@kici-dev/engine 0.9.1 → 0.10.0

package/dist/index.d.ts

@@ -68,7 +68,7 @@ export type { RateLimiterConfig, RateLimitResult } from './ws/rate-limiter.js';
 export * from './env/environment-allowlist.js';
 export * from './secrets/index.js';
 export * from './context/index.js';
-export { deriveOsArchLabels, derivePlatformTaints, PLATFORM_TAINT_LABELS, ScalerOs, ScalerArch, scalerPlatformSchema, platformToOsArchLabels, platformToTaints, nodePlatformToScalerOs, nodeArchToScalerArch, hostToScalerPlatform, hostLabel, parseHostLabel, HOST_LABEL_PREFIX, agentTypeLabel, scalerLabel, mergeAutoLabels, normalizeRunsOn, KNOWN_ROLES, resolveRoleLabels, validateNoReservedLabels, scalerAgentLabels, isSelfReportedLabel, SELF_REPORTED_LABEL_PREFIXES, CAPABILITY_LABEL_PREFIX, capabilityLabel, SSH_TRANSPORT_CAPABILITY, RUNTIME_LABEL_PREFIX, runtimeLabel, RuntimeFact, CONTAINER_BUILD_RUNTIME_LABEL, INIT_LABEL, PRIVILEGED_ROOT_LABEL, INIT_RUNNER_ROLE_LABEL, } from './labels.js';
+export { deriveOsArchLabels, derivePlatformTaints, PLATFORM_TAINT_LABELS, ScalerOs, ScalerArch, scalerPlatformSchema, platformToOsArchLabels, platformToTaints, nodePlatformToScalerOs, nodeArchToScalerArch, hostToScalerPlatform, hostLabel, parseHostLabel, HOST_LABEL_PREFIX, agentTypeLabel, scalerLabel, mergeAutoLabels, normalizeRunsOn, KNOWN_ROLES, resolveRoleLabels, validateNoReservedLabels, scalerAgentLabels, isSelfReportedLabel, SELF_REPORTED_LABEL_PREFIXES, CAPABILITY_LABEL_PREFIX, capabilityLabel, SSH_TRANSPORT_CAPABILITY, RUNTIME_LABEL_PREFIX, runtimeLabel, RuntimeFact, CONTAINER_BUILD_RUNTIME_LABEL, JOB_IMAGE_RUNTIME_LABEL, AGENT_FEATURE_LABEL_PREFIX, AgentFeature, agentFeatureLabel, GLOBAL_EVAL_SKIPS_RESULT_AWARE_LABEL, AGENT_FEATURE_LABELS, INIT_LABEL, PRIVILEGED_ROOT_LABEL, INIT_RUNNER_ROLE_LABEL, } from './labels.js';
 export type { NormalizedRunsOn } from './labels.js';
 export type { AgentRole } from './labels.js';
 export type { ScalerPlatform } from './labels.js';

