@kici-dev/engine 0.1.14 → 0.1.16

package/README.md

@@ -1 +1,13 @@
-TBD
+# @kici-dev/engine
+
+Shared business logic for the KiCI CI/CD stack: protocol message schemas, trigger matching, the execution state machine, and provider interfaces used across the KiCI tiers.
+
+This is an internal support library — other `@kici-dev` packages depend on it; it is not meant to be installed directly.
+
+Part of [KiCI](https://kici.dev) — CI/CD workflows as TypeScript code: author them with full language power, dry-run them locally, and run them on your own infrastructure.
+
+## Links
+
+- Documentation: <https://docs.kici.dev/architecture/overview/>
+- Source: <https://github.com/kici-dev/kici-public/tree/main/packages/engine>
+- License: AGPL-3.0-only

package/dist/approval/types.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Shared approval requirement + clause types.
+ *
+ * One normalized `ApprovalRequirement` is produced by both approval triggers —
+ * a mandatory environment policy and an explicit SDK `requireApproval` — and is
+ * consumed identically by the orchestrator gate, the resolver, the held-run
+ * store, and the agent step round-trip. Pure Zod (no node built-ins), so this
+ * module is safe in the browser-facing engine barrel.
+ */
+import { z } from 'zod';
+/**
+ * A single approver clause. `{ team }` is satisfied by any member of the named
+ * team; `{ user }` by that specific user. A flat AND list of clauses must all
+ * be satisfied to release a held element.
+ */
+export declare const approverClauseSchema: z.ZodUnion<readonly [z.ZodObject<{
+    team: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    user: z.ZodString;
+}, z.core.$strict>]>;
+export type ApproverClause = z.infer<typeof approverClauseSchema>;
+/** Granularity of a held element. */
+export declare const HoldScope: z.ZodEnum<{
+    job: "job";
+    step: "step";
+    workflow: "workflow";
+}>;
+export type HoldScope = z.infer<typeof HoldScope>;
+/** What triggered the hold: an environment policy (mandatory) or SDK code (explicit). */
+export declare const TriggerSource: z.ZodEnum<{
+    environment: "environment";
+    explicit: "explicit";
+}>;
+export type TriggerSource = z.infer<typeof TriggerSource>;
+/**
+ * The normalized requirement attached to a held element. `clauses` is a flat
+ * AND list; an empty list means "any approval-capable org member". `expiresAt`
+ * is an ISO timestamp; on expiry the element is rejected.
+ */
+export declare const approvalRequirementSchema: z.ZodObject<{
+    clauses: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        team: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        user: z.ZodString;
+    }, z.core.$strict>]>>;
+    expiresAt: z.ZodString;
+    reason: z.ZodString;
+}, z.core.$strip>;
+export type ApprovalRequirement = z.infer<typeof approvalRequirementSchema>;
+/** An individual approve/reject decision recorded against a held element. */
+export declare const ApprovalDecision: z.ZodEnum<{
+    approve: "approve";
+    reject: "reject";
+}>;
+export type ApprovalDecision = z.infer<typeof ApprovalDecision>;
+//# sourceMappingURL=types.d.ts.map

package/dist/approval/types.js

@@ -0,0 +1,42 @@
+import "../chunk-gOLHoazu.js";
+import { z } from "zod";
+//#region src/approval/types.ts
+/**
+* Shared approval requirement + clause types.
+*
+* One normalized `ApprovalRequirement` is produced by both approval triggers —
+* a mandatory environment policy and an explicit SDK `requireApproval` — and is
+* consumed identically by the orchestrator gate, the resolver, the held-run
+* store, and the agent step round-trip. Pure Zod (no node built-ins), so this
+* module is safe in the browser-facing engine barrel.
+*/
+/**
+* A single approver clause. `{ team }` is satisfied by any member of the named
+* team; `{ user }` by that specific user. A flat AND list of clauses must all
+* be satisfied to release a held element.
+*/
+const approverClauseSchema = z.union([z.object({ team: z.string().min(1) }).strict(), z.object({ user: z.string().min(1) }).strict()]);
+/** Granularity of a held element. */
+const HoldScope = z.enum([
+	"workflow",
+	"job",
+	"step"
+]);
+/** What triggered the hold: an environment policy (mandatory) or SDK code (explicit). */
+const TriggerSource = z.enum(["environment", "explicit"]);
+/**
+* The normalized requirement attached to a held element. `clauses` is a flat
+* AND list; an empty list means "any approval-capable org member". `expiresAt`
+* is an ISO timestamp; on expiry the element is rejected.
+*/
+const approvalRequirementSchema = z.object({
+	clauses: z.array(approverClauseSchema),
+	expiresAt: z.string(),
+	reason: z.string()
+});
+/** An individual approve/reject decision recorded against a held element. */
+const ApprovalDecision = z.enum(["approve", "reject"]);
+//#endregion
+export { ApprovalDecision, HoldScope, TriggerSource, approvalRequirementSchema, approverClauseSchema };
+
+//# sourceMappingURL=types.js.map

package/dist/audit/access-log-policy.js

@@ -38,6 +38,18 @@ const POLICY_BY_ACTION = {
 		kind: "sample",
 		allowedRate: .05
 	},
+	"runs.list.read": {
+		kind: "sample",
+		allowedRate: .05
+	},
+	"runs.filters.read": {
+		kind: "sample",
+		allowedRate: .05
+	},
+	"sources.list.read": {
+		kind: "sample",
+		allowedRate: .1
+	},
 	"run.orch_logs.read": {
 		kind: "sample",
 		allowedRate: .1
@@ -124,6 +136,8 @@ const POLICY_BY_ACTION = {
 	"secret_scope.delete": { kind: "always" },
 	"held_run.approve": { kind: "always" },
 	"held_run.reject": { kind: "always" },
+	"held_run.request": { kind: "always" },
+	"held_run.expire": { kind: "always" },
 	"registration.disable": { kind: "always" },
 	"registration.delete": { kind: "always" },
 	"backend.sync": { kind: "always" },

package/dist/audit/retention-policy.js

@@ -13,6 +13,9 @@ import "../chunk-gOLHoazu.js";
 */
 const ACCESS_LOG_WARM_DAYS = {
 	"run.detail.read": 30,
+	"runs.list.read": 30,
+	"runs.filters.read": 30,
+	"sources.list.read": 30,
 	"run.orch_logs.read": 30,
 	"step.logs.read": 30,
 	"event_log.list.read": 30,
@@ -49,6 +52,8 @@ const ACCESS_LOG_WARM_DAYS = {
 	"env_binding.set": 180,
 	"held_run.approve": 180,
 	"held_run.reject": 180,
+	"held_run.request": 180,
+	"held_run.expire": 180,
 	"registration.disable": 180,
 	"registration.delete": 180,
 	"backend.sync": 180,
@@ -244,6 +249,9 @@ function secretAuditLogWarmSqlCase() {
 */
 const ACCESS_LOG_COