@kici-dev/engine 0.7.0 → 0.9.0

package/dist/context/hold-reason.d.ts

@@ -1,14 +1,14 @@
 /**
- * Protection-gate hold-reason templates — the free-text sentence the trust gate
+ * Protection-gate hold-reason template — the free-text sentence the trust gate
  * persists into `held_runs.reason` when a contributor is below a context's
  * `minimumTrust`.
  *
- * Single source of truth for the two sentences: the orchestrator's trust gate
- * emits them, the ci-security DB fixture seeds them, and the unit and E2E
- * assertions compare against them. One copy means a copy edit moves every site
- * at once (`.claude/rules/code-style.md` § "Enums over hardcoded strings").
+ * Single source of truth for the sentence: the orchestrator's trust gate emits
+ * it, the ci-security DB fixture seeds it, and the unit and E2E assertions
+ * compare against it. One copy means a copy edit moves every site at once
+ * (`.claude/rules/code-style.md` § "Enums over hardcoded strings").
  *
- * `held_runs.reason` is a free-text column, so these are functions rather than
+ * `held_runs.reason` is a free-text column, so this is a function rather than
  * an enum: the sentence carries the context name, which is per-hold data.
  *
  * Carries no runtime import on purpose — this module reaches the browser
@@ -17,11 +17,6 @@
  * below is type-only and is erased at compile time.
  */
 import type { TrustTier } from './types.js';
-/**
- * Reason a run is held because the context requires `minimumTrust: 'known'`
- * and the contributor's tier is `unknown`.
- */
-export declare function unknownContributorHoldReason(contextName: string): string;
 /**
  * Reason a run is held because the context requires `minimumTrust: 'trusted'`
  * and the contributor's tier is below that. `trustTier` is the contributor's

package/dist/context/hold-reason.js

@@ -1,13 +1,6 @@
 import "../rolldown-runtime-ClRpJifh.js";
 //#region src/context/hold-reason.ts
 /**
-* Reason a run is held because the context requires `minimumTrust: 'known'`
-* and the contributor's tier is `unknown`.
-*/
-function unknownContributorHoldReason(contextName) {
-	return `Context '${contextName}' requires known contributors (contributor is unknown)`;
-}
-/**
 * Reason a run is held because the context requires `minimumTrust: 'trusted'`
 * and the contributor's tier is below that. `trustTier` is the contributor's
 * actual tier, which the gate has already narrowed to a tier below `trusted` —
@@ -18,6 +11,6 @@ function trustedContributorHoldReason(contextName, trustTier) {
 	return `Context '${contextName}' requires trusted contributors (contributor is ${trustTier})`;
 }
 //#endregion
-export { trustedContributorHoldReason, unknownContributorHoldReason };
+export { trustedContributorHoldReason };
 
 //# sourceMappingURL=hold-reason.js.map

package/dist/context/index.d.ts

@@ -1,7 +1,7 @@
-export type { Context, ContextBinding, ContextVariable, ContextSourceOverride, ScopedSecret, HeldRun, ProtectionGateResult, TrustTier, } from './types.js';
-export { TrustTierSchema } from './types.js';
+export type { Context, ContextBinding, ContextVariable, ContextSourceOverride, ScopedSecret, HeldRun, ProtectionGateResult, TrustTier, MinimumTrust, } from './types.js';
+export { TrustTierSchema, MinimumTrustSchema } from './types.js';
 export { HoldType, normalizePersistedHoldType, persistedHoldTypeSpellings } from './hold-type.js';
-export { trustedContributorHoldReason, unknownContributorHoldReason } from './hold-reason.js';
+export { trustedContributorHoldReason } from './hold-reason.js';
 export { HeldRunStatus } from './held-run-status.js';
 export { WORKFLOW_MODIFICATION_JOB_ID, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, isSecurityHoldJobId, INSTALL_JOB_ID_PREFIX, installGateJobId, } from './held-run-job-id.js';
 export { ConcurrencyStrategy, DEFAULT_CONCURRENCY_STRATEGY } from './concurrency-strategy.js';

package/dist/context/index.js

@@ -1,13 +1,13 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import { HeldRunStatus } from "./held-run-status.js";
 import { HoldType, normalizePersistedHoldType, persistedHoldTypeSpellings } from "./hold-type.js";
-import { TrustTierSchema } from "./types.js";
+import { MinimumTrustSchema, TrustTierSchema } from "./types.js";
 import { ConcurrencyStrategy, DEFAULT_CONCURRENCY_STRATEGY } from "./concurrency-strategy.js";
-import { trustedContributorHoldReason, unknownContributorHoldReason } from "./hold-reason.js";
+import { trustedContributorHoldReason } from "./hold-reason.js";
 import { INSTALL_JOB_ID_PREFIX, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, WORKFLOW_MODIFICATION_JOB_ID, installGateJobId, isSecurityHoldJobId } from "./held-run-job-id.js";
 import { DEFAULT_HOLD_EXPIRY_SECONDS } from "./hold-expiry.js";
 import { matchScopePattern, resolveSecretsForContext, resolveSecretsWithProvenance, stripScopePrefix } from "./scope-resolver.js";
 import { ContextGateRejectReason, mergeOrderedMaps } from "./multi-context.js";
 import { SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, ScopeNameError, assertValidScopeName, validateScopeName } from "./scope-name.js";
 import { SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SecretKeyError, assertValidSecretKey, validateSecretKey } from "./secret-key.js";
-export { ConcurrencyStrategy, ContextGateRejectReason, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, HeldRunStatus, HoldType, INSTALL_JOB_ID_PREFIX, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, ScopeNameError, SecretKeyError, TrustTierSchema, WORKFLOW_MODIFICATION_JOB_ID, assertValidScopeName, assertValidSecretKey, installGateJobId, isSecurityHoldJobId, matchScopePattern, mergeOrderedMaps, normalizePersistedHoldType, persistedHoldTypeSpellings, resolveSecretsForContext, resolveSecretsWithProvenance, stripScopePrefix, trustedContributorHoldReason, unknownContributorHoldReason, validateScopeName, validateSecretKey };
+export { ConcurrencyStrategy, ContextGateRejectReason, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, HeldRunStatus, HoldType, INSTALL_JOB_ID_PREFIX, MinimumTrustSchema, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, ScopeNameError, SecretKeyError, TrustTierSchema, WORKFLOW_MODIFICATION_JOB_ID, assertValidScopeName, assertValidSecretKey, installGateJobId, isSecurityHoldJobId, matchScopePattern, mergeOrderedMaps, normalizePersistedHoldType, persistedHoldTypeSpellings, resolveSecretsForContext, resolveSecretsWithProvenance, stripScopePrefix, trustedContributorHoldReason, validateScopeName, validateSecretKey };

package/dist/context/types.d.ts

@@ -26,7 +26,7 @@ export interface Context {
     waitTimerSeconds: number | null;
     holdExpirySeconds: number;
     /** Minimum trust tier required for CI execution in this context. */
-    minimumTrust?: 'known' | 'trusted';
+    minimumTrust?: 'trusted';
     /** Whether this context allows local (no-remote) executions. Default false. */
     allowLocalExecution?: boolean;
     enabled: boolean;
@@ -84,21 +84,23 @@ export interface ContextSourceOverride {
     updatedAt: string;
 }
 /**
- * Trust tier for CI execution gating (single source of truth).
- *
- * `'known'` is legacy vocabulary: the orchestrator's ref-based trust resolution
- * produces only `'trusted'` (a ref in the base repo) and `'unknown'` (a ref
- * from a fork). It still reaches runtime from a stored
- * `execution_runs.trust_tier` row an internal event inherits, and a context can
- * still declare it as its `minimumTrust` floor. It is slated for removal at
- * v1.0.0, after which trust is a two-value vocabulary.
+ * Trust tier for CI execution gating (single source of truth). Trust is
+ * ref-based: a ref in the base repo is `'trusted'`, a ref from a fork is
+ * `'unknown'`.
  */
 export declare const TrustTierSchema: z.ZodEnum<{
-    known: "known";
     trusted: "trusted";
     unknown: "unknown";
 }>;
 export type TrustTier = z.infer<typeof TrustTierSchema>;
+/**
+ * The one `minimumTrust` requirement a context can carry, as it travels on the
+ * wire and in the row: `'trusted'` sets it, `null` clears it. The trust gate
+ * holds a run whose ref resolved as a fork; a context that sets no requirement
+ * passes every run.
+ */
+export declare const MinimumTrustSchema: z.ZodNullable<z.ZodLiteral<"trusted">>;
+export type MinimumTrust = z.infer<typeof MinimumTrustSchema>;
 /** Held run record for protection gate enforcement. */
 export interface HeldRun {
     id: string;

package/dist/context/types.js

@@ -8,21 +8,19 @@ import { z } from "zod";
 * and protection rules for deployment targets (dev, staging, production).
 */
 /**
-* Trust tier for CI execution gating (single source of truth).
-*
-* `'known'` is legacy vocabulary: the orchestrator's ref-based trust resolution
-* produces only `'trusted'` (a ref in the base repo) and `'unknown'` (a ref
-* from a fork). It still reaches runtime from a stored
-* `execution_runs.trust_tier` row an internal event inherits, and a context can
-* still declare it as its `minimumTrust` floor. It is slated for removal at
-* v1.0.0, after which trust is a two-value vocabulary.
+* Trust tier for CI execution gating (single source of truth). Trust is
+* ref-based: a ref in the base repo is `'trusted'`, a ref from a fork is
+* `'unknown'`.
+*/
+const TrustTierSchema = z.enum(["trusted", "unknown"]);
+/**
+* The one `minimumTrust` requirement a context can carry, as it travels on the
+* wire and in the row: `'trusted'` sets it, `null` clears it. The trust gate
+* holds a run whose ref resolved as a fork; a context that sets no requirement
+* passes every run.
 */
-const TrustTierSchema = z.enum([
-	"trusted",
-	"known",
-	"unknown"
-]);
+const MinimumTrustSchema = z.literal("trusted").nullable();
 //#endregion
-export { TrustTierSchema };
+export { MinimumTrustSchema, TrustTierSchema };
 
 //# sourceMappingURL=types.js.map

package/dist/index.d.ts

@@ -11,6 +11,7 @@ export * from './protocol/version.js';
 export * from './protocol/source-origin.js';
 export * from './provenance/attestation-origin.js';
 export * from './provenance/id-token-event-claims.js';
+export * from './provenance/id-token-claim-names.js';
 export * from './protocol/messages/common.js';
 export * from './protocol/messages/actor.js';
 export * from './protocol/messages/pat-kind.js';

package/dist/index.js

@@ -1,10 +1,11 @@
 import "./rolldown-runtime-ClRpJifh.js";
 import { CheckMode, CheckStepOutcome } from "./check-mode.js";
-import { FORK_POLICY_IGNORE_MIN_PROTOCOL_VERSION, MIN_PROTOCOL_VERSION, PROTOCOL_VERSION } from "./protocol/version.js";
+import { MIN_PROTOCOL_VERSION, PROTOCOL_VERSION } from "./protocol/version.js";
 import { SourceOrigin } from "./protocol/source-origin.js";
 import { AttestationOrigin } from "./provenance/attestation-origin.js";
 import { PULL_REQUEST_FAMILY_TRIGGER_EVENTS, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, isPullRequestFamilyTriggerEvent } from "./trigger/trigger-event-type.js";
 import { UNRESOLVED_CLAIM, buildEventClaims, buildIdTokenSubject, provenanceContextSchema } from "./provenance/id-token-event-claims.js";
+import { ID_TOKEN_CLAIM_NAMES } from "./provenance/id-token-claim-names.js";
 import { NACK_EXEMPT_MESSAGE_TYPES, WS_MAX_PAYLOAD_BYTES, ackSchema, buildUnsupportedMessageNack, errorSchema, heartbeatSchema, nackSchema } from "./protocol/messages/common.js";
 import { ACTOR_AGENT_SUFFIX, ActorType, actorPrincipalSchema, agentLabelOf, apiKeyActorSchema, flattenActor, parseActor, platformOperatorActorSchema, serviceAccountActorSchema, stringifyActor, systemActorSchema, userActorSchema } from "./protocol/messages/actor.js";
 import { PatKind } from "./protocol/messages/pat-kind.js";
@@ -14,7 +15,7 @@ import { HoldType, normalizePersistedHoldType, persistedHoldTypeSpellings } from
 import { resolveHeldRunId } from "./mcp/held-run-resolve.js";
 import { renderFenced } from "./mcp/fence.js";
 import { CONTEXTS_MAX, CacheOutcome, CacheRunEventType, CacheStepType, DEAD_ORCH_FAILURE_REASON, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, JobKind, MAX_JOBS_PER_RUN, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RunFailureClass, STATE_REPLAY_MAX_RUNS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, SetupStepType, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, isSetupStepType, jobStatusForwardSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepStatusForwardSchema } from "./protocol/messages/execution-status.js";
-import { TrustTierSchema } from "./context/types.js";
+import { MinimumTrustSchema, TrustTierSchema } from "./context/types.js";
 import { AgentFailureCategory, agentJobResultSchema, agentRunListItemSchema, agentRunResultSchema, agentStepLogsSchema, agentStepResultSchema, agentWorkflowSummarySchema, untrusted, wrapUntrusted } from "./protocol/messages/agent-run-result.js";
 import { AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, accessLogFilterSchema, accessLogItemSchema, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema } from "./protocol/messages/access-log.js";
 import { browserJobContextSchema, browserRunEventSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, jobContextMessageSchema, runEventMessageSchema } from "./protocol/messages/run-events.js";
@@ -25,7 +26,7 @@ import { OWN_INGRESS_MODES, OrchestratorMode, PLATFORM_CONNECTED_MODES, RELAY_IN
 import { INTERNAL_EVENT_NAME_PREFIX, KICI_EVENT_NAME_PREFIX, ScalerBackendType, reservedEventNamePrefix } from "./scaler/scaler-backend-type.js";
 import { ApprovalDecision, HoldScope, TriggerSource, approvalRequirementSchema, approvalTimeoutSecondsSchema, approverClauseSchema } from "./approval/types.js";
 import { CANONICAL_STATUSES, LEGACY_STATUS_ALIASES, STATUS_FAILURE_CLASS, STATUS_PRECEDENCE, StatusFailureClass, isFailureStatus, toCanonicalStatus, worstStatus } from "./status/presentation.js";
-import { BREAKING_FLOOR, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, changedFilesStatusSchema, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, resolveContentFormat, resolveWhenToRunOn } from "./trigger/types.js";
+import { BREAKING_FLOOR, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, changedFilesStatusSchema, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, resolveContentFormat, resolveWhenToRunOn } from "./trigger/types.js";
 import { canonicalizeLabel, canonicalizeLabelSet, canonicalizeLabels } from "./labels-canonical.js";
 import { normalizeRegexFlags, stripStatefulRegexFlags } from "./regex-flags.js";
 import { HostTargetSelector, HostTargetValue, LabelMatcher, canonicalizeMatcher, compileRegexMatcher, hostSatisfiesTarget, matcherMatches, matcherSatisfiedBy, partitionMatchers } from "./labels-match.js";
@@ -49,7 +50,7 @@ import { EVENT_LOG_PAYLOAD_CHUNK_BYTES } from "./protocol/event-log-payload.js";
 import { browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, platformToBrowserMessageSchema } from "./protocol/messages/browser.js";
 import { joinRequestSchema, joinResponseSchema } from "./protocol/messages/join.js";
 import { fleetSelectionSchema, jobProgressAckSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, workerClusterSettingsSchema } from "./protocol/messages/peer.js";
-import { ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactRejectReason, ArtifactUploadOutcome, CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, invokeResultSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, scalerClaimCredentialsResponseSchema, scalerClaimCredentialsSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema } from "./protocol/messages/orchestrator-agent.js";
+import { ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactRejectReason, ArtifactUploadOutcome, CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, invokeResultSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, rateLimitWarningSchema, registerAckSchema, scalerClaimCredentialsResponseSchema, scalerClaimCredentialsSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema } from "./protocol/messages/orchestrator-agent.js";
 import { KNOWN_LINUX_CAPABILITIES, canonicalizeCapability, isKnownCapability } from "./sandbox/capabilities.js";
 import { compileSafeRegex, describeTextMatch, evaluateTextMatch, textMatchHasQuery } from "./trigger/text-match.js";
 import { REDACTED_TRACE_FIELD, TRACE_TEXT_MAX, TRACE_TRUNCATION_WORKFLOW_NAME, TraceCheck, TraceVerdict, appendChecks, createCommitMessageTraceEntry, createContentRequirementsTraceEntry, createDispatchFailureTraceEntry, createGlobalFilterTraceEntry, createTraceEntry, createTraceTruncationMarker, createWorkflowDecision, truncateDecisionsToByteBudget, truncateTraceText, utf8ByteLength } from "./trigger/decision-trace.js";
@@ -73,7 +74,7 @@ import { WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAM
 import { WsRateLimiter } from "./ws/rate-limiter.js";
 import { AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, KICI_AGENT_ENV_PREFIX, SANDBOX_DEFAULT_VARS, TRUSTED_ENV_SCRUB_EXACT, buildTrustedPassthroughEnv, isTrustedEnvScrubbed } from "./env/environment-allowlist.js";
 import "./secrets/index.js";
-import { trustedContributorHoldReason, unknownContributorHoldReason } from "./context/hold-reason.js";
+import { trustedContributorHoldReason } from "./context/hold-reason.js";
 import { INSTALL_JOB_ID_PREFIX, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, WORKFLOW_MODIFICATION_JOB_ID, installGateJobId, isSecurityHoldJobId } from "./context/held-run-job-id.js";
 import { DEFAULT_HOLD_EXPIRY_SECONDS } from "./context/hold-expiry.js";
 import { matchScopePattern, resolveSecretsForContext, resolveSecretsWithProvenance, stripScopePrefix } from "./context/scope-resolver.js";
@@ -94,4 +95,4 @@ import { ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, ArtifactNameSch
 import { PLAN_TYPES, PaidPlanType, PlanType, isPaidTier, planRank } from "./billing/plan-type.js";
 import { SUBSCRIPTION_EXISTS_CODE, StripeSubscriptionStatus, blocksNewCheckout } from "./billing/subscription-status.js";
 import { INFRA_ALERT_TYPES, InfraAlertSeverity, InfraAlertType, normalizeInfraAlertSeverity } from "./diagnostics/infra-alert.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, ACTOR_AGENT_SUFFIX, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentFailureCategory, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactNameSchema, ArtifactRejectReason, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CAPABILITY_LABEL_PREFIX, CLUSTER_MEMBERSHIP_MAX_WORKERS, CONTAINER_BUILD_RUNTIME_LABEL, CONTEXTS_MAX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, CiTrustLevel, ConcurrencyStrategy, ConfigPathsSchema, ContextDeleteErrorCode, ContextGateRejectReason, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DEAD_ORCH_FAILURE_REASON, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_APPROVAL_EXPIRY_SECONDS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DEVELOPER_OPERATIONS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FORK_POLICY_IGNORE_MIN_PROTOCOL_VERSION, FanoutCause, FanoutError, FleetHostDisposition, ForkPolicy, HEARTBEAT_CLOSE_MS, HEARTBEAT_DEGRADED_MS, HEARTBEAT_FRESH_MS, HEARTBEAT_STALE_THRESHOLD_SECONDS, HEARTBEAT_UNHEALTHY_MARK_MS, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, INFRA_ALERT_TYPES, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, INSTALL_JOB_ID_PREFIX, INTERNAL_EVENT_NAME_PREFIX, InfraAlertSeverity, InfraAlertType, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobKind, JobRejectReason, KICI_AGENT_ENV_PREFIX, KICI_EVENT_NAME_PREFIX, KNOWN_LINUX_CAPABILITIES, KNOWN_ROLES, LEGACY_STATUS_ALIASES, LabelMatcher, LockFileParseError, LogStream, MAX_APPROVAL_EXPIRY_HOURS, MAX_APPROVAL_EXPIRY_SECONDS, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MAX_MATRIX_MATERIALIZATION, MIN_APPROVAL_EXPIRY_SECONDS, MIN_PROTOCOL_VERSION, MatrixShapeError, NACK_EXEMPT_MESSAGE_TYPES, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OWN_INGRESS_MODES, OnUnreachableMode, OrchLogPhase, OrchRole, OrchestratorMode, PING_EVENT_TYPE, PLAN_TYPES, PLATFORM_CAPABILITIES, PLATFORM_CONNECTED_MODES, PLATFORM_TAINT_LABELS, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PULL_REQUEST_FAMILY_TRIGGER_EVENTS, PaidPlanType, PatKind, PayloadOmittedReason, PlanType, REDACTED_TRACE_FIELD, REGEX_NEGATIVE_ASSERTION, RELAY_INGRESS_MODES, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RUNTIME_LABEL_PREFIX, RegisterableTriggerType, RunFailureClass, RunsOnPick, RuntimeFact, SANDBOX_DEFAULT_VARS, SANDBOX_NETWORK_MODES, SCALER_EVENT_NAMES, SCHEMA_VERSION, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECONDS_PER_HOUR, SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_FAILURE_CLASS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, STATUS_PRECEDENCE, SUBSCRIBABLE_WEBHOOK_EVENT_TYPES, SUBSCRIPTION_EXISTS_CODE, ScaleDownReason, ScalerArch, ScalerBackendType, ScalerEventType, ScalerOs, ScalerScaleDownPayload, ScalerScaleUpPayload, ScopeNameError, SecretKeyError, SetupStepType, SourceOrigin, SourceProvider, SourceSubtype, StatusFailureClass, StepApprovalOutcome, StepConcurrencyKind, StripeSubscriptionStatus, SubscribableWebhookEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TRACE_TEXT_MAX, TRACE_TRUNCATION_WORKFLOW_NAME, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TRIGGER_TYPE_TO_EVENT_TYPES, TRUSTED_ENV_SCRUB_EXACT, TestRelayType, TimeoutReason, TraceCheck, TraceVerdict, TriggerSource, TrustTierSchema, UNRESOLVED_CLAIM, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WORKFLOW_MODIFICATION_JOB_ID, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_SUPERSEDED_BY_RECONNECT, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookEventType, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentJobResultSchema, agentLabelOf, agentLogChunkSchema, agentMetricsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentRegisterSchema, agentRunListItemSchema, agentRunResultSchema, agentSecretScopeSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, agentWorkflowSummarySchema, apiKeyActorSchema, appendChecks, applyIncludeExclude, approvalExpiryHoursOf, approvalExpirySecondsOf, approvalRequirementSchema, approvalTimeoutSecondsSchema, approveRunToolSchema, approverClauseSchema, artifactInvalidNameError, artifactListItemSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, assertScheduleInputsSatisfiable, assertValidScopeName, assertValidSecretKey, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, blocksNewCheckout, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildEventClaims, buildIdTokenSubject, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, canonicalizeCapability, canonicalizeLabel, canonicalizeLabelSet, canonicalizeLabels, canonicalizeMatcher, capabilityLabel, changedFilesStatusSchema, checkArtifactName, clusterMembershipSchema, coerceDispatchInputs, coerceHostPropertyValue, collectDiscriminatorTypes, compileRegexMatcher, compileSafeRegex, configAckSchema, connectionHealthStatusSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, createCommitMessageTraceEntry, createContentRequirementsTraceEntry, createDispatchFailureTraceEntry, createGlobalFilterTraceEntry, createTraceEntry, createTraceTruncationMarker, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, derivePlatformTaints, describeTextMatch, developerOpsForEntrypoint, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, errorSchema, evaluateTextMatch, eventEmitResponseSchema, eventEmitSchema, eventLogActivityCountsSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, findDuplicateCombination, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getDiagnosticsToolSchema, getRepoGlobMatcher, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubIngressPath, githubWebhookPath, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, installGateJobId, invokeResultSchema, isFailureStatus, isInputSatisfiableFromDefaults, isKnownCapability, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, isMintedRef, isNegatedPattern, isPaidTier, isPullRequestFamilyTriggerEvent, isSecurityHoldJobId, isSelfReportedLabel, isSetupStepType, isTrustedEnvScrubbed, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchTrigger, matchWorkflowTriggers, matchWorkflowsForEvent, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixCombinationCount, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, negatedPatternReason, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeInfraAlertSeverity, normalizeMatrixInput, normalizePersistedHoldType, normalizeRegexFlags, normalizeRunsOn, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, persistedHoldTypeSpellings, planHeadroomSchema, planRank, platformCapabilitiesMessageSchema, platformCapabilitiesSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, prepareEventBuckets, provenanceContextSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rejectRunToolSchema, renderFenced, rerunRunToolSchema, reservedEventNamePrefix, resolveContentFormat, resolveHeldRunId, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForContext, resolveSecretsWithProvenance, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, runtimeLabel, scalerAgentLabels, scalerClaimCredentialsResponseSchema, scalerClaimCredentialsSchema, scalerLabel, scalerPlatformSchema, scheduleTriggerKey, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, stripStatefulRegexFlags, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, textMatchHasQuery, toCanonicalStatus, triggerRunToolSchema, truncateDecisionsToByteBudget, truncateTraceText, trustPolicyResponseSchema, trustPolicySchema, trustPolicyUpdateSchema, trustedContributorHoldReason, unknownContributorHoldReason, untrusted, upstreamSnapshotSchema, userActorSchema, utf8ByteLength, validateNoReservedLabels, validateResourceRequest, validateScopeName, validateSecretKey, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, workerClusterSettingsSchema, worstStatus, wrapUntrusted };
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, ACTOR_AGENT_SUFFIX, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentFailureCategory, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactNameSchema, ArtifactRejectReason, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CAPABILITY_LABEL_PREFIX, CLUSTER_MEMBERSHIP_MAX_WORKERS, CONTAINER_BUILD_RUNTIME_LABEL, CONTEXTS_MAX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, CiTrustLevel, ConcurrencyStrategy, ConfigPathsSchema, ContextDeleteErrorCode, ContextGateRejectReason, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DEAD_ORCH_FAILURE_REASON, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_APPROVAL_EXPIRY_SECONDS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DEVELOPER_OPERATIONS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, ForkPolicy, HEARTBEAT_CLOSE_MS, HEARTBEAT_DEGRADED_MS, HEARTBEAT_FRESH_MS, HEARTBEAT_STALE_THRESHOLD_SECONDS, HEARTBEAT_UNHEALTHY_MARK_MS, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, ID_TOKEN_CLAIM_NAMES, INFRA_ALERT_TYPES, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, INSTALL_JOB_ID_PREFIX, INTERNAL_EVENT_NAME_PREFIX, InfraAlertSeverity, InfraAlertType, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobKind, JobRejectReason, KICI_AGENT_ENV_PREFIX, KICI_EVENT_NAME_PREFIX, KNOWN_LINUX_CAPABILITIES, KNOWN_ROLES, LEGACY_STATUS_ALIASES, LabelMatcher, LockFileParseError, LogStream, MAX_APPROVAL_EXPIRY_HOURS, MAX_APPROVAL_EXPIRY_SECONDS, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MAX_MATRIX_MATERIALIZATION, MIN_APPROVAL_EXPIRY_SECONDS, MIN_PROTOCOL_VERSION, MatrixShapeError, MinimumTrustSchema, NACK_EXEMPT_MESSAGE_TYPES, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OWN_INGRESS_MODES, OnUnreachableMode, OrchLogPhase, OrchRole, OrchestratorMode, PING_EVENT_TYPE, PLAN_TYPES, PLATFORM_CAPABILITIES, PLATFORM_CONNECTED_MODES, PLATFORM_TAINT_LABELS, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PULL_REQUEST_FAMILY_TRIGGER_EVENTS, PaidPlanType, PatKind, PayloadOmittedReason, PlanType, REDACTED_TRACE_FIELD, REGEX_NEGATIVE_ASSERTION, RELAY_INGRESS_MODES, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RUNTIME_LABEL_PREFIX, RegisterableTriggerType, RunFailureClass, RunsOnPick, RuntimeFact, SANDBOX_DEFAULT_VARS, SANDBOX_NETWORK_MODES, SCALER_EVENT_NAMES, SCHEMA_VERSION, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECONDS_PER_HOUR, SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_FAILURE_CLASS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, STATUS_PRECEDENCE, SUBSCRIBABLE_WEBHOOK_EVENT_TYPES, SUBSCRIPTION_EXISTS_CODE, ScaleDownReason, ScalerArch, ScalerBackendType, ScalerEventType, ScalerOs, ScalerScaleDownPayload, ScalerScaleUpPayload, ScopeNameError, SecretKeyError, SetupStepType, SourceOrigin, SourceProvider, SourceSubtype, StatusFailureClass, StepApprovalOutcome, StepConcurrencyKind, StripeSubscriptionStatus, SubscribableWebhookEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TRACE_TEXT_MAX, TRACE_TRUNCATION_WORKFLOW_NAME, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TRIGGER_TYPE_TO_EVENT_TYPES, TRUSTED_ENV_SCRUB_EXACT, TestRelayType, TimeoutReason, TraceCheck, TraceVerdict, TriggerSource, TrustTierSchema, UNRESOLVED_CLAIM, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WORKFLOW_MODIFICATION_JOB_ID, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_SUPERSEDED_BY_RECONNECT, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookEventType, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentJobResultSchema, agentLabelOf, agentLogChunkSchema, agentMetricsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentRegisterSchema, agentRunListItemSchema, agentRunResultSchema, agentSecretScopeSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, agentWorkflowSummarySchema, apiKeyActorSchema, appendChecks, applyIncludeExclude, approvalExpiryHoursOf, approvalExpirySecondsOf, approvalRequirementSchema, approvalTimeoutSecondsSchema, approveRunToolSchema, approverClauseSchema, artifactInvalidNameError, artifactListItemSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, assertScheduleInputsSatisfiable, assertValidScopeName, assertValidSecretKey, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, blocksNewCheckout, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildEventClaims, buildIdTokenSubject, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, canonicalizeCapability, canonicalizeLabel, canonicalizeLabelSet, canonicalizeLabels, canonicalizeMatcher, capabilityLabel, changedFilesStatusSchema, checkArtifactName, clusterMembershipSchema, coerceDispatchInputs, coerceHostPropertyValue, collectDiscriminatorTypes, compileRegexMatcher, compileSafeRegex, configAckSchema, connectionHealthStatusSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, createCommitMessageTraceEntry, createContentRequirementsTraceEntry, createDispatchFailureTraceEntry, createGlobalFilterTraceEntry, createTraceEntry, createTraceTruncationMarker, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, derivePlatformTaints, describeTextMatch, developerOpsForEntrypoint, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, errorSchema, evaluateTextMatch, eventEmitResponseSchema, eventEmitSchema, eventLogActivityCountsSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, findDuplicateCombination, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getDiagnosticsToolSchema, getRepoGlobMatcher, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubIngressPath, githubWebhookPath, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, installGateJobId, invokeResultSchema, isFailureStatus, isInputSatisfiableFromDefaults, isKnownCapability, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, isMintedRef, isNegatedPattern, isPaidTier, isPullRequestFamilyTriggerEvent, isSecurityHoldJobId, isSelfReportedLabel, isSetupStepType, isTrustedEnvScrubbed, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchTrigger, matchWorkflowTriggers, matchWorkflowsForEvent, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixCombinationCount, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, negatedPatternReason, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeInfraAlertSeverity, normalizeMatrixInput, normalizePersistedHoldType, normalizeRegexFlags, normalizeRunsOn, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, persistedHoldTypeSpellings, planHeadroomSchema, planRank, platformCapabilitiesMessageSchema, platformCapabilitiesSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, prepareEventBuckets, provenanceContextSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, rateLimitWarningSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rejectRunToolSchema, renderFenced, rerunRunToolSchema, reservedEventNamePrefix, resolveContentFormat, resolveHeldRunId, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForContext, resolveSecretsWithProvenance, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, runtimeLabel, scalerAgentLabels, scalerClaimCredentialsResponseSchema, scalerClaimCredentialsSchema, scalerLabel, scalerPlatformSchema, scheduleTriggerKey, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, stripStatefulRegexFlags, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, textMatchHasQuery, toCanonicalStatus, triggerRunToolSchema, truncateDecisionsToByteBudget, truncateTraceText, trustPolicyResponseSchema, trustPolicySchema, trustPolicyUpdateSchema, trustedContributorHoldReason, untrusted, upstreamSnapshotSchema, userActorSchema, utf8ByteLength, validateNoReservedLabels, validateResourceRequest, validateScopeName, validateSecretKey, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, workerClusterSettingsSchema, worstStatus, wrapUntrusted };