package/dist/index.js

@@ -14,7 +14,7 @@ import { HeldRunStatus } from "./context/held-run-status.js";
 import { HoldType, normalizePersistedHoldType, persistedHoldTypeSpellings } from "./context/hold-type.js";
 import { resolveHeldRunId } from "./mcp/held-run-resolve.js";
 import { renderFenced } from "./mcp/fence.js";
-import { CONTEXTS_MAX, CacheOutcome, CacheRunEventType, CacheStepType, DEAD_ORCH_FAILURE_REASON, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, JobKind, MAX_JOBS_PER_RUN, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RunFailureClass, STATE_REPLAY_MAX_RUNS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, SetupStepType, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, isSetupStepType, jobStatusForwardSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepStatusForwardSchema } from "./protocol/messages/execution-status.js";
+import { CONTEXTS_MAX, CacheOutcome, CacheRunEventType, CacheStepType, DEAD_ORCH_FAILURE_REASON, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, JobKind, MAX_JOBS_PER_RUN, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RunFailureClass, STATE_REPLAY_MAX_RUNS, STATUS_EPOCH_MAX, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, SetupStepType, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, isSetupStepType, jobStatusForwardSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepStatusForwardSchema } from "./protocol/messages/execution-status.js";
 import { MinimumTrustSchema, TrustTierSchema } from "./context/types.js";
 import { AgentFailureCategory, agentJobResultSchema, agentRunListItemSchema, agentRunResultSchema, agentStepLogsSchema, agentStepResultSchema, agentWorkflowSummarySchema, untrusted, wrapUntrusted } from "./protocol/messages/agent-run-result.js";
 import { AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, accessLogFilterSchema, accessLogItemSchema, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema } from "./protocol/messages/access-log.js";
@@ -26,15 +26,15 @@ import { OWN_INGRESS_MODES, OrchestratorMode, PLATFORM_CONNECTED_MODES, RELAY_IN
 import { INTERNAL_EVENT_NAME_PREFIX, KICI_EVENT_NAME_PREFIX, ScalerBackendType, reservedEventNamePrefix } from "./scaler/scaler-backend-type.js";
 import { ApprovalDecision, HoldScope, TriggerSource, approvalRequirementSchema, approvalTimeoutSecondsSchema, approverClauseSchema } from "./approval/types.js";
 import { CANONICAL_STATUSES, LEGACY_STATUS_ALIASES, STATUS_FAILURE_CLASS, STATUS_PRECEDENCE, StatusFailureClass, isFailureStatus, toCanonicalStatus, worstStatus } from "./status/presentation.js";
-import { BREAKING_FLOOR, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, changedFilesStatusSchema, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, resolveContentFormat, resolveWhenToRunOn } from "./trigger/types.js";
+import { BREAKING_FLOOR, GLOBAL_APPROVAL_MIN_READER, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, changedFilesStatusSchema, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, resolveContentFormat, resolveWhenToRunOn } from "./trigger/types.js";
 import { canonicalizeLabel, canonicalizeLabelSet, canonicalizeLabels } from "./labels-canonical.js";
 import { normalizeRegexFlags, stripStatefulRegexFlags } from "./regex-flags.js";
 import { HostTargetSelector, HostTargetValue, LabelMatcher, canonicalizeMatcher, compileRegexMatcher, hostSatisfiesTarget, matcherMatches, matcherSatisfiedBy, partitionMatchers } from "./labels-match.js";
 import { ConcurrencyStrategy, DEFAULT_CONCURRENCY_STRATEGY } from "./context/concurrency-strategy.js";
 import { HostInventoryEntry, HostPropertyValue, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, coerceHostPropertyValue, parseHostPropertyAssignments } from "./inventory.js";
 import { REGEX_NEGATIVE_ASSERTION, isNegatedPattern, negatedPatternReason } from "./repo/pattern-negation.js";
-import { ContextDeleteErrorCode, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, TestRelayType, artifactListItemSchema, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, eventLogActivityCountsSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
-import { ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, OrchRole, PLATFORM_CAPABILITIES, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, platformCapabilitiesSchema } from "./protocol/messages/capabilities.js";
+import { ContextDeleteErrorCode, ContextType, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, TestRelayType, artifactListItemSchema, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, eventLogActivityCountsSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
+import { AGENT_CAPABILITIES, AgentCapabilityFlag, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, OrchRole, PLATFORM_CAPABILITIES, agentCapabilitiesSchema, hasAgentCapability, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, platformCapabilitiesSchema } from "./protocol/messages/capabilities.js";
 import { authFailureSchema, authRequestSchema, authSuccessSchema } from "./protocol/messages/auth.js";
 import { LogStream } from "./protocol/messages/log-stream.js";
 import { CLUSTER_MEMBERSHIP_MAX_WORKERS, CiTrustLevel, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_APPROVAL_EXPIRY_SECONDS, ForkPolicy, MAX_APPROVAL_EXPIRY_HOURS, MAX_APPROVAL_EXPIRY_SECONDS, MIN_APPROVAL_EXPIRY_SECONDS, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OrchLogPhase, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, SECONDS_PER_HOUR, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, approvalExpiryHoursOf, approvalExpirySecondsOf, cacheStatsSchema, clusterMembershipSchema, collectDiscriminatorTypes, executionEventSchema, logChunkSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, planHeadroomSchema, platformCapabilitiesMessageSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicySchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema } from "./protocol/messages/platform-orchestrator.js";
@@ -50,7 +50,7 @@ import { EVENT_LOG_PAYLOAD_CHUNK_BYTES } from "./protocol/event-log-payload.js";
 import { browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, platformToBrowserMessageSchema } from "./protocol/messages/browser.js";
 import { joinRequestSchema, joinResponseSchema } from "./protocol/messages/join.js";
 import { fleetSelectionSchema, jobProgressAckSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, workerClusterSettingsSchema } from "./protocol/messages/peer.js";
-import { ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactRejectReason, ArtifactUploadOutcome, CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, invokeResultSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, rateLimitWarningSchema, registerAckSchema, scalerClaimCredentialsResponseSchema, scalerClaimCredentialsSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema } from "./protocol/messages/orchestrator-agent.js";
+import { AGENT_API_REQUEST_TIMEOUT_MS, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactRejectReason, ArtifactUploadOutcome, CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, invokeResultSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, rateLimitWarningSchema, registerAckSchema, scalerClaimCredentialsResponseSchema, scalerClaimCredentialsSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema } from "./protocol/messages/orchestrator-agent.js";
 import { KNOWN_LINUX_CAPABILITIES, canonicalizeCapability, isKnownCapability } from "./sandbox/capabilities.js";
 import { compileSafeRegex, describeTextMatch, evaluateTextMatch, textMatchHasQuery } from "./trigger/text-match.js";
 import { REDACTED_TRACE_FIELD, TRACE_TEXT_MAX, TRACE_TRUNCATION_WORKFLOW_NAME, TraceCheck, TraceVerdict, appendChecks, createCommitMessageTraceEntry, createContentRequirementsTraceEntry, createDispatchFailureTraceEntry, createGlobalFilterTraceEntry, createTraceEntry, createTraceTruncationMarker, createWorkflowDecision, truncateDecisionsToByteBudget, truncateTraceText, utf8ByteLength } from "./trigger/decision-trace.js";
@@ -82,7 +82,7 @@ import { ContextGateRejectReason, mergeOrderedMaps } from "./context/multi-conte
 import { SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, ScopeNameError, assertValidScopeName, validateScopeName } from "./context/scope-name.js";
 import { SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SecretKeyError, assertValidSecretKey, validateSecretKey } from "./context/secret-key.js";
 import "./context/index.js";
-import { CAPABILITY_LABEL_PREFIX, CONTAINER_BUILD_RUNTIME_LABEL, HOST_LABEL_PREFIX, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, KNOWN_ROLES, PLATFORM_TAINT_LABELS, PRIVILEGED_ROOT_LABEL, RUNTIME_LABEL_PREFIX, RuntimeFact, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, ScalerArch, ScalerOs, agentTypeLabel, capabilityLabel, deriveOsArchLabels, derivePlatformTaints, hostLabel, hostToScalerPlatform, isSelfReportedLabel, mergeAutoLabels, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeRunsOn, parseHostLabel, platformToOsArchLabels, platformToTaints, resolveRoleLabels, runtimeLabel, scalerAgentLabels, scalerLabel, scalerPlatformSchema, validateNoReservedLabels } from "./labels.js";
+import { AGENT_FEATURE_LABELS, AGENT_FEATURE_LABEL_PREFIX, AgentFeature, CAPABILITY_LABEL_PREFIX, CONTAINER_BUILD_RUNTIME_LABEL, GLOBAL_EVAL_SKIPS_RESULT_AWARE_LABEL, HOST_LABEL_PREFIX, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, JOB_IMAGE_RUNTIME_LABEL, KNOWN_ROLES, PLATFORM_TAINT_LABELS, PRIVILEGED_ROOT_LABEL, RUNTIME_LABEL_PREFIX, RuntimeFact, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, ScalerArch, ScalerOs, agentFeatureLabel, agentTypeLabel, capabilityLabel, deriveOsArchLabels, derivePlatformTaints, hostLabel, hostToScalerPlatform, isSelfReportedLabel, mergeAutoLabels, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeRunsOn, parseHostLabel, platformToOsArchLabels, platformToTaints, resolveRoleLabels, runtimeLabel, scalerAgentLabels, scalerLabel, scalerPlatformSchema, validateNoReservedLabels } from "./labels.js";
 import { SCALER_EVENT_NAMES, ScaleDownReason, ScalerScaleDownPayload, ScalerScaleUpPayload } from "./scaler/scaler-events.js";
 import { parseMemoryString, resourceRequestNestedSchema, resourceSpecSchema, validateResourceRequest } from "./scaler/resource-types.js";
 import { RegisterableTriggerType } from "./registration/registerable-trigger-type.js";
@@ -95,4 +95,4 @@ import { ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, ArtifactNameSch
 import { PLAN_TYPES, PaidPlanType, PlanType, isPaidTier, planRank } from "./billing/plan-type.js";
 import { SUBSCRIPTION_EXISTS_CODE, StripeSubscriptionStatus, blocksNewCheckout } from "./billing/subscription-status.js";
 import { INFRA_ALERT_TYPES, InfraAlertSeverity, InfraAlertType, normalizeInfraAlertSeverity } from "./diagnostics/infra-alert.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, ACTOR_AGENT_SUFFIX, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentFailureCategory, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactNameSchema, ArtifactRejectReason, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CAPABILITY_LABEL_PREFIX, CLUSTER_MEMBERSHIP_MAX_WORKERS, CONTAINER_BUILD_RUNTIME_LABEL, CONTEXTS_MAX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, CiTrustLevel, ConcurrencyStrategy, ConfigPathsSchema, ContextDeleteErrorCode, ContextGateRejectReason, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DEAD_ORCH_FAILURE_REASON, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_APPROVAL_EXPIRY_SECONDS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DEVELOPER_OPERATIONS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, ForkPolicy, HEARTBEAT_CLOSE_MS, HEARTBEAT_DEGRADED_MS, HEARTBEAT_FRESH_MS, HEARTBEAT_STALE_THRESHOLD_SECONDS, HEARTBEAT_UNHEALTHY_MARK_MS, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, ID_TOKEN_CLAIM_NAMES, INFRA_ALERT_TYPES, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, INSTALL_JOB_ID_PREFIX, INTERNAL_EVENT_NAME_PREFIX, InfraAlertSeverity, InfraAlertType, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobKind, JobRejectReason, KICI_AGENT_ENV_PREFIX, KICI_EVENT_NAME_PREFIX, KNOWN_LINUX_CAPABILITIES, KNOWN_ROLES, LEGACY_STATUS_ALIASES, LabelMatcher, LockFileParseError, LogStream, MAX_APPROVAL_EXPIRY_HOURS, MAX_APPROVAL_EXPIRY_SECONDS, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MAX_MATRIX_MATERIALIZATION, MIN_APPROVAL_EXPIRY_SECONDS, MIN_PROTOCOL_VERSION, MatrixShapeError, MinimumTrustSchema, NACK_EXEMPT_MESSAGE_TYPES, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OWN_INGRESS_MODES, OnUnreachableMode, OrchLogPhase, OrchRole, OrchestratorMode, PING_EVENT_TYPE, PLAN_TYPES, PLATFORM_CAPABILITIES, PLATFORM_CONNECTED_MODES, PLATFORM_TAINT_LABELS, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PULL_REQUEST_FAMILY_TRIGGER_EVENTS, PaidPlanType, PatKind, PayloadOmittedReason, PlanType, REDACTED_TRACE_FIELD, REGEX_NEGATIVE_ASSERTION, RELAY_INGRESS_MODES, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RUNTIME_LABEL_PREFIX, RegisterableTriggerType, RunFailureClass, RunsOnPick, RuntimeFact, SANDBOX_DEFAULT_VARS, SANDBOX_NETWORK_MODES, SCALER_EVENT_NAMES, SCHEMA_VERSION, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECONDS_PER_HOUR, SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_FAILURE_CLASS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, STATUS_PRECEDENCE, SUBSCRIBABLE_WEBHOOK_EVENT_TYPES, SUBSCRIPTION_EXISTS_CODE, ScaleDownReason, ScalerArch, ScalerBackendType, ScalerEventType, ScalerOs, ScalerScaleDownPayload, ScalerScaleUpPayload, ScopeNameError, SecretKeyError, SetupStepType, SourceOrigin, SourceProvider, SourceSubtype, StatusFailureClass, StepApprovalOutcome, StepConcurrencyKind, StripeSubscriptionStatus, SubscribableWebhookEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TRACE_TEXT_MAX, TRACE_TRUNCATION_WORKFLOW_NAME, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TRIGGER_TYPE_TO_EVENT_TYPES, TRUSTED_ENV_SCRUB_EXACT, TestRelayType, TimeoutReason, TraceCheck, TraceVerdict, TriggerSource, TrustTierSchema, UNRESOLVED_CLAIM, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WORKFLOW_MODIFICATION_JOB_ID, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_SUPERSEDED_BY_RECONNECT, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookEventType, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentJobResultSchema, agentLabelOf, agentLogChunkSchema, agentMetricsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentRegisterSchema, agentRunListItemSchema, agentRunResultSchema, agentSecretScopeSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, agentWorkflowSummarySchema, apiKeyActorSchema, appendChecks, applyIncludeExclude, approvalExpiryHoursOf, approvalExpirySecondsOf, approvalRequirementSchema, approvalTimeoutSecondsSchema, approveRunToolSchema, approverClauseSchema, artifactInvalidNameError, artifactListItemSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, assertScheduleInputsSatisfiable, assertValidScopeName, assertValidSecretKey, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, blocksNewCheckout, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildEventClaims, buildIdTokenSubject, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, canonicalizeCapability, canonicalizeLabel, canonicalizeLabelSet, canonicalizeLabels, canonicalizeMatcher, capabilityLabel, changedFilesStatusSchema, checkArtifactName, clusterMembershipSchema, coerceDispatchInputs, coerceHostPropertyValue, collectDiscriminatorTypes, compileRegexMatcher, compileSafeRegex, configAckSchema, connectionHealthStatusSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, createCommitMessageTraceEntry, createContentRequirementsTraceEntry, createDispatchFailureTraceEntry, createGlobalFilterTraceEntry, createTraceEntry, createTraceTruncationMarker, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, derivePlatformTaints, describeTextMatch, developerOpsForEntrypoint, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, errorSchema, evaluateTextMatch, eventEmitResponseSchema, eventEmitSchema, eventLogActivityCountsSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, findDuplicateCombination, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getDiagnosticsToolSchema, getRepoGlobMatcher, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubIngressPath, githubWebhookPath, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, installGateJobId, invokeResultSchema, isFailureStatus, isInputSatisfiableFromDefaults, isKnownCapability, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, isMintedRef, isNegatedPattern, isPaidTier, isPullRequestFamilyTriggerEvent, isSecurityHoldJobId, isSelfReportedLabel, isSetupStepType, isTrustedEnvScrubbed, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchTrigger, matchWorkflowTriggers, matchWorkflowsForEvent, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixCombinationCount, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, negatedPatternReason, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeInfraAlertSeverity, normalizeMatrixInput, normalizePersistedHoldType, normalizeRegexFlags, normalizeRunsOn, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, persistedHoldTypeSpellings, planHeadroomSchema, planRank, platformCapabilitiesMessageSchema, platformCapabilitiesSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, prepareEventBuckets, provenanceContextSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, rateLimitWarningSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rejectRunToolSchema, renderFenced, rerunRunToolSchema, reservedEventNamePrefix, resolveContentFormat, resolveHeldRunId, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForContext, resolveSecretsWithProvenance, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, runtimeLabel, scalerAgentLabels, scalerClaimCredentialsResponseSchema, scalerClaimCredentialsSchema, scalerLabel, scalerPlatformSchema, scheduleTriggerKey, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, stripStatefulRegexFlags, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, textMatchHasQuery, toCanonicalStatus, triggerRunToolSchema, truncateDecisionsToByteBudget, truncateTraceText, trustPolicyResponseSchema, trustPolicySchema, trustPolicyUpdateSchema, trustedContributorHoldReason, untrusted, upstreamSnapshotSchema, userActorSchema, utf8ByteLength, validateNoReservedLabels, validateResourceRequest, validateScopeName, validateSecretKey, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, workerClusterSettingsSchema, worstStatus, wrapUntrusted };
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, ACTOR_AGENT_SUFFIX, AGENT_API_REQUEST_TIMEOUT_MS, AGENT_CAPABILITIES, AGENT_FEATURE_LABELS, AGENT_FEATURE_LABEL_PREFIX, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentCapabilityFlag, AgentFailureCategory, AgentFeature, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactNameSchema, ArtifactRejectReason, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CAPABILITY_LABEL_PREFIX, CLUSTER_MEMBERSHIP_MAX_WORKERS, CONTAINER_BUILD_RUNTIME_LABEL, CONTEXTS_MAX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, CiTrustLevel, ConcurrencyStrategy, ConfigPathsSchema, ContextDeleteErrorCode, ContextGateRejectReason, ContextType, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DEAD_ORCH_FAILURE_REASON, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_APPROVAL_EXPIRY_SECONDS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DEVELOPER_OPERATIONS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, ForkPolicy, GLOBAL_APPROVAL_MIN_READER, GLOBAL_EVAL_SKIPS_RESULT_AWARE_LABEL, HEARTBEAT_CLOSE_MS, HEARTBEAT_DEGRADED_MS, HEARTBEAT_FRESH_MS, HEARTBEAT_STALE_THRESHOLD_SECONDS, HEARTBEAT_UNHEALTHY_MARK_MS, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, ID_TOKEN_CLAIM_NAMES, INFRA_ALERT_TYPES, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, INSTALL_JOB_ID_PREFIX, INTERNAL_EVENT_NAME_PREFIX, InfraAlertSeverity, InfraAlertType, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JOB_IMAGE_RUNTIME_LABEL, JobKind, JobRejectReason, KICI_AGENT_ENV_PREFIX, KICI_EVENT_NAME_PREFIX, KNOWN_LINUX_CAPABILITIES, KNOWN_ROLES, LEGACY_STATUS_ALIASES, LabelMatcher, LockFileParseError, LogStream, MAX_APPROVAL_EXPIRY_HOURS, MAX_APPROVAL_EXPIRY_SECONDS, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MAX_MATRIX_MATERIALIZATION, MIN_APPROVAL_EXPIRY_SECONDS, MIN_PROTOCOL_VERSION, MatrixShapeError, MinimumTrustSchema, NACK_EXEMPT_MESSAGE_TYPES, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OWN_INGRESS_MODES, OnUnreachableMode, OrchLogPhase, OrchRole, OrchestratorMode, PING_EVENT_TYPE, PLAN_TYPES, PLATFORM_CAPABILITIES, PLATFORM_CONNECTED_MODES, PLATFORM_TAINT_LABELS, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PULL_REQUEST_FAMILY_TRIGGER_EVENTS, PaidPlanType, PatKind, PayloadOmittedReason, PlanType, REDACTED_TRACE_FIELD, REGEX_NEGATIVE_ASSERTION, RELAY_INGRESS_MODES, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RUNTIME_LABEL_PREFIX, RegisterableTriggerType, RunFailureClass, RunsOnPick, RuntimeFact, SANDBOX_DEFAULT_VARS, SANDBOX_NETWORK_MODES, SCALER_EVENT_NAMES, SCHEMA_VERSION, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECONDS_PER_HOUR, SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_EPOCH_MAX, STATUS_FAILURE_CLASS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, STATUS_PRECEDENCE, SUBSCRIBABLE_WEBHOOK_EVENT_TYPES, SUBSCRIPTION_EXISTS_CODE, ScaleDownReason, ScalerArch, ScalerBackendType, ScalerEventType, ScalerOs, ScalerScaleDownPayload, ScalerScaleUpPayload, ScopeNameError, SecretKeyError, SetupStepType, SourceOrigin, SourceProvider, SourceSubtype, StatusFailureClass, StepApprovalOutcome, StepConcurrencyKind, StripeSubscriptionStatus, SubscribableWebhookEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TRACE_TEXT_MAX, TRACE_TRUNCATION_WORKFLOW_NAME, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TRIGGER_TYPE_TO_EVENT_TYPES, TRUSTED_ENV_SCRUB_EXACT, TestRelayType, TimeoutReason, TraceCheck, TraceVerdict, TriggerSource, TrustTierSchema, UNRESOLVED_CLAIM, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WORKFLOW_MODIFICATION_JOB_ID, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_SUPERSEDED_BY_RECONNECT, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookEventType, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentCapabilitiesSchema, agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentFeatureLabel, agentJobResultSchema, agentLabelOf, agentLogChunkSchema, agentMetricsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentRegisterSchema, agentRunListItemSchema, agentRunResultSchema, agentSecretScopeSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, agentWorkflowSummarySchema, apiKeyActorSchema, appendChecks, applyIncludeExclude, approvalExpiryHoursOf, approvalExpirySecondsOf, approvalRequirementSchema, approvalTimeoutSecondsSchema, approveRunToolSchema, approverClauseSchema, artifactInvalidNameError, artifactListItemSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, assertScheduleInputsSatisfiable, assertValidScopeName, assertValidSecretKey, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, blocksNewCheckout, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildEventClaims, buildIdTokenSubject, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, canonicalizeCapability, canonicalizeLabel, canonicalizeLabelSet, canonicalizeLabels, canonicalizeMatcher, capabilityLabel, changedFilesStatusSchema, checkArtifactName, clusterMembershipSchema, coerceDispatchInputs, coerceHostPropertyValue, collectDiscriminatorTypes, compileRegexMatcher, compileSafeRegex, configAckSchema, connectionHealthStatusSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, createCommitMessageTraceEntry, createContentRequirementsTraceEntry, createDispatchFailureTraceEntry, createGlobalFilterTraceEntry, createTraceEntry, createTraceTruncationMarker, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, derivePlatformTaints, describeTextMatch, developerOpsForEntrypoint, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, errorSchema, evaluateTextMatch, eventEmitResponseSchema, eventEmitSchema, eventLogActivityCountsSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, findDuplicateCombination, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getDiagnosticsToolSchema, getRepoGlobMatcher, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubIngressPath, githubWebhookPath, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, hasAgentCapability, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, installGateJobId, invokeResultSchema, isFailureStatus, isInputSatisfiableFromDefaults, isKnownCapability, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, isMintedRef, isNegatedPattern, isPaidTier, isPullRequestFamilyTriggerEvent, isSecurityHoldJobId, isSelfReportedLabel, isSetupStepType, isTrustedEnvScrubbed, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchTrigger, matchWorkflowTriggers, matchWorkflowsForEvent, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixCombinationCount, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, negatedPatternReason, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeInfraAlertSeverity, normalizeMatrixInput, normalizePersistedHoldType, normalizeRegexFlags, normalizeRunsOn, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, persistedHoldTypeSpellings, planHeadroomSchema, planRank, platformCapabilitiesMessageSchema, platformCapabilitiesSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, prepareEventBuckets, provenanceContextSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, rateLimitWarningSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rejectRunToolSchema, renderFenced, rerunRunToolSchema, reservedEventNamePrefix, resolveContentFormat, resolveHeldRunId, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForContext, resolveSecretsWithProvenance, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, runtimeLabel, scalerAgentLabels, scalerClaimCredentialsResponseSchema, scalerClaimCredentialsSchema, scalerLabel, scalerPlatformSchema, scheduleTriggerKey, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, stripStatefulRegexFlags, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, textMatchHasQuery, toCanonicalStatus, triggerRunToolSchema, truncateDecisionsToByteBudget, truncateTraceText, trustPolicyResponseSchema, trustPolicySchema, trustPolicyUpdateSchema, trustedContributorHoldReason, untrusted, upstreamSnapshotSchema, userActorSchema, utf8ByteLength, validateNoReservedLabels, validateResourceRequest, validateScopeName, validateSecretKey, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, workerClusterSettingsSchema, worstStatus, wrapUntrusted };

