jobDispatchSchema: z.ZodObject<{
     concurrencyWaitTimeoutMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
     sourceTarUrl: z.ZodOptional<z.ZodString>;
     sourceTarHash: z.ZodOptional<z.ZodString>;
+    sourceTarDigest: z.ZodOptional<z.ZodString>;
     depsUrl: z.ZodOptional<z.ZodString>;
     depsHash: z.ZodOptional<z.ZodString>;
     requestId: z.ZodOptional<z.ZodString>;
     runPublicKey: z.ZodOptional<z.ZodString>;
+    provenanceContext: z.ZodOptional<z.ZodObject<{
+        repository: z.ZodNullable<z.ZodString>;
+        ref: z.ZodNullable<z.ZodString>;
+        sha: z.ZodNullable<z.ZodString>;
+        workflowRef: z.ZodNullable<z.ZodString>;
+        runId: z.ZodString;
+        jobId: z.ZodString;
+        orgId: z.ZodString;
+        sourceOrigin: z.ZodString;
+        provider: z.ZodNullable<z.ZodString>;
+        issuer: z.ZodString;
+        orchestratorId: z.ZodString;
+    }, z.core.$loose>>;
     upstreamJobOutputs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
     upstreamJobStatuses: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<{
         cancelled: "cancelled";
@@ -766,6 +780,16 @@ export declare const fleetLogsRequestSchema: z.ZodObject<{
     logWindowHours: z.ZodNumber;
     maxBytes: z.ZodNumber;
 }, z.core.$strip>;
+/**
+ * The orchestrator dropped the agent's last frame because the connection's
+ * rate limiter refused it. Sent instead of processing the frame; the agent
+ * should wait `retryAfterMs` before sending more. A sustained overrun closes
+ * the connection instead.
+ */
+export declare const rateLimitWarningSchema: z.ZodObject<{
+    type: z.ZodLiteral<"rate.limit.warning">;
+    retryAfterMs: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
 /** One base64 frame of an agent's mini-bundle ZIP. */
 export declare const fleetBundleChunkSchema: z.ZodObject<{
     type: z.ZodLiteral<"fleet.bundle.chunk">;
@@ -870,10 +894,24 @@ export declare const orchestratorToAgentMessageSchema: z.ZodDiscriminatedUnion<[
     concurrencyWaitTimeoutMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
     sourceTarUrl: z.ZodOptional<z.ZodString>;
     sourceTarHash: z.ZodOptional<z.ZodString>;
+    sourceTarDigest: z.ZodOptional<z.ZodString>;
     depsUrl: z.ZodOptional<z.ZodString>;
     depsHash: z.ZodOptional<z.ZodString>;
     requestId: z.ZodOptional<z.ZodString>;
     runPublicKey: z.ZodOptional<z.ZodString>;
+    provenanceContext: z.ZodOptional<z.ZodObject<{
+        repository: z.ZodNullable<z.ZodString>;
+        ref: z.ZodNullable<z.ZodString>;
+        sha: z.ZodNullable<z.ZodString>;
+        workflowRef: z.ZodNullable<z.ZodString>;
+        runId: z.ZodString;
+        jobId: z.ZodString;
+        orgId: z.ZodString;
+        sourceOrigin: z.ZodString;
+        provider: z.ZodNullable<z.ZodString>;
+        issuer: z.ZodString;
+        orchestratorId: z.ZodString;
+    }, z.core.$loose>>;
     upstreamJobOutputs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
     upstreamJobStatuses: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<{
         cancelled: "cancelled";
@@ -1066,6 +1104,9 @@ export declare const orchestratorToAgentMessageSchema: z.ZodDiscriminatedUnion<[
         rejected: "rejected";
     }>;
     reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"rate.limit.warning">;
+    retryAfterMs: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>], "type">;
 /** All messages that flow from Agent to Orchestrator. */
 export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -1220,6 +1261,8 @@ export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[
     platform: z.ZodString;
     arch: z.ZodString;
     depsHash: z.ZodOptional<z.ZodString>;
+    sourceTarDigest: z.ZodOptional<z.ZodString>;
+    siblingsDigest: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"cache.upload.complete">;
     messageId: z.ZodString;
@@ -1233,6 +1276,8 @@ export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[
     platform: z.ZodString;
     arch: z.ZodString;
     depsHash: z.ZodOptional<z.ZodString>;
+    sourceTarDigest: z.ZodOptional<z.ZodString>;
+    siblingsDigest: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"cache.user.restore.request">;
     messageId: z.ZodString;
@@ -1398,6 +1443,7 @@ export type ArtifactsDownloadRequest = z.infer<typeof artifactsDownloadRequestSc
 export type ArtifactsDownloadResponse = z.infer<typeof artifactsDownloadResponseSchema>;
 export type FleetLogsRequest = z.infer<typeof fleetLogsRequestSchema>;
 export type FleetBundleChunk = z.infer<typeof fleetBundleChunkSchema>;
+export type RateLimitWarning = z.infer<typeof rateLimitWarningSchema>;
 export type FleetBundleError = z.infer<typeof fleetBundleErrorSchema>;
 export type ScalerClaimCredentials = z.infer<typeof scalerClaimCredentialsSchema>;
 export type ScalerClaimCredentialsResponse = z.infer<typeof scalerClaimCredentialsResponseSchema>;