@kici-dev/engine 0.0.0 → 0.1.1

package/dist/env/environment-allowlist.js

@@ -0,0 +1,69 @@
+import "../chunk-gOLHoazu.js";
+//#region src/env/environment-allowlist.ts
+/**
+* Shared environment allowlist constants for KiCI.
+*
+* Single source of truth for environment variable filtering used across tiers:
+* - Orchestrator bare-metal backend (spawned agent processes)
+* - Agent sandbox execution (customer code isolation)
+*
+* These constants ensure that orchestrator/agent secrets (DATABASE_URL,
+* GITHUB_PRIVATE_KEY, PLATFORM_TOKEN, WEBHOOK_SECRET, etc.) are never leaked
+* to child processes or customer code.
+*/
+/**
+* System environment variables that are safe to pass into spawned processes.
+*
+* This is an explicit allowlist -- anything NOT listed here is stripped.
+* Adding new variables to the host process will NOT leak them downstream.
+*/
+const ALLOWED_SYSTEM_VARS = [
+	"PATH",
+	"HOME",
+	"USER",
+	"SHELL",
+	"LANG",
+	"LC_ALL",
+	"TERM",
+	"TMPDIR",
+	"NODE_PATH",
+	"TZ"
+];
+/**
+* Default environment variables injected into every sandbox execution.
+*
+* These are set before user/secret env vars so they can be overridden.
+* - FORCE_COLOR=1: Ensures color-aware libraries (chalk, etc.) emit ANSI
+*   codes even when stdout is a pipe (non-TTY). Without this, log output
+*   appears uncolored in the dashboard log viewer.
+*/
+const SANDBOX_DEFAULT_VARS = { FORCE_COLOR: "1" };
+/**
+* KICI environment variables required by the agent.
+*
+* These are set explicitly by the scaler (not copied from orchestrator process.env)
+* to ensure the agent receives only the values it needs with correct content.
+*/
+const AGENT_REQUIRED_KICI_VARS = [
+	"KICI_ORCHESTRATOR_URL",
+	"KICI_AGENT_ID",
+	"KICI_LABELS",
+	"KICI_MAX_CONCURRENT_JOBS",
+	"KICI_SCALER_MANAGED",
+	"KICI_EXECUTION_MODE",
+	"KICI_PORT"
+];
+/**
+* Prefix for operator-defined environment variables that should be forwarded
+* from the orchestrator process to spawned agent processes.
+*
+* Variables with this prefix in the orchestrator's process.env are forwarded
+* to agent child processes with the prefix stripped. For example:
+*   KICI_AGENT_ENV_HTTP_PROXY=http://proxy:3128
+*   -> HTTP_PROXY=http://proxy:3128 in the agent process
+*/
+const KICI_AGENT_ENV_PREFIX = "KICI_AGENT_ENV_";
+//#endregion
+export { AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, KICI_AGENT_ENV_PREFIX, SANDBOX_DEFAULT_VARS };
+
+//# sourceMappingURL=environment-allowlist.js.map

package/dist/environment/index.d.ts

@@ -0,0 +1,3 @@
+export type { Environment, EnvironmentBinding, EnvironmentVariable, EnvironmentSourceOverride, ScopedSecret, HeldRun, ProtectionGateResult, TrustTier, } from './types.js';
+export { resolveSecretsForEnvironment, matchScopePattern, stripScopePrefix, } from './scope-resolver.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/environment/index.js

@@ -0,0 +1,3 @@
+import "../chunk-gOLHoazu.js";
+import { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix } from "./scope-resolver.js";
+export { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix };

package/dist/environment/scope-resolver.d.ts

@@ -0,0 +1,35 @@
+import type { EnvironmentBinding, ScopedSecret } from './types.js';
+/**
+ * Check whether a scope string matches a pattern.
+ *
+ * Supports exact match and glob patterns (via picomatch).
+ * Scope paths use '/' as separator (e.g., 'aws/prod/db').
+ *
+ * For prefixed scopes (e.g., 'pg:aws/prod'), the pattern may be prefixed too
+ * (e.g., 'pg:**'). In this case, the backend prefix must match exactly and
+ * the path portion is matched separately against the glob. This is needed
+ * because picomatch's '**' requires '/' separators — 'pg:**' wouldn't match
+ * 'pg:aws/prod' without splitting on the colon.
+ */
+export declare function matchScopePattern(scope: string, pattern: string): boolean;
+/**
+ * Strip the backend prefix from a scope string.
+ * Prefixed scopes have the form "backendName:path" (e.g., "pg:aws/prod").
+ * Returns the path after the first colon, or the full scope if no prefix.
+ */
+export declare function stripScopePrefix(scope: string): string;
+/**
+ * Resolve secrets for an environment by matching bindings against scoped secrets.
+ *
+ * Takes already-filtered bindings (for the target environment). For each binding,
+ * finds secrets whose scope matches the binding's scopePattern via picomatch.
+ * When multiple scopes provide the same key, longest scope path wins (higher specificity).
+ * Scope depth is computed AFTER stripping the backend prefix.
+ *
+ * @param bindings - Bindings already filtered for the target environment
+ * @param allSecrets - All scoped secrets in the org
+ * @param decryptFn - Pure decryption function (keeps this module crypto-free)
+ * @returns Flat record of decrypted secret key-value pairs
+ */
+export declare function resolveSecretsForEnvironment(bindings: EnvironmentBinding[], allSecrets: ScopedSecret[], decryptFn: (s: ScopedSecret) => string): Record<string, string>;
+//# sourceMappingURL=scope-resolver.d.ts.map

package/dist/environment/scope-resolver.js

@@ -0,0 +1,77 @@
+import "../chunk-gOLHoazu.js";
+import picomatch from "picomatch";
+//#region src/environment/scope-resolver.ts
+/**
+* Check whether a scope string matches a pattern.
+*
+* Supports exact match and glob patterns (via picomatch).
+* Scope paths use '/' as separator (e.g., 'aws/prod/db').
+*
+* For prefixed scopes (e.g., 'pg:aws/prod'), the pattern may be prefixed too
+* (e.g., 'pg:**'). In this case, the backend prefix must match exactly and
+* the path portion is matched separately against the glob. This is needed
+* because picomatch's '**' requires '/' separators — 'pg:**' wouldn't match
+* 'pg:aws/prod' without splitting on the colon.
+*/
+function matchScopePattern(scope, pattern) {
+	if (scope === pattern) return true;
+	const scopeColon = scope.indexOf(":");
+	const patternColon = pattern.indexOf(":");
+	if (scopeColon >= 0 && patternColon >= 0) {
+		if (scope.slice(0, scopeColon) !== pattern.slice(0, patternColon)) return false;
+		const scopePath = scope.slice(scopeColon + 1);
+		const patternPath = pattern.slice(patternColon + 1);
+		if (scopePath === patternPath) return true;
+		return picomatch.isMatch(scopePath, patternPath);
+	}
+	if (scopeColon >= 0 && patternColon < 0) {
+		const scopePath = scope.slice(scopeColon + 1);
+		if (scopePath === pattern) return true;
+		return picomatch.isMatch(scopePath, pattern);
+	}
+	return picomatch.isMatch(scope, pattern);
+}
+/**
+* Strip the backend prefix from a scope string.
+* Prefixed scopes have the form "backendName:path" (e.g., "pg:aws/prod").
+* Returns the path after the first colon, or the full scope if no prefix.
+*/
+function stripScopePrefix(scope) {
+	const colonIdx = scope.indexOf(":");
+	return colonIdx >= 0 ? scope.slice(colonIdx + 1) : scope;
+}
+/**
+* Resolve secrets for an environment by matching bindings against scoped secrets.
+*
+* Takes already-filtered bindings (for the target environment). For each binding,
+* finds secrets whose scope matches the binding's scopePattern via picomatch.
+* When multiple scopes provide the same key, longest scope path wins (higher specificity).
+* Scope depth is computed AFTER stripping the backend prefix.
+*
+* @param bindings - Bindings already filtered for the target environment
+* @param allSecrets - All scoped secrets in the org
+* @param decryptFn - Pure decryption function (keeps this module crypto-free)
+* @returns Flat record of decrypted secret key-value pairs
+*/
+function resolveSecretsForEnvironment(bindings, allSecrets, decryptFn) {
+	const candidates = [];
+	for (const binding of bindings) for (const secret of allSecrets) if (matchScopePattern(secret.scope, binding.scopePattern)) {
+		const scopePath = stripScopePrefix(secret.scope);
+		candidates.push({
+			secret,
+			scopeDepth: scopePath.split("/").length
+		});
+	}
+	const resolved = /* @__PURE__ */ new Map();
+	for (const candidate of candidates) {
+		const existing = resolved.get(candidate.secret.key);
+		if (!existing || candidate.scopeDepth > existing.scopeDepth) resolved.set(candidate.secret.key, candidate);
+	}
+	const result = {};
+	for (const [key, { secret }] of resolved) result[key] = decryptFn(secret);
+	return result;
+}
+//#endregion
+export { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix };
+
+//# sourceMappingURL=scope-resolver.js.map

package/dist/environment/types.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Environment types for KiCI's deployment environment model.
+ *
+ * Environments are org-level entities that group secrets, variables,
+ * and protection rules for deployment targets (dev, staging, production).
+ */
+/** Environment entity — org-level deployment target with protection rules. */
+export interface Environment {
+    id: string;
+    orgId: string;
+    name: string;
+    type: 'fixed' | 'glob';
+    globPattern: string | null;
+    branchRestrictions: string[];
+    triggerTypeFilters: string[];
+    repoPatterns: string[];
+    concurrencyLimit: number | null;
+    concurrencyStrategy: 'queue' | 'cancel-pending';
+    concurrencyTimeoutMs: number;
+    requiredReviewers: string[] | null;
+    waitTimerSeconds: number | null;
+    holdExpirySeconds: number;
+    /** Minimum trust tier required for CI execution in this environment. */
+    minimumTrust?: 'known' | 'trusted';
+    /** Whether this environment allows local (no-remote) executions. Default false. */
+    allowLocalExecution?: boolean;
+    enabled: boolean;
+    createdAt: string;
+    updatedAt: string;
+    createdBy: string;
+}
+/** Scoped secret — individual secret with a scope path for precedence resolution. */
+export interface ScopedSecret {
+    id: string;
+    orgId: string;
+    scope: string;
+    key: string;
+    encryptedValue: string;
+    backendType: 'pg' | 'vault';
+    keyVersion: number;
+    createdAt: string;
+    updatedAt: string;
+}
+/** Binding that maps a scope pattern to an environment. */
+export interface EnvironmentBinding {
+    id: string;
+    orgId: string;
+    environmentId: string;
+    scopePattern: string;
+    createdAt: string;
+}
+/** Non-secret key-value config per environment, with optional lock. */
+export interface EnvironmentVariable {
+    id: string;
+    orgId: string;
+    environmentId: string;
+    key: string;
+    value: string;
+    locked: boolean;
+    createdAt: string;
+    updatedAt: string;
+}
+/** Per-source override for an environment variable. */
+export interface EnvironmentSourceOverride {
+    id: string;
+    orgId: string;
+    environmentId: string;
+    routingKey: string;
+    key: string;
+    value: string;
+    createdAt: string;
+    updatedAt: string;
+}
+/** Trust tier for contributor-based CI execution gating. */
+export type TrustTier = 'trusted' | 'known' | 'unknown';
+/** Held run record for protection gate enforcement. */
+export interface HeldRun {
+    id: string;
+    orgId: string;
+    runId: string;
+    jobId: string;
+    environmentId: string;
+    holdType: 'reviewer' | 'timer' | 'concurrency' | 'security';
+    status: 'pending' | 'approved' | 'rejected' | 'expired';
+    reason: string | null;
+    approvedBy: string | null;
+    createdAt: string;
+    expiresAt: string | null;
+    resolvedAt: string | null;
+}
+/** Result from the protection gate pipeline evaluation. */
+export interface ProtectionGateResult {
+    action: 'pass' | 'reject' | 'hold' | 'queue' | 'wait';
+    reason?: string;
+    holdUntil?: string;
+    holdType?: 'reviewer' | 'timer' | 'concurrency' | 'security';
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/environment/types.js

@@ -0,0 +1,2 @@
+import "../chunk-gOLHoazu.js";
+export {};