package/dist/labels.d.ts

@@ -198,15 +198,50 @@ export declare function runtimeLabel(name: string): string;
  *   build a job's image from a Dockerfile. Distinct from the two above: a host
  *   reachable only through a mounted socket can RUN containers but not BUILD
  *   one, because the build shells out to the CLI.
+ * - `job-image` — the agent runs inside one job's own container image, started
+ *   for that job. Any other job would run in an image it never declared, so the
+ *   orchestrator gives such an agent no other work. The fact only ever
+ *   restricts the agent reporting it, so taking it on the agent's word grants
+ *   nothing.
  */
 export declare const RuntimeFact: z.ZodEnum<{
     "container-build": "container-build";
     docker: "docker";
+    "job-image": "job-image";
     podman: "podman";
 }>;
 export type RuntimeFact = z.infer<typeof RuntimeFact>;
 /** The label a job's `runsOn` names to require a host that can build an image. */
 export declare const CONTAINER_BUILD_RUNTIME_LABEL: string;
+/** The label an agent running inside a job's own image registers with. */
+export declare const JOB_IMAGE_RUNTIME_LABEL: string;
+/**
+ * Agent-feature label prefix — `kici:agent-feature:<name>` states a behaviour
+ * the agent BUILD implements. Like `kici:runtime:`, it is a fact, not a
+ * privilege: it lets the orchestrator route work that depends on the behaviour
+ * to an agent that has it, and asserting it grants nothing.
+ */
+export declare const AGENT_FEATURE_LABEL_PREFIX = "kici:agent-feature:";
+/**
+ * Behaviours an agent build reports at registration.
+ *
+ * - `global-eval-skips-result-aware` — the pre-run global eval round runs only
+ *   the needs-free generators and skips every generator declared with `needs`.
+ */
+export declare const AgentFeature: z.ZodEnum<{
+    "global-eval-skips-result-aware": "global-eval-skips-result-aware";
+}>;
+export type AgentFeature = z.infer<typeof AgentFeature>;
+/** Build a `kici:agent-feature:<name>` label. */
+export declare function agentFeatureLabel(feature: AgentFeature): string;
+/** The label a global eval round carries when it must skip result-aware generators. */
+export declare const GLOBAL_EVAL_SKIPS_RESULT_AWARE_LABEL: string;
+/**
+ * Every agent-feature label this build implements: what the agent self-reports
+ * at registration, and what a scaler adds to the label sets of the agents it
+ * spawns so it matches the same jobs.
+ */
+export declare const AGENT_FEATURE_LABELS: readonly string[];
 /**
  * The `kici:init` lifecycle label carried by a temporary init-runner agent
  * brought up on a fresh box for bootstrap. Marks it as ephemeral + privileged;
@@ -282,7 +317,7 @@ export declare function scalerAgentLabels(labelSet: string[], backendType: strin
  * for a fact about the host and WRONG for anything that grants a privilege —
  * `kici:capability:` is absent from this list for exactly that reason.
  */
-export declare const SELF_REPORTED_LABEL_PREFIXES: readonly ['kici:os:', 'kici:arch:', 'kici:host:', "kici:runtime:"];
+export declare const SELF_REPORTED_LABEL_PREFIXES: readonly ['kici:os:', 'kici:arch:', 'kici:host:', "kici:runtime:", "kici:agent-feature:"];
 /**
  * True if a label is a self-reported platform fact (os/arch/host) rather than a
  * scaler-assigned, authorization-bearing label. Used by the agent register-time

package/dist/labels.js

@@ -277,14 +277,48 @@ function runtimeLabel(name) {
 *   build a job's image from a Dockerfile. Distinct from the two above: a host
 *   reachable only through a mounted socket can RUN containers but not BUILD
 *   one, because the build shells out to the CLI.
+* - `job-image` — the agent runs inside one job's own container image, started
+*   for that job. Any other job would run in an image it never declared, so the
+*   orchestrator gives such an agent no other work. The fact only ever
+*   restricts the agent reporting it, so taking it on the agent's word grants
+*   nothing.
 */
 const RuntimeFact = z.enum([
 	"docker",
 	"podman",
-	"container-build"
+	"container-build",
+	"job-image"
 ]);
 /** The label a job's `runsOn` names to require a host that can build an image. */
 const CONTAINER_BUILD_RUNTIME_LABEL = runtimeLabel(RuntimeFact.enum["container-build"]);
+/** The label an agent running inside a job's own image registers with. */
+const JOB_IMAGE_RUNTIME_LABEL = runtimeLabel(RuntimeFact.enum["job-image"]);
+/**
+* Agent-feature label prefix — `kici:agent-feature:<name>` states a behaviour
+* the agent BUILD implements. Like `kici:runtime:`, it is a fact, not a
+* privilege: it lets the orchestrator route work that depends on the behaviour
+* to an agent that has it, and asserting it grants nothing.
+*/
+const AGENT_FEATURE_LABEL_PREFIX = "kici:agent-feature:";
+/**
+* Behaviours an agent build reports at registration.
+*
+* - `global-eval-skips-result-aware` — the pre-run global eval round runs only
+*   the needs-free generators and skips every generator declared with `needs`.
+*/
+const AgentFeature = z.enum(["global-eval-skips-result-aware"]);
+/** Build a `kici:agent-feature:<name>` label. */
+function agentFeatureLabel(feature) {
+	return `${AGENT_FEATURE_LABEL_PREFIX}${feature}`;
+}
+/** The label a global eval round carries when it must skip result-aware generators. */
+const GLOBAL_EVAL_SKIPS_RESULT_AWARE_LABEL = agentFeatureLabel(AgentFeature.enum["global-eval-skips-result-aware"]);
+/**
+* Every agent-feature label this build implements: what the agent self-reports
+* at registration, and what a scaler adds to the label sets of the agents it
+* spawns so it matches the same jobs.
+*/
+const AGENT_FEATURE_LABELS = AgentFeature.options.map(agentFeatureLabel);
 /**
 * The `kici:init` lifecycle label carried by a temporary init-runner agent
 * brought up on a fresh box for bootstrap. Marks it as ephemeral + privileged;
@@ -379,7 +413,8 @@ const SELF_REPORTED_LABEL_PREFIXES = [
 	"kici:os:",
 	"kici:arch:",
 	"kici:host:",
-	RUNTIME_LABEL_PREFIX
+	RUNTIME_LABEL_PREFIX,
+	AGENT_FEATURE_LABEL_PREFIX
 ];
 /**
 * True if a label is a self-reported platform fact (os/arch/host) rather than a
@@ -417,6 +452,6 @@ function separateLabels(labels) {
 	};
 }
 //#endregion
-export { CAPABILITY_LABEL_PREFIX, CONTAINER_BUILD_RUNTIME_LABEL, HOST_LABEL_PREFIX, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, KNOWN_ROLES, PLATFORM_TAINT_LABELS, PRIVILEGED_ROOT_LABEL, RESERVED_LABEL_PREFIX, ROLE_LABEL_PREFIX, RUNTIME_LABEL_PREFIX, RuntimeFact, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, ScalerArch, ScalerOs, agentTypeLabel, capabilityLabel, deriveOsArchLabels, derivePlatformTaints, hostLabel, hostToScalerPlatform, isAutoLabel, isSelfReportedLabel, mergeAutoLabels, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeRunsOn, parseHostLabel, platformToOsArchLabels, platformToTaints, resolveRoleLabels, roleToLabel, runtimeLabel, scalerAgentLabels, scalerLabel, scalerPlatformSchema, separateLabels, validateNoReservedLabels };
+export { AGENT_FEATURE_LABELS, AGENT_FEATURE_LABEL_PREFIX, AgentFeature, CAPABILITY_LABEL_PREFIX, CONTAINER_BUILD_RUNTIME_LABEL, GLOBAL_EVAL_SKIPS_RESULT_AWARE_LABEL, HOST_LABEL_PREFIX, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, JOB_IMAGE_RUNTIME_LABEL, KNOWN_ROLES, PLATFORM_TAINT_LABELS, PRIVILEGED_ROOT_LABEL, RESERVED_LABEL_PREFIX, ROLE_LABEL_PREFIX, RUNTIME_LABEL_PREFIX, RuntimeFact, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, ScalerArch, ScalerOs, agentFeatureLabel, agentTypeLabel, capabilityLabel, deriveOsArchLabels, derivePlatformTaints, hostLabel, hostToScalerPlatform, isAutoLabel, isSelfReportedLabel, mergeAutoLabels, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeRunsOn, parseHostLabel, platformToOsArchLabels, platformToTaints, resolveRoleLabels, roleToLabel, runtimeLabel, scalerAgentLabels, scalerLabel, scalerPlatformSchema, separateLabels, validateNoReservedLabels };
 
 //# sourceMappingURL=labels.js.map

package/dist/protocol/messages/agent-run-result.d.ts

@@ -355,6 +355,7 @@ export declare const agentStepLogsSchema: z.ZodObject<{
         value: z.ZodString;
     }, z.core.$strip>>;
     nextCursor: z.ZodNullable<z.ZodString>;
+    recorded: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export type AgentStepLogs = z.infer<typeof agentStepLogsSchema>;
 /**

package/dist/protocol/messages/agent-run-result.js

@@ -117,7 +117,13 @@ const agentStepLogsSchema = z.object({
 	totalLines: z.number().int(),
 	/** Every log line is user/process-controlled — each is enveloped untrusted. */
 	lines: z.array(untrustedString),
-	nextCursor: z.string().nullable()
+	nextCursor: z.string().nullable(),
+	/**
+	* Whether a log is stored for the step: `false` when none was ever written,
+	* `true` when one is, even if it holds no lines. Absent when the orchestrator
+	* does not report it.
+	*/
+	recorded: z.boolean().optional()
 });
 /**
 * Compact run-list row for the agent surface. KiCI ids/status/hashes are trusted

package/dist/protocol/messages/capabilities.d.ts

@@ -147,4 +147,33 @@ export declare const ORCH_AGENT_CAPABILITIES: Readonly<{
  * undefined (pre-capability orchestrator) or the flag is missing/false.
  */
 export declare function hasOrchAgentCapability(capabilities: OrchAgentCapabilities | undefined, flag: string): boolean;
+/**
+ * Agent -> Orchestrator capabilities, advertised on `agent.register`. Same
+ * evolution contract as the other directions: every field optional, absent =
+ * unsupported, `.passthrough()` preserves a newer agent's unknown flags. Lets
+ * the orchestrator route work that depends on an optional agent behaviour only
+ * to agents that implement it.
+ */
+export declare const agentCapabilitiesSchema: z.ZodObject<{
+    globalEvalSkipsResultAwareGenerators: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$loose>;
+/** Flag names of {@link agentCapabilitiesSchema}, for {@link hasAgentCapability} lookups. */
+export declare const AgentCapabilityFlag: z.ZodEnum<{
+    globalEvalSkipsResultAwareGenerators: "globalEvalSkipsResultAwareGenerators";
+}>;
+export type AgentCapabilityFlag = z.infer<typeof AgentCapabilityFlag>;
+/** Inferred type for agent -> orchestrator capabilities. */
+export type AgentCapabilities = z.infer<typeof agentCapabilitiesSchema>;
+/** Default agent -> orchestrator capabilities advertised on agent.register. */
+export declare const AGENT_CAPABILITIES: Readonly<{
+    globalEvalSkipsResultAwareGenerators: true;
+}>;
+/**
+ * Check whether an agent advertises a specific capability flag.
+ *
+ * Takes `string` (not `keyof`) because a newer agent may advertise flags this
+ * orchestrator build doesn't know about. Returns false if capabilities is
+ * undefined (pre-capability agent) or the flag is missing/false.
+ */
+export declare function hasAgentCapability(capabilities: AgentCapabilities | null | undefined, flag: string): boolean;
 //# sourceMappingURL=capabilities.d.ts.map

package/dist/protocol/messages/capabilities.js

@@ -138,7 +138,40 @@ const ORCH_AGENT_CAPABILITIES = Object.freeze({ artifactCompleteAck: true });
 function hasOrchAgentCapability(capabilities, flag) {
 	return capabilities?.[flag] === true;
 }
+/**
+* Agent -> Orchestrator capabilities, advertised on `agent.register`. Same
+* evolution contract as the other directions: every field optional, absent =
+* unsupported, `.passthrough()` preserves a newer agent's unknown flags. Lets
+* the orchestrator route work that depends on an optional agent behaviour only
+* to agents that implement it.
+*/
+const agentCapabilitiesSchema = z.object({ 
+/**
+* In a pre-run global eval round the agent runs only the needs-free
+* `DynamicJobFn`s and skips every generator declared with upstream `needs`
+* (a result-aware generator). Such a generator runs later, on the run's
+* deferred path, with its upstream outputs. An agent without this flag runs
+* every generator in the round — including a result-aware one, which then
+* sees no upstream outputs and produces the wrong jobs — so the
+* orchestrator sends a round containing a result-aware generator only to an
+* agent that advertises it.
+*/
+globalEvalSkipsResultAwareGenerators: z.boolean().optional() }).passthrough();
+/** Flag names of {@link agentCapabilitiesSchema}, for {@link hasAgentCapability} lookups. */
+const AgentCapabilityFlag = z.enum(["globalEvalSkipsResultAwareGenerators"]);
+/** Default agent -> orchestrator capabilities advertised on agent.register. */
+const AGENT_CAPABILITIES = Object.freeze({ globalEvalSkipsResultAwareGenerators: true });
+/**
+* Check whether an agent advertises a specific capability flag.
+*
+* Takes `string` (not `keyof`) because a newer agent may advertise flags this
+* orchestrator build doesn't know about. Returns false if capabilities is
+* undefined (pre-capability agent) or the flag is missing/false.
+*/
+function hasAgentCapability(capabilities, flag) {
+	return capabilities?.[flag] === true;
+}
 //#endregion
-export { ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, OrchRole, PLATFORM_CAPABILITIES, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, platformCapabilitiesSchema };
+export { AGENT_CAPABILITIES, AgentCapabilityFlag, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, OrchRole, PLATFORM_CAPABILITIES, agentCapabilitiesSchema, hasAgentCapability, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, platformCapabilitiesSchema };
 
 //# sourceMappingURL=capabilities.js.map

package/dist/protocol/messages/dashboard.d.ts

@@ -319,6 +319,7 @@ export declare const dashboardRunStateResponseSchema: z.ZodObject<{
             step_failure: "step_failure";
             timed_out: "timed_out";
         }>>;
+        statusEpoch: z.ZodOptional<z.ZodNumber>;
         jobs: z.ZodArray<z.ZodObject<{
             jobId: z.ZodString;
             jobName: z.ZodString;
@@ -601,6 +602,7 @@ export declare const dashboardStepLogsResponseSchema: z.ZodObject<{
     lines: z.ZodArray<z.ZodString>;
     totalLines: z.ZodNumber;
     nextCursor: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    recorded: z.ZodOptional<z.ZodBoolean>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /** Request the build-provenance attestations for a run. */
@@ -2091,6 +2093,16 @@ declare const dashboardEventDlqDiscardResponseSchema: z.ZodObject<{
     discarded: z.ZodOptional<z.ZodBoolean>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/**
+ * The kinds of context a job's declared context name resolves through: a
+ * `fixed` context matches its exact name, a `glob` context any name its
+ * pattern matches.
+ */
+export declare const ContextType: z.ZodEnum<{
+    fixed: "fixed";
+    glob: "glob";
+}>;
+export type ContextType = z.infer<typeof ContextType>;
 /** List all contexts for the org. */
 export declare const contextListRequestSchema: z.ZodObject<{
     type: z.ZodLiteral<"dashboard.contexts.list">;
@@ -2187,6 +2199,7 @@ declare const contextGetResponseSchema: z.ZodObject<{
         }>;
         globPattern: z.ZodNullable<z.ZodString>;
         branchRestrictions: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        repoPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
         concurrencyLimit: z.ZodNullable<z.ZodNumber>;
         concurrencyStrategy: z.ZodNullable<z.ZodEnum<{
             "cancel-pending": "cancel-pending";
@@ -2239,6 +2252,7 @@ export declare const contextCreateRequestSchema: z.ZodObject<{
     }>;
     globPattern: z.ZodOptional<z.ZodString>;
     branchRestrictions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    repoPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
     concurrencyLimit: z.ZodOptional<z.ZodNumber>;
     concurrencyStrategy: z.ZodOptional<z.ZodEnum<{
         "cancel-pending": "cancel-pending";
@@ -2288,6 +2302,7 @@ export declare const contextUpdateRequestSchema: z.ZodObject<{
         }>>;
         globPattern: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         branchRestrictions: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        repoPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
         concurrencyLimit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
         concurrencyStrategy: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
             "cancel-pending": "cancel-pending";
@@ -5196,6 +5211,7 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
     }>;
     globPattern: z.ZodOptional<z.ZodString>;
     branchRestrictions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    repoPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
     concurrencyLimit: z.ZodOptional<z.ZodNumber>;
     concurrencyStrategy: z.ZodOptional<z.ZodEnum<{
         "cancel-pending": "cancel-pending";
@@ -5243,6 +5259,7 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
         }>>;
         globPattern: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         branchRestrictions: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        repoPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
         concurrencyLimit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
         concurrencyStrategy: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
             "cancel-pending": "cancel-pending";
@@ -7438,6 +7455,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             step_failure: "step_failure";
             timed_out: "timed_out";
         }>>;
+        statusEpoch: z.ZodOptional<z.ZodNumber>;
         jobs: z.ZodArray<z.ZodObject<{
             jobId: z.ZodString;
             jobName: z.ZodString;
@@ -7458,6 +7476,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
     lines: z.ZodArray<z.ZodString>;
     totalLines: z.ZodNumber;
     nextCursor: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    recorded: z.ZodOptional<z.ZodBoolean>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.attestations.list.response">;
@@ -7754,6 +7773,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
         }>;
         globPattern: z.ZodNullable<z.ZodString>;
         branchRestrictions: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        repoPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
         concurrencyLimit: z.ZodNullable<z.ZodNumber>;
         concurrencyStrategy: z.ZodNullable<z.ZodEnum<{
             "cancel-pending": "cancel-pending";
@@ -8898,6 +8918,7 @@ export declare const dashboardStepLogsApiResponseSchema: z.ZodObject<{
     lines: z.ZodArray<z.ZodString>;
     totalLines: z.ZodNumber;
     nextCursor: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    recorded: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 /**
  * REST API response for the run attestations list. The orchestrator-relayed