package/dist/metrics/catalog-policy.js

@@ -191,8 +191,8 @@ const METRIC_LABEL_POLICY = {
 		provider: { values: ["static"] },
 		scope: { maxUniqueValues: 100 }
 	},
-	kici_orch_container_registry_auth_contributor_stripped_total: { trust_tier: { values: ["unknown", "known"] } },
-	kici_orch_install_secrets_contributor_stripped_total: { trust_tier: { values: ["unknown", "known"] } },
+	kici_orch_container_registry_auth_contributor_stripped_total: { trust_tier: { values: ["unknown"] } },
+	kici_orch_install_secrets_contributor_stripped_total: { trust_tier: { values: ["unknown"] } },
 	kici_orch_install_secrets_token_resolution_duration_seconds: { environment: { maxUniqueValues: 50 } },
 	kici_cross_source_errors_total: { reason: { values: ["clone_token", "bundle_missing"] } },
 	kici_cross_source_fanout_size: { event: { maxUniqueValues: 50 } },

package/dist/protocol/dashboard-write-operations.d.ts

@@ -134,15 +134,6 @@ export declare const DashboardWritePolicyState: z.ZodEnum<{
     permissive: "permissive";
 }>;
 export type DashboardWritePolicyState = z.infer<typeof DashboardWritePolicyState>;
-/**
- * Coerce a single stored / on-the-wire policy value to a
- * {@link DashboardWritePolicyState}. Older orchestrators (and pre-migration
- * JSONB rows) carry the legacy boolean shape: `true` (enabled/permissive) and
- * `false` (disabled). New peers carry the enum string directly. This keeps the
- * protected wire + storage surfaces backward-compatible during the deprecation
- * window — a boolean is never rejected, it is translated.
- */
-export declare function coerceDashboardWritePolicyValue(value: unknown): DashboardWritePolicyState;
 /**
  * Map of operation → posture. Omitted operations default to `permissive`.
  * The orch persists this shape verbatim as JSONB; the Platform mirrors it in
@@ -150,9 +141,8 @@ export declare function coerceDashboardWritePolicyValue(value: unknown): Dashboa
  */
 export type DashboardWritePolicyMap = Partial<Record<DashboardWriteOperation, DashboardWritePolicyState>>;
 /**
- * Validates a sparse policy map. Accepts BOTH the enum-string shape and the
- * legacy boolean shape (coerced), so an older orchestrator's boolean map and a
- * pre-migration JSONB row both parse. `encrypted` is rejected for any operation
+ * Validates a sparse policy map. Every value is a
+ * {@link DashboardWritePolicyState}; `encrypted` is rejected for any operation
  * whose sensitivity is not `plaintext` (nothing to seal without a plaintext
  * payload; the signing half that would cover authority/dispatch ops is a
  * separate feature). Use this where the value is required but may be empty
@@ -160,7 +150,7 @@ export type DashboardWritePolicyMap = Partial<Record<DashboardWriteOperation, Da
  * embed `dashboardWritePolicyMap` directly with `.optional()` so omission stays
  * as `undefined` rather than being coerced to `{}`.
  */
-export declare const dashboardWritePolicyMap: z.ZodPipe<z.ZodRecord<z.ZodEnum<{
+export declare const dashboardWritePolicyMap: z.ZodRecord<z.ZodEnum<{
     "attestations.retry": "attestations.retry";
     "backends.sync": "backends.sync";
     "backends.sync_one": "backends.sync_one";
@@ -188,12 +178,12 @@ export declare const dashboardWritePolicyMap: z.ZodPipe<z.ZodRecord<z.ZodEnum<{
     "secrets.set": "secrets.set";
     "variables.delete": "variables.delete";
     "variables.set": "variables.set";
-}> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodEnum<{
+}> & z.core.$partial, z.ZodEnum<{
     disabled: "disabled";
     encrypted: "encrypted";
     permissive: "permissive";
-}>]>>, z.ZodTransform<Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive">>, Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive" | boolean>>>>;
-export declare const dashboardWritePolicyMapSchema: z.ZodDefault<z.ZodPipe<z.ZodRecord<z.ZodEnum<{
+}>>;
+export declare const dashboardWritePolicyMapSchema: z.ZodDefault<z.ZodRecord<z.ZodEnum<{
     "attestations.retry": "attestations.retry";
     "backends.sync": "backends.sync";
     "backends.sync_one": "backends.sync_one";
@@ -221,11 +211,11 @@ export declare const dashboardWritePolicyMapSchema: z.ZodDefault<z.ZodPipe<z.Zod
     "secrets.set": "secrets.set";
     "variables.delete": "variables.delete";
     "variables.set": "variables.set";
-}> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodEnum<{
+}> & z.core.$partial, z.ZodEnum<{
     disabled: "disabled";
     encrypted: "encrypted";
     permissive: "permissive";
-}>]>>, z.ZodTransform<Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive">>, Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive" | boolean>>>>>;
+}>>>;
 /**
  * Resolve the effective posture of an operation given a (possibly sparse)
  * policy map. Treats `undefined` as the permissive default.

package/dist/protocol/dashboard-write-operations.js

@@ -367,23 +367,8 @@ const DashboardWritePolicyState = z.enum([
 	"disabled"
 ]);
 /**
-* Coerce a single stored / on-the-wire policy value to a
-* {@link DashboardWritePolicyState}. Older orchestrators (and pre-migration
-* JSONB rows) carry the legacy boolean shape: `true` (enabled/permissive) and
-* `false` (disabled). New peers carry the enum string directly. This keeps the
-* protected wire + storage surfaces backward-compatible during the deprecation
-* window — a boolean is never rejected, it is translated.
-*/
-function coerceDashboardWritePolicyValue(value) {
-	if (value === true) return "permissive";
-	if (value === false) return "disabled";
-	const parsed = DashboardWritePolicyState.safeParse(value);
-	return parsed.success ? parsed.data : "permissive";
-}
-/**
-* Validates a sparse policy map. Accepts BOTH the enum-string shape and the
-* legacy boolean shape (coerced), so an older orchestrator's boolean map and a
-* pre-migration JSONB row both parse. `encrypted` is rejected for any operation
+* Validates a sparse policy map. Every value is a
+* {@link DashboardWritePolicyState}; `encrypted` is rejected for any operation
 * whose sensitivity is not `plaintext` (nothing to seal without a plaintext
 * payload; the signing half that would cover authority/dispatch ops is a
 * separate feature). Use this where the value is required but may be empty
@@ -391,11 +376,7 @@ function coerceDashboardWritePolicyValue(value) {
 * embed `dashboardWritePolicyMap` directly with `.optional()` so omission stays
 * as `undefined` rather than being coerced to `{}`.
 */
-const dashboardWritePolicyMap = z.partialRecord(DashboardWriteOperation, z.union([z.boolean(), DashboardWritePolicyState])).transform((map) => {
-	const out = {};
-	for (const [op, value] of Object.entries(map)) out[op] = coerceDashboardWritePolicyValue(value);
-	return out;
-}).superRefine((map, ctx) => {
+const dashboardWritePolicyMap = z.partialRecord(DashboardWriteOperation, DashboardWritePolicyState).superRefine((map, ctx) => {
 	for (const [op, state] of Object.entries(map)) {
 		if (state !== "encrypted") continue;
 		if (DASHBOARD_WRITE_OPERATIONS_BY_NAME.get(op)?.sensitivity !== "plaintext") ctx.addIssue({
@@ -411,9 +392,7 @@ const dashboardWritePolicyMapSchema = dashboardWritePolicyMap.default({});
 * policy map. Treats `undefined` as the permissive default.
 */
 function resolvePolicyState(policy, op) {
-	const raw = policy?.[op];
-	if (raw === void 0) return "permissive";
-	return coerceDashboardWritePolicyValue(raw);
+	return policy?.[op] ?? "permissive";
 }
 /**
 * Resolve the effective enabled state of an operation. `true` unless the
@@ -452,6 +431,6 @@ function resolveFullPolicyStateView(policy) {
 	return out;
 }
 //#endregion
-export { CLI_INDEPENDENT_ONLY_OPERATIONS, DASHBOARD_WRITE_OPERATIONS, DASHBOARD_WRITE_OPERATIONS_BY_NAME, DASHBOARD_WRITE_OPERATIONS_BY_WIRE_TYPE, DASHBOARD_WRITE_OPERATION_VALUES, DashboardWriteCategory, DashboardWriteOperation, DashboardWritePolicyState, DashboardWriteSensitivity, coerceDashboardWritePolicyValue, dashboardWritePolicyMap, dashboardWritePolicyMapSchema, getDashboardWriteOperationDescriptor, getDashboardWriteOperationsByCategory, getDashboardWriteOperationsBySensitivity, isDashboardWriteOperationEnabled, isEncryptedState, resolveFullPolicyStateView, resolveFullPolicyView, resolvePolicyState };
+export { CLI_INDEPENDENT_ONLY_OPERATIONS, DASHBOARD_WRITE_OPERATIONS, DASHBOARD_WRITE_OPERATIONS_BY_NAME, DASHBOARD_WRITE_OPERATIONS_BY_WIRE_TYPE, DASHBOARD_WRITE_OPERATION_VALUES, DashboardWriteCategory, DashboardWriteOperation, DashboardWritePolicyState, DashboardWriteSensitivity, dashboardWritePolicyMap, dashboardWritePolicyMapSchema, getDashboardWriteOperationDescriptor, getDashboardWriteOperationsByCategory, getDashboardWriteOperationsBySensitivity, isDashboardWriteOperationEnabled, isEncryptedState, resolveFullPolicyStateView, resolveFullPolicyView, resolvePolicyState };
 