package/dist/index.d.ts

@@ -0,0 +1,54 @@
+/**
+ * @kici-dev/engine - Consolidated business logic for KiCI.
+ *
+ * Single source of truth for shared logic used across tiers:
+ * - Protocol message schemas (Zod-based, direction-specific unions)
+ * - Trigger matching engine (branch, path, event evaluation)
+ * - Execution state machine (pure function transitions)
+ * - Webhook signature verification (HMAC-SHA256)
+ * - WebSocket close codes (unified across all tiers)
+ */
+export * from './protocol/version.js';
+export * from './protocol/messages/common.js';
+export * from './protocol/messages/actor.js';
+export * from './protocol/messages/auth.js';
+export * from './protocol/messages/capabilities.js';
+export { webhookRelaySchema, webhookRelayStartSchema, webhookRelayChunkSchema, webhookAckSchema, WebhookRelayResult, WEBHOOK_RELAY_MAX_BODY_BYTES, WEBHOOK_RELAY_CHUNK_SIZE, executionEventSchema, logChunkSchema, peerDiscoverSchema, peerUpdateSchema, cacheStatsSchema, orchMetricsSchema, platformToOrchestratorMessageSchema, orchestratorToPlatformMessageSchema, type WebhookRelay, type WebhookRelayStart, type WebhookRelayChunk, type WebhookAck, type LogChunk, type PeerDiscover, type PeerUpdate, type CacheStats, type OrchMetrics, trustPolicyUpdateSchema, type TrustPolicyUpdate, staleCheckrunCleanupSchema, type StaleCheckrunCleanup, type PlatformToOrchestratorMessage, type OrchestratorToPlatformMessage, } from './protocol/messages/platform-orchestrator.js';
+export * from './protocol/messages/execution-status.js';
+export * from './protocol/messages/event-log.js';
+export * from './protocol/messages/access-log.js';
+export * from './audit/access-log-policy.js';
+export * from './audit/retention-policy.js';
+export * from './audit/activity.js';
+export * from './protocol/messages/log-pull.js';
+export * from './protocol/messages/dashboard.js';
+export * from './protocol/event-log-payload.js';
+export * from './protocol/messages/browser.js';
+export * from './protocol/messages/run-events.js';
+export { sourceRegistrationSchema, sourceRegistrationAckSchema, sourceDeregisterSchema, sourceDeregisterAckSchema, SourceSubtype, SourceProvider, type SourceRegistration, type SourceRegistrationAck, type SourceDeregister, type SourceDeregisterAck, } from './protocol/messages/source-registration.js';
+export * from './protocol/messages/join.js';
+export * from './protocol/messages/peer.js';
+export * from './protocol/messages/orchestrator-agent.js';
+export * from './protocol/messages/test-run.js';
+export * from './protocol/messages/observe.js';
+export * from './trigger/types.js';
+export * from './trigger/trigger-event-type.js';
+export * from './trigger/decision-trace.js';
+export * from './trigger/matcher.js';
+export * from './state-machine/index.js';
+export * from './provider/index.js';
+export type { WsLike } from './ws/ws-like.js';
+export * from './ws/close-codes.js';
+export { WsRateLimiter } from './ws/rate-limiter.js';
+export type { RateLimiterConfig, RateLimitResult } from './ws/rate-limiter.js';
+export * from './env/environment-allowlist.js';
+export * from './secrets/index.js';
+export * from './environment/index.js';
+export { deriveOsArchLabels, hostLabel, agentTypeLabel, scalerLabel, mergeAutoLabels, normalizeRunsOn, KNOWN_ROLES, resolveRoleLabels, validateNoReservedLabels, } from './labels.js';
+export type { NormalizedRunsOn } from './labels.js';
+export type { AgentRole } from './labels.js';
+export * from './scaler/scaler-backend-type.js';
+export * from './scaler/resource-types.js';
+export * from './registration/registerable-trigger-type.js';
+export * from './bundler/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,45 @@
+import "./chunk-gOLHoazu.js";
+import { MIN_PROTOCOL_VERSION, PROTOCOL_VERSION } from "./protocol/version.js";
+import { WS_MAX_PAYLOAD_BYTES, ackSchema, errorSchema, heartbeatSchema, nackSchema } from "./protocol/messages/common.js";
+import { ActorType, actorPrincipalSchema, apiKeyActorSchema, flattenActor, parseActor, platformOperatorActorSchema, serviceAccountActorSchema, stringifyActor, systemActorSchema, userActorSchema } from "./protocol/messages/actor.js";
+import { ORCH_CAPABILITIES, OrchRole, hasOrchCapability, orchCapabilitiesSchema } from "./protocol/messages/capabilities.js";
+import { authFailureSchema, authRequestSchema, authSuccessSchema } from "./protocol/messages/auth.js";
+import { ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, executionStatusSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema } from "./protocol/messages/execution-status.js";
+import { SourceProvider, SourceSubtype, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema } from "./protocol/messages/source-registration.js";
+import { AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, accessLogFilterSchema, accessLogItemSchema, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema } from "./protocol/messages/access-log.js";