package/dist/protocol/messages/dashboard.js

@@ -234,6 +234,12 @@ const dashboardStepLogsResponseSchema = z.object({
 	totalLines: z.number(),
 	/** Next line-offset cursor, or null when the page reached the end. */
 	nextCursor: z.string().nullable().optional(),
+	/**
+	* Whether a log is stored for the step: `false` when none was ever written,
+	* `true` when one is, even if it holds no lines. Absent when the orchestrator
+	* does not report it.
+	*/
+	recorded: z.boolean().optional(),
 	error: z.string().optional()
 });
 /** Request the build-provenance attestations for a run. */
@@ -946,7 +952,12 @@ const dashboardEventDlqDiscardResponseSchema = z.object({
 	discarded: z.boolean().optional(),
 	error: z.string().optional()
 });
-const contextTypeSchema = z.enum(["fixed", "glob"]);
+/**
+* The kinds of context a job's declared context name resolves through: a
+* `fixed` context matches its exact name, a `glob` context any name its
+* pattern matches.
+*/
+const ContextType = z.enum(["fixed", "glob"]);
 /** List all contexts for the org. */
 const contextListRequestSchema = z.object({
 	type: z.literal("dashboard.contexts.list"),
@@ -975,7 +986,7 @@ const contextListResponseSchema = z.object({
 	contexts: z.array(z.object({
 		id: z.string(),
 		name: z.string(),
-		type: contextTypeSchema,
+		type: ContextType,
 		globPattern: z.string().nullable(),
 		enabled: z.boolean(),
 		allowLocalExecution: z.boolean(),
@@ -990,6 +1001,11 @@ const contextListResponseSchema = z.object({
 	})).optional(),
 	error: z.string().optional()
 });
+/**
+* `owner/repo` glob patterns a context is limited to. An empty array means the
+* context applies to every repository, so it is also how the rule is cleared.
+*/
+const ContextRepoPatternsSchema = z.array(z.string());
 /** Get a single context by ID. */
 const contextGetRequestSchema = z.object({
 	type: z.literal("dashboard.contexts.get"),
@@ -1003,9 +1019,10 @@ const contextGetResponseSchema = z.object({
 	context: z.object({
 		id: z.string(),
 		name: z.string(),
-		type: contextTypeSchema,
+		type: ContextType,
 		globPattern: z.string().nullable(),
 		branchRestrictions: z.array(z.string()).nullable(),
+		repoPatterns: ContextRepoPatternsSchema.optional(),
 		concurrencyLimit: z.number().nullable(),
 		concurrencyStrategy: ConcurrencyStrategy.nullable(),
 		requiredReviewers: z.number().nullable(),
@@ -1024,9 +1041,10 @@ const contextCreateRequestSchema = z.object({
 	requestId: z.string(),
 	actor: actorPrincipalSchema,
 	name: z.string(),
-	contextType: contextTypeSchema,
+	contextType: ContextType,
 	globPattern: z.string().optional(),
 	branchRestrictions: z.array(z.string()).optional(),
+	repoPatterns: ContextRepoPatternsSchema.optional(),
 	concurrencyLimit: z.number().int().positive().optional(),
 	concurrencyStrategy: ConcurrencyStrategy.optional(),
 	requiredReviewers: z.number().optional(),
@@ -1048,9 +1066,10 @@ const contextUpdateRequestSchema = z.object({
 	contextId: z.string(),
 	updates: z.object({
 		name: z.string().optional(),
-		contextType: contextTypeSchema.optional(),
+		contextType: ContextType.optional(),
 		globPattern: z.string().nullable().optional(),
 		branchRestrictions: z.array(z.string()).nullable().optional(),
+		repoPatterns: ContextRepoPatternsSchema.optional(),
 		concurrencyLimit: z.number().int().positive().nullable().optional(),
 		concurrencyStrategy: ConcurrencyStrategy.nullable().optional(),
 		requiredReviewers: z.number().nullable().optional(),
@@ -2250,7 +2269,13 @@ const dashboardStepLogsApiResponseSchema = z.object({
 	lines: z.array(z.string()),
 	totalLines: z.number(),
 	/** Next line-offset cursor, or null when the page reached the end. */
-	nextCursor: z.string().nullable().optional()
+	nextCursor: z.string().nullable().optional(),
+	/**
+	* Whether a log is stored for the step: `false` when none was ever written,
+	* `true` when one is, even if it holds no lines. Absent when the orchestrator
+	* does not report it.
+	*/
+	recorded: z.boolean().optional()
 });
 /**
 * REST API response for the run attestations list. The orchestrator-relayed
@@ -2578,6 +2603,6 @@ const DashboardResponseErrorCode = z.enum([
 	"internal_error"
 ]);
 //#endregion
-export { ContextDeleteErrorCode, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, HeldRunStatus, TestRelayType, artifactListItemSchema, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, eventLogActivityCountsSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema };
+export { ContextDeleteErrorCode, ContextType, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, HeldRunStatus, TestRelayType, artifactListItemSchema, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, eventLogActivityCountsSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema };
 
 //# sourceMappingURL=dashboard.js.map

package/dist/protocol/messages/execution-status.d.ts

@@ -139,6 +139,8 @@ export type TimeoutReason = z.infer<typeof TimeoutReason>;
  *    build_coordination, approval_misconfig, sandbox_denied, trust_policy).
  *  - `job`-scoped categories fail one job and leave siblings alone
  *    (context_rules, dynamic_eval, no_agent, matrix_expansion).
+ *  - `secret_resolution` is also job-scoped on a dynamically generated job
+ *    whose own context gate failed; its siblings still dispatch.
  */
 export declare const InitFailureCategory: z.ZodEnum<{
     approval_misconfig: "approval_misconfig";
@@ -281,6 +283,8 @@ export declare const TERMINAL_JOB_STATES: ReadonlySet<string>;
 export type TerminalJobStatus = Exclude<ExecutionJobStatus, 'pending' | 'queued' | 'running' | 'recovering' | 'cancelling'>;
 /** Terminal step states that indicate the step is no longer running. */
 export declare const TERMINAL_STEP_STATES: ReadonlySet<string>;
+/** Largest status generation a frame may carry: the Platform stores it in a 32-bit integer column. */
+export declare const STATUS_EPOCH_MAX = 2147483647;
 /** Structured execution status update for Platform metadata tracking. */
 export declare const executionStatusSchema: z.ZodObject<{
     type: z.ZodLiteral<"execution.status">;
@@ -348,6 +352,7 @@ export declare const executionStatusSchema: z.ZodObject<{
         step_failure: "step_failure";
         timed_out: "timed_out";
     }>>;
+    statusEpoch: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 /** Per-step status forwarded from agent to Platform (real-time). */
 export declare const stepStatusForwardSchema: z.ZodObject<{
@@ -480,6 +485,7 @@ export declare const stateReplayRunSchema: z.ZodObject<{
         step_failure: "step_failure";
         timed_out: "timed_out";
     }>>;
+    statusEpoch: z.ZodOptional<z.ZodNumber>;
     jobs: z.ZodArray<z.ZodObject<{
         jobId: z.ZodString;
         jobName: z.ZodString;
@@ -532,6 +538,7 @@ export declare const stateReplaySchema: z.ZodObject<{
             step_failure: "step_failure";
             timed_out: "timed_out";
         }>>;
+        statusEpoch: z.ZodOptional<z.ZodNumber>;
         jobs: z.ZodArray<z.ZodObject<{
             jobId: z.ZodString;
             jobName: z.ZodString;

package/dist/protocol/messages/execution-status.js

@@ -134,6 +134,8 @@ const TimeoutReason = z.enum(["job_timeout", "workflow_timeout"]);
 *    build_coordination, approval_misconfig, sandbox_denied, trust_policy).
 *  - `job`-scoped categories fail one job and leave siblings alone
 *    (context_rules, dynamic_eval, no_agent, matrix_expansion).
+*  - `secret_resolution` is also job-scoped on a dynamically generated job
+*    whose own context gate failed; its siblings still dispatch.
 */
 const InitFailureCategory = z.enum([
 	"secret_resolution",
@@ -255,6 +257,10 @@ const TERMINAL_STEP_STATES = /* @__PURE__ */ new Set([
 	ExecutionStepStatus.enum.skipped,
 	ExecutionStepStatus.enum.cancelled
 ]);
+/** Largest status generation a frame may carry: the Platform stores it in a 32-bit integer column. */
+const STATUS_EPOCH_MAX = 2147483647;
+/** A run's status generation — see `executionStatusSchema.statusEpoch`. */
+const statusEpochSchema = z.number().int().nonnegative().max(STATUS_EPOCH_MAX);
 /** Structured execution status update for Platform metadata tracking. */
 const executionStatusSchema = z.object({
 	type: z.literal("execution.status"),
@@ -345,7 +351,17 @@ const executionStatusSchema = z.object({
 	*/
 	initFailure: initFailureSchema.optional(),
 	/** Why a terminal run failed (only present for failed/cancelled runs). */
-	failureClass: RunFailureClass.optional()
+	failureClass: RunFailureClass.optional(),
+	/**
+	* The run's status generation. It starts at 0 and the orchestrator raises it
+	* each time the run leaves a terminal status (a run failed before a job it had
+	* already dispatched reported in, and then continues). The Platform keeps a
+	* terminal status against a non-terminal frame unless the frame's generation
+	* is newer, so a frame that arrives late cannot move a finished run back.
+	* Optional for backward compatibility: an older orchestrator omits it, and the
+	* Platform then applies the frame unguarded.
+	*/
+	statusEpoch: statusEpochSchema.optional()
 });
 /** Per-step status forwarded from agent to Platform (real-time). */
 const stepStatusForwardSchema = z.object({
@@ -442,6 +458,8 @@ const stateReplayRunSchema = z.object({
 	failureReason: z.string().max(STATUS_FREE_TEXT_MAX).optional(),
 	/** Why the run failed (`RunFailureClass`); only present for failed/cancelled runs. */
 	failureClass: RunFailureClass.optional(),
+	/** The run's status generation, with the same meaning as on `execution.status`. */
+	statusEpoch: statusEpochSchema.optional(),
 	jobs: z.array(z.object({
 		jobId: z.string().max(128),
 		jobName: z.string().max(128),
@@ -462,6 +480,6 @@ const stateReplaySchema = z.object({
 	timestamp: z.number()
 });
 //#endregion
-export { CONTEXTS_MAX, CacheOutcome, CacheRunEventType, CacheStepType, DEAD_ORCH_FAILURE_REASON, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, JobKind, MAX_JOBS_PER_RUN, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RunFailureClass, STATE_REPLAY_MAX_RUNS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, SetupStepType, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, isSetupStepType, jobStatusForwardSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepStatusForwardSchema };
+export { CONTEXTS_MAX, CacheOutcome, CacheRunEventType, CacheStepType, DEAD_ORCH_FAILURE_REASON, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, JobKind, MAX_JOBS_PER_RUN, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RunFailureClass, STATE_REPLAY_MAX_RUNS, STATUS_EPOCH_MAX, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, SetupStepType, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, isSetupStepType, jobStatusForwardSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepStatusForwardSchema };
 