 //# sourceMappingURL=dashboard-write-operations.js.map

package/dist/protocol/messages/agent-run-result.d.ts

@@ -213,7 +213,6 @@ export declare const agentRunResultSchema: z.ZodObject<{
     completedAt: z.ZodNullable<z.ZodString>;
     durationMs: z.ZodNullable<z.ZodNumber>;
     trustTier: z.ZodNullable<z.ZodEnum<{
-        known: "known";
         trusted: "trusted";
         unknown: "unknown";
     }>>;

package/dist/protocol/messages/auth.d.ts

@@ -9,7 +9,7 @@ export declare const authRequestSchema: z.ZodObject<{
             coordinator: "coordinator";
             worker: "worker";
         }>>;
-        dashboardWrites: z.ZodOptional<z.ZodPipe<z.ZodRecord<z.ZodEnum<{
+        dashboardWrites: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
             "attestations.retry": "attestations.retry";
             "backends.sync": "backends.sync";
             "backends.sync_one": "backends.sync_one";
@@ -37,11 +37,11 @@ export declare const authRequestSchema: z.ZodObject<{
             "secrets.set": "secrets.set";
             "variables.delete": "variables.delete";
             "variables.set": "variables.set";
-        }> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodEnum<{
+        }> & z.core.$partial, z.ZodEnum<{
             disabled: "disabled";
             encrypted: "encrypted";
             permissive: "permissive";
-        }>]>>, z.ZodTransform<Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive">>, Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive" | boolean>>>>>;
+        }>>>;
         supportedDashboardRequests: z.ZodOptional<z.ZodArray<z.ZodString>>;
         dashboardEncryptionKey: z.ZodOptional<z.ZodObject<{
             kty: z.ZodLiteral<"OKP">;

package/dist/protocol/messages/capabilities.d.ts

@@ -36,7 +36,7 @@ export declare const orchCapabilitiesSchema: z.ZodObject<{
         coordinator: "coordinator";
         worker: "worker";
     }>>;
-    dashboardWrites: z.ZodOptional<z.ZodPipe<z.ZodRecord<z.ZodEnum<{
+    dashboardWrites: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
         "attestations.retry": "attestations.retry";
         "backends.sync": "backends.sync";
         "backends.sync_one": "backends.sync_one";
@@ -64,11 +64,11 @@ export declare const orchCapabilitiesSchema: z.ZodObject<{
         "secrets.set": "secrets.set";
         "variables.delete": "variables.delete";
         "variables.set": "variables.set";
-    }> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodEnum<{
+    }> & z.core.$partial, z.ZodEnum<{
         disabled: "disabled";
         encrypted: "encrypted";
         permissive: "permissive";
-    }>]>>, z.ZodTransform<Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive">>, Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive" | boolean>>>>>;
+    }>>>;
     supportedDashboardRequests: z.ZodOptional<z.ZodArray<z.ZodString>>;
     dashboardEncryptionKey: z.ZodOptional<z.ZodObject<{
         kty: z.ZodLiteral<"OKP">;
@@ -102,14 +102,12 @@ export declare function hasOrchCapability(capabilities: OrchCapabilities | undef
  */
 export declare const platformCapabilitiesSchema: z.ZodObject<{
     orchMetrics: z.ZodOptional<z.ZodBoolean>;
-    oidcMint: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$loose>;
 /** Inferred type for Platform capabilities. */
 export type PlatformCapabilities = z.infer<typeof platformCapabilitiesSchema>;
 /** Default Platform capabilities advertised to the orchestrator after auth. */
 export declare const PLATFORM_CAPABILITIES: Readonly<{
     orchMetrics: true;
-    oidcMint: true;
 }>;
 /**
  * Check whether the Platform advertises a specific capability flag.

package/dist/protocol/messages/capabilities.js

@@ -91,17 +91,11 @@ function hasOrchCapability(capabilities, flag) {
 * Every field is optional and absent = unsupported (same evolution contract as
 * `orchCapabilitiesSchema`).
 */
-const platformCapabilitiesSchema = z.object({
-	/** Platform ingests periodic `orch.metrics` telemetry pushes. */
-	orchMetrics: z.boolean().optional(),
-	/** Platform serves the orchestrator-initiated `oidc.mint.request` RPC. */
-	oidcMint: z.boolean().optional()
-}).passthrough();
+const platformCapabilitiesSchema = z.object({ 
+/** Platform ingests periodic `orch.metrics` telemetry pushes. */
+orchMetrics: z.boolean().optional() }).passthrough();
 /** Default Platform capabilities advertised to the orchestrator after auth. */
-const PLATFORM_CAPABILITIES = Object.freeze({
-	orchMetrics: true,
-	oidcMint: true
-});
+const PLATFORM_CAPABILITIES = Object.freeze({ orchMetrics: true });
 /**
 * Check whether the Platform advertises a specific capability flag.
 *