+import { browserJobContextSchema, browserRunEventSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, jobContextMessageSchema, runEventMessageSchema } from "./protocol/messages/run-events.js";
+import { EventLogSource, EventLogStatus, PayloadOmittedReason } from "./protocol/messages/event-log.js";
+import { EventLogPayloadStreamError, HeldRunQueueType, HeldRunStatus, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runRerunRequestSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
+import { WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, cacheStatsSchema, executionEventSchema, logChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema } from "./protocol/messages/platform-orchestrator.js";
+import { AccessLogPolicyKind, POLICY_BY_ACTION, fnv1a32, shouldRecordAccess, shouldRecordSecretResolve } from "./audit/access-log-policy.js";
+import { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, accessLogWarmSqlCase, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase } from "./audit/retention-policy.js";
+import { ActivityFilterSource, ActivityRowSource, activityCursorSchema, activityFilterSchema, activityRowSchema, decodeActivityCursor, encodeActivityCursor, resolveRunIdSugar } from "./audit/activity.js";
+import { logPullOrchToPlatformSchema, logPullPlatformToOrchSchema } from "./protocol/messages/log-pull.js";
+import { EVENT_LOG_PAYLOAD_CHUNK_BYTES } from "./protocol/event-log-payload.js";
+import { browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, platformToBrowserMessageSchema } from "./protocol/messages/browser.js";
+import { joinRequestSchema, joinResponseSchema } from "./protocol/messages/join.js";
+import { jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema } from "./protocol/messages/peer.js";
+import { agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, gitAuthSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobStatusSchema, orchestratorToAgentMessageSchema, registerAckSchema } from "./protocol/messages/orchestrator-agent.js";
+import { testCancelResponseSchema, testCancelSchema, testEventSchema, testTriggerResponseSchema, testTriggerSchema } from "./protocol/messages/test-run.js";
+import { observeCompleteSchema, observeLogSchema, observeStatusSchema, observeStepSchema, observeSubscribeSchema } from "./protocol/messages/observe.js";
+import { NeedsEntrySchema, NeedsGroupEntrySchema, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob } from "./trigger/types.js";
+import { TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES } from "./trigger/trigger-event-type.js";
+import { createTraceEntry, createWorkflowDecision } from "./trigger/decision-trace.js";
+import { matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchWorkflowTriggers } from "./trigger/matcher.js";
+import { isTerminal, transition } from "./state-machine/machine.js";
+import "./state-machine/index.js";
+import { CheckRunConclusion } from "./provider/check-run-conclusion.js";
+import "./provider/index.js";
+import { WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED } from "./ws/close-codes.js";
+import { WsRateLimiter } from "./ws/rate-limiter.js";
+import { AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, KICI_AGENT_ENV_PREFIX, SANDBOX_DEFAULT_VARS } from "./env/environment-allowlist.js";
+import "./secrets/index.js";
+import { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix } from "./environment/scope-resolver.js";
+import "./environment/index.js";
+import { KNOWN_ROLES, agentTypeLabel, deriveOsArchLabels, hostLabel, mergeAutoLabels, normalizeRunsOn, resolveRoleLabels, scalerLabel, validateNoReservedLabels } from "./labels.js";
+import { ScalerBackendType } from "./scaler/scaler-backend-type.js";
+import { parseMemoryString, resourceRequestNestedSchema, resourceSpecSchema, validateResourceRequest } from "./scaler/resource-types.js";
+import { RegisterableTriggerType } from "./registration/registerable-trigger-type.js";
+import { createWorkflowBundleConfig } from "./bundler/rolldown-config.js";
+import "./bundler/index.js";
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, CheckRunConclusion, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, HeldRunQueueType, HeldRunStatus, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, ORCH_CAPABILITIES, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, ScalerBackendType, SourceProvider, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, flattenActor, fnv1a32, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostLabel, identityLinkItemSchema, identityLinkListResponseSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isTerminal, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, observeCompleteSchema, observeLogSchema, observeStatusSchema, observeStepSchema, observeSubscribeSchema, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseMemoryString, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runRerunRequestSchema, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testCancelResponseSchema, testCancelSchema, testEventSchema, testTriggerResponseSchema, testTriggerSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };

package/dist/labels.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Structured auto-labels with category prefixes.
+ *
+ * Auto-labels are injected into agent label sets so that workflows can target
+ * specific platforms, architectures, scaler types, hosts, etc. without
+ * requiring manual label configuration.
+ *
+ * All auto-labels use the `kici:` namespace prefix to distinguish them from
+ * user-defined labels. Users cannot set labels with this prefix.
+ *
+ * Categories:
+ *   kici:os:      — operating system (kici:os:linux, kici:os:macos, kici:os:windows)
+ *   kici:arch:    — CPU architecture (kici:arch:x64, kici:arch:amd64, kici:arch:arm64)
+ *   kici:agent:   — scaler/execution backend type (kici:agent:container, kici:agent:bare-metal, kici:agent:firecracker)
+ *   kici:scaler:  — scaler backend name (kici:scaler:stg-container, kici:scaler:prod-firecracker)
+ *   kici:host:    — hostname of the machine running the agent (kici:host:<hostname>)
+ *   kici:role:    — agent role (kici:role:builder, kici:role:init-runner)
+ *
+ * Platform mapping (os.platform() → kici:os: labels):
+ *   'linux'  → ['kici:os:linux']
+ *   'darwin' → ['kici:os:macos', 'kici:os:darwin']
+ *   'win32'  → ['kici:os:windows', 'kici:os:win32']
+ *
+ * Architecture mapping (os.arch() → kici:arch: labels):
+ *   'x64'   → ['kici:arch:x64', 'kici:arch:amd64']
+ *   'arm64' → ['kici:arch:arm64']
+ *   other   → ['kici:arch:{value}']
+ */
+/**
+ * Derive kici:os: and kici:arch: labels from platform and architecture strings.
+ */
+export declare function deriveOsArchLabels(platform: string, arch: string): string[];
+/**
+ * Build a kici:host: label from a hostname.
+ */
+export declare function hostLabel(hostname: string): string;
+/**
+ * Build a kici:agent: label from the scaler backend type.
+ */
+export declare function agentTypeLabel(backendType: string): string;
+/**
+ * Build a kici:scaler: label from the scaler backend name.
+ */
+export declare function scalerLabel(backendName: string): string;
+/**
+ * Merges explicit labels with auto-derived structured labels.
+ * Deduplicates the result.
+ */
+export declare function mergeAutoLabels(labels: string[], autoLabels: string[]): string[];
+/**
+ * Normalized runsOn result with labels and exclude arrays.
+ */
+export interface NormalizedRunsOn {
+    labels: string[];
+    exclude: string[];
+}
+/**
+ * Normalize the polymorphic runsOn value into a consistent object form.
+ * Accepts string, string[], or { labels, exclude? } object.
+ */
+export declare function normalizeRunsOn(runsOn: string | string[] | {
+    labels: string | string[];
+    exclude?: string | string[];
+}): NormalizedRunsOn;
+/**
+ * Known agent roles that grant capabilities beyond basic execution.
+ * - builder: can run __build__ jobs (dependency cache compilation)
+ * - init-runner: can run __init__ jobs (workspace initialization)
+ */
+export declare const KNOWN_ROLES: readonly ["builder", "init-runner"];
+/** Agent role type derived from KNOWN_ROLES. */
+export type AgentRole = (typeof KNOWN_ROLES)[number];
+/** Reserved label prefix — labels starting with this are system-managed. */
+export declare const RESERVED_LABEL_PREFIX = "kici:";
+/** Role label prefix — used to generate role-specific labels. */
+export declare const ROLE_LABEL_PREFIX = "kici:role:";
+/**
+ * Convert a role name to its corresponding label.
+ */
+export declare function roleToLabel(role: AgentRole): string;
+/**
+ * Resolve a roles configuration into role labels.
+ *
+ * - undefined → all roles (backward compat: existing agents get all capabilities)
+ * - [] → no roles (execution-only agent)
+ * - ['all'] → all roles (explicit opt-in to all)
+ * - ['builder'] → specific role labels only
+ */
+export declare function resolveRoleLabels(roles: readonly string[] | undefined): string[];
+/**
+ * Validate that no labels use the reserved kici: prefix.
+ * Throws if any reserved labels are found (case-insensitive check).
+ */
+export declare function validateNoReservedLabels(labels: string[], source: string): void;
+/**
+ * Check if a label is an auto-generated system label (has the kici: prefix).
+ */
+export declare function isAutoLabel(label: string): boolean;
+/**
+ * Separate labels into user-defined and auto-generated (kici: prefixed) groups.
+ */
+export declare function separateLabels(labels: string[]): {
+    userLabels: string[];
+    autoLabels: string[];
+};
+//# sourceMappingURL=labels.d.ts.map