 //# sourceMappingURL=execution-status.js.map

package/dist/protocol/messages/orchestrator-agent.d.ts

@@ -237,6 +237,9 @@ export declare const agentRegisterSchema: z.ZodObject<{
     runningAsUser: z.ZodOptional<z.ZodString>;
     runningAsUid: z.ZodOptional<z.ZodNumber>;
     properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    capabilities: z.ZodOptional<z.ZodObject<{
+        globalEvalSkipsResultAwareGenerators: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>;
 }, z.core.$strip>;
 /** Periodic agent status update. */
 export declare const agentStatusSchema: z.ZodObject<{
@@ -763,6 +766,13 @@ export declare const agentAuthFailureSchema: z.ZodObject<{
     type: z.ZodLiteral<"auth.failure">;
     reason: z.ZodString;
 }, z.core.$strip>;
+/**
+ * How long an agent waits for the `agent.api.response` to one
+ * `agent.api.request` before it fails the call. An orchestrator handler that
+ * can wait on something slow (the provenance signer) answers within a fraction
+ * of this, so the step receives the handler's answer instead of a timeout.
+ */
+export declare const AGENT_API_REQUEST_TIMEOUT_MS = 15000;
 /** API request sent by agent to orchestrator (e.g., infrastructure.list). */
 export declare const agentApiRequestSchema: z.ZodObject<{
     type: z.ZodLiteral<"agent.api.request">;
@@ -1134,6 +1144,9 @@ export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[
     runningAsUser: z.ZodOptional<z.ZodString>;
     runningAsUid: z.ZodOptional<z.ZodNumber>;
     properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    capabilities: z.ZodOptional<z.ZodObject<{
+        globalEvalSkipsResultAwareGenerators: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"agent.status">;
     messageId: z.ZodString;

package/dist/protocol/messages/orchestrator-agent.js

@@ -3,7 +3,7 @@ import { provenanceContextSchema } from "../../provenance/id-token-event-claims.
 import { ExecutionJobStatus, ExecutionStepStatus, StepConcurrencyKind } from "./execution-status.js";
 import { dsseEnvelopeSchema } from "../../provenance/dsse.js";
 import { approvalTimeoutSecondsSchema, approverClauseSchema } from "../../approval/types.js";
-import { orchAgentCapabilitiesSchema } from "./capabilities.js";
+import { agentCapabilitiesSchema, orchAgentCapabilitiesSchema } from "./capabilities.js";
 import { LogStream } from "./log-stream.js";
 import { z } from "zod";
 //#region src/protocol/messages/orchestrator-agent.ts
@@ -325,7 +325,13 @@ const agentRegisterSchema = z.object({
 		z.string(),
 		z.number(),
 		z.boolean()
-	])).optional()
+	])).optional(),
+	/**
+	* Optional agent behaviours this agent build implements (absent on
+	* pre-capability agents, which the orchestrator treats as supporting none).
+	* The orchestrator reads it to route work that depends on one of them.
+	*/
+	capabilities: agentCapabilitiesSchema.optional()
 });
 /** Periodic agent status update. */
 const agentStatusSchema = z.object({
@@ -939,6 +945,13 @@ const agentAuthFailureSchema = z.object({
 	type: z.literal("auth.failure"),
 	reason: z.string()
 });
+/**
+* How long an agent waits for the `agent.api.response` to one
+* `agent.api.request` before it fails the call. An orchestrator handler that
+* can wait on something slow (the provenance signer) answers within a fraction
+* of this, so the step receives the handler's answer instead of a timeout.
+*/
+const AGENT_API_REQUEST_TIMEOUT_MS = 15e3;
 /** API request sent by agent to orchestrator (e.g., infrastructure.list). */
 const agentApiRequestSchema = z.object({
 	type: z.literal("agent.api.request"),
@@ -1116,6 +1129,6 @@ const agentToOrchestratorMessageSchema = z.discriminatedUnion("type", [
 	stepApprovalRequestSchema
 ]);
 //#endregion
-export { ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactRejectReason, ArtifactUploadOutcome, CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, invokeResultSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, rateLimitWarningSchema, registerAckSchema, scalerClaimCredentialsResponseSchema, scalerClaimCredentialsSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema };
+export { AGENT_API_REQUEST_TIMEOUT_MS, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactRejectReason, ArtifactUploadOutcome, CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, invokeResultSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, rateLimitWarningSchema, registerAckSchema, scalerClaimCredentialsResponseSchema, scalerClaimCredentialsSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema };
 
 //# sourceMappingURL=orchestrator-agent.js.map

package/dist/protocol/messages/peer.d.ts

@@ -178,6 +178,7 @@ export declare const jobRerouteSchema: z.ZodObject<{
     depsUrl: z.ZodOptional<z.ZodString>;
     depsHash: z.ZodOptional<z.ZodString>;
     cloneToken: z.ZodOptional<z.ZodString>;
+    workflowCloneToken: z.ZodOptional<z.ZodString>;
     encryptedSecrets: z.ZodOptional<z.ZodString>;
     encryptedNamespacedSecrets: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -601,6 +602,7 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     depsUrl: z.ZodOptional<z.ZodString>;
     depsHash: z.ZodOptional<z.ZodString>;
     cloneToken: z.ZodOptional<z.ZodString>;
+    workflowCloneToken: z.ZodOptional<z.ZodString>;
     encryptedSecrets: z.ZodOptional<z.ZodString>;
     encryptedNamespacedSecrets: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
@@ -915,6 +917,7 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     depsUrl: z.ZodOptional<z.ZodString>;
     depsHash: z.ZodOptional<z.ZodString>;
     cloneToken: z.ZodOptional<z.ZodString>;
+    workflowCloneToken: z.ZodOptional<z.ZodString>;
     encryptedSecrets: z.ZodOptional<z.ZodString>;
     encryptedNamespacedSecrets: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{

package/dist/protocol/messages/peer.js

@@ -203,6 +203,8 @@ const jobRerouteSchema = z.object({
 	depsHash: z.string().optional(),
 	/** Pre-resolved clone token for workers without provider credentials. */
 	cloneToken: z.string().optional(),
+	/** Pre-resolved clone token for the workflow repository of an organization-wide job. */
+	workflowCloneToken: z.string().optional(),
 	/** Encrypted secrets envelope (AES-256-GCM with session key). */
 	encryptedSecrets: z.string().optional(),
 	/** Encrypted namespaced secrets envelope. */

package/dist/protocol/messages/platform-orchestrator.d.ts

@@ -1345,6 +1345,7 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     }>;
     globPattern: z.ZodOptional<z.ZodString>;
     branchRestrictions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    repoPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
     concurrencyLimit: z.ZodOptional<z.ZodNumber>;
     concurrencyStrategy: z.ZodOptional<z.ZodEnum<{
         "cancel-pending": "cancel-pending";
@@ -1392,6 +1393,7 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         }>>;
         globPattern: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         branchRestrictions: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        repoPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
         concurrencyLimit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
         concurrencyStrategy: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
             "cancel-pending": "cancel-pending";
@@ -3377,6 +3379,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
         step_failure: "step_failure";
         timed_out: "timed_out";
     }>>;
+    statusEpoch: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"step.status.forward">;
     messageId: z.ZodString;
@@ -3498,6 +3501,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             step_failure: "step_failure";
             timed_out: "timed_out";
         }>>;
+        statusEpoch: z.ZodOptional<z.ZodNumber>;
         jobs: z.ZodArray<z.ZodObject<{
             jobId: z.ZodString;
             jobName: z.ZodString;

package/dist/provenance/id-token-claim-names.d.ts

@@ -8,6 +8,6 @@
  * orchestrator binds the list to its `IdTokenClaims` type at compile time and
  * a drift test checks it against the claims its builder actually emits.
  */
-export declare const ID_TOKEN_CLAIM_NAMES: readonly ['iss', 'sub', 'aud', 'iat', 'nbf', 'exp', 'jti', 'kici_run_id', 'kici_job_id', 'repository', 'ref', 'base_ref', 'head_ref', 'head_repository', 'is_fork', 'event_name', 'trust_tier', 'actor', 'sha', 'workflow_ref', 'orchestrator_id', 'org_id', 'source_origin', 'provider', 'statement_hash', 'attestation_origin'];
+export declare const ID_TOKEN_CLAIM_NAMES: readonly ['iss', 'sub', 'aud', 'iat', 'nbf', 'exp', 'jti', 'kici_run_id', 'kici_job_id', 'repository', 'workflow_repository', 'ref', 'base_ref', 'head_ref', 'head_repository', 'is_fork', 'event_name', 'trust_tier', 'actor', 'sha', 'workflow_ref', 'orchestrator_id', 'org_id', 'source_origin', 'provider', 'statement_hash', 'attestation_origin'];
 export type IdTokenClaimName = (typeof ID_TOKEN_CLAIM_NAMES)[number];
 //# sourceMappingURL=id-token-claim-names.d.ts.map

package/dist/provenance/id-token-claim-names.js

@@ -21,6 +21,7 @@ const ID_TOKEN_CLAIM_NAMES = [
 	"kici_run_id",
 	"kici_job_id",
 	"repository",
+	"workflow_repository",
 	"ref",
 	"base_ref",
 	"head_ref",

package/dist/provider/check-status-poster.d.ts

@@ -33,24 +33,12 @@ export interface CheckStatusPoster {
      * the two never overwrite each other.
      */
     postWorkflowModificationCheck(repoIdentifier: string, commitSha: string, modifications: WorkflowModificationInfo[], credentials: unknown): Promise<void>;
-    /**
-     * Post an informational (neutral) check recording that the organization's
-     * global workflows were skipped because the org trust policy held or rejected
-     * the event.
-     *
-     * Its own check name, for the same reason as the workflow-modification check:
-     * the security-hold check is a single named run per commit, so posting this
-     * notice through `postCheckStatus` would UPDATE that run and replace the
-     * pending "Held for approval" state with a completed neutral conclusion —
-     * unblocking a branch protection rule that requires the security check.
-     */
-    postGlobalWorkflowsSkippedCheck(repoIdentifier: string, commitSha: string, summary: string, credentials: unknown): Promise<void>;
     /**
      * Post a failing check recording that the pre-run evaluation of the
      * organization's global workflows could not be completed, so none of the
      * workflows it was deciding on ran for this commit.
      *
-     * Its own check name, for the same reason as the two notices above: the
+     * Its own check name, for the same reason as the notice above: the
      * security-hold check is a single named run per commit, so posting this
      * through `postCheckStatus` would UPDATE that run and replace a pending
      * "Held for approval" state with a completed conclusion.

package/dist/trigger/types.d.ts

@@ -42,6 +42,11 @@
  *   sibling closure the deps tarball carries, which no package-manager lock file moves).
  * Schema version 41 (additive): adds LockDynamicJobFn.gitCredentials (named git credential
  *   refs declared by a dynamicJob generator and inherited by every job it generates).
+ * Schema version 42 (additive, conditional reader floor): approval enforced on
+ *   organization-wide workflows. The lock shape is unchanged, but a v41 reader dispatches a
+ *   global workflow without consulting its `approval`, so a lock whose global workflow (or
+ *   one of its static jobs) declares `approval` stamps `minReaderVersion` =
+ *   `GLOBAL_APPROVAL_MIN_READER`. Every other lock keeps `minReaderVersion` = `BREAKING_FLOOR`.
  */
 import { z } from 'zod';
 import type { ProviderType } from '../provider/types.js';
@@ -54,7 +59,7 @@ import { ExecutionJobStatus } from '../protocol/messages/execution-status.js';
  * schema change (additive or breaking); the bump-history comment above records
  * which. See `BREAKING_FLOOR` for the compatibility-window semantics.
  */
-export declare const SCHEMA_VERSION: 41;
+export declare const SCHEMA_VERSION: 42;
 /**
  * Oldest lock schema version this codebase can still read correctly — the lower
  * bound of the acceptance window.
@@ -71,6 +76,16 @@ export declare const SCHEMA_VERSION: 41;
  * reads correctly.
  */
 export declare const BREAKING_FLOOR: 30;
+/**
+ * Reader version a lock must require when an organization-wide workflow in it
+ * (a workflow with a trigger carrying `repos:`), or one of that workflow's
+ * static jobs, declares `approval`. Readers below this version run a global
+ * workflow's jobs without holding them for approval, so they must refuse such a
+ * lock rather than dispatch it ungated. Not a `BREAKING_FLOOR` move: the lock
+ * shape is unchanged, and locks without a gated global workflow stay readable by
+ * every orchestrator down to the floor.
+ */
+export declare const GLOBAL_APPROVAL_MIN_READER: 42;
 /**
  * Normalized approval config carried in the lock file. Produced by the compiler
  * from an SDK `approval` at any of the three levels; consumed by the
@@ -936,8 +951,8 @@ export type LockJobOrFactory = LockJob | LockDynamicJobFn;
 /**
  * Private npm registry declaration in the lock file.
  * Carries the URL/scope/secret-reference but NOT the resolved token —
- * the orchestrator resolves the token at dispatch time via the per-context
- * secretResolver.resolveForJob path.
+ * the orchestrator resolves the token at dispatch time through the named
+ * context's secret bindings.
  */
 export interface LockRegistry {
     readonly url: string;
@@ -966,7 +981,11 @@ export interface LockWorkflow {
     readonly hashFiles?: string[];
     /** Resolved paths (relative to repo root) used to compute contentHash. Enables agent to verify hash without re-discovering workflow. Optional. */
     readonly resolvedHashFiles?: string[];
-    /** Secret contexts declared by the workflow. Orchestrator validates access before dispatch. Optional. */
+    /**
+     * Context names bound by every job of the workflow, gated per job like job-level
+     * contexts. They come before each job's own contexts, so a job-level context wins
+     * a key collision. Optional.
+     */
     readonly contexts?: readonly string[];
     /**
      * Private npm registries the agent should authenticate against before `npm install`.
@@ -1018,9 +1037,11 @@ export interface LockWorkflow {
 export interface LockFile {
     readonly schemaVersion: typeof SCHEMA_VERSION;
     /**
-     * The newest breaking schema version at emit time (the compiler stamps
-     * `BREAKING_FLOOR`). A reader whose own `SCHEMA_VERSION` is below this value
-     * predates a breaking change the lock relies on and must reject it. Absent on
+     * The oldest reader schema version that handles this lock correctly. The
+     * compiler stamps `BREAKING_FLOOR`, or `GLOBAL_APPROVAL_MIN_READER` when an
+     * organization-wide workflow in the lock declares `approval`. A reader whose
+     * own `SCHEMA_VERSION` is below this value would mis-handle the lock and must
+     * reject it. Absent on
      * pre-window locks, in which case the reader falls back to exact-match
      * strictness (see `assertLockFileSchemaCompatible`).
      */

package/dist/trigger/types.js

@@ -47,13 +47,18 @@ import { z } from "zod";
 *   sibling closure the deps tarball carries, which no package-manager lock file moves).
 * Schema version 41 (additive): adds LockDynamicJobFn.gitCredentials (named git credential
 *   refs declared by a dynamicJob generator and inherited by every job it generates).
+* Schema version 42 (additive, conditional reader floor): approval enforced on
+*   organization-wide workflows. The lock shape is unchanged, but a v41 reader dispatches a
+*   global workflow without consulting its `approval`, so a lock whose global workflow (or
+*   one of its static jobs) declares `approval` stamps `minReaderVersion` =
+*   `GLOBAL_APPROVAL_MIN_READER`. Every other lock keeps `minReaderVersion` = `BREAKING_FLOOR`.
 */
 /**
 * Schema version the compiler emits into every lock file. Incremented on ANY
 * schema change (additive or breaking); the bump-history comment above records
 * which. See `BREAKING_FLOOR` for the compatibility-window semantics.
 */
-const SCHEMA_VERSION = 41;
+const SCHEMA_VERSION = 42;
 /**
 * Oldest lock schema version this codebase can still read correctly — the lower
 * bound of the acceptance window.
@@ -71,6 +76,16 @@ const SCHEMA_VERSION = 41;
 */
 const BREAKING_FLOOR = 30;
 /**
+* Reader version a lock must require when an organization-wide workflow in it
+* (a workflow with a trigger carrying `repos:`), or one of that workflow's
+* static jobs, declares `approval`. Readers below this version run a global
+* workflow's jobs without holding them for approval, so they must refuse such a
+* lock rather than dispatch it ungated. Not a `BREAKING_FLOOR` move: the lock
+* shape is unchanged, and locks without a gated global workflow stay readable by
+* every orchestrator down to the floor.
+*/
+const GLOBAL_APPROVAL_MIN_READER = 42;
+/**
 * Resolve a content requirement's parse format to a concrete value. An explicit
 * non-`auto` format is returned as-is; `auto` (or unset) is resolved by the file
 * extension: `.json` → json, `.yaml`/`.yml` → yaml, everything else text.
@@ -204,6 +219,6 @@ const changedFilesStatusSchema = z.enum([
 	"skipped"
 ]);
 //#endregion
-export { BREAKING_FLOOR, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, changedFilesStatusSchema, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, resolveContentFormat, resolveWhenToRunOn };
+export { BREAKING_FLOOR, GLOBAL_APPROVAL_MIN_READER, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, changedFilesStatusSchema, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, resolveContentFormat, resolveWhenToRunOn };
 
 //# sourceMappingURL=types.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/engine",
-  "version": "0.9.1",
+  "version": "0.10.0",
   "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
   "keywords": [
     "ci",

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/engine@0.9.1",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.9.1/6069e1a4-5c5d-4efa-878f-506b7563ca06",
+  "name": "@kici-dev/engine@0.10.0",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.10.0/500f319e-27da-47e9-bc66-2d93e21e2c04",
   "creationInfo": {
-    "created": "2026-09-22T02:16:18Z",
+    "created": "2026-09-25T03:03:09Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -54,7 +54,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.9.1",
+      "versionInfo": "0.10.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -65,7 +65,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.9.1"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.10.0"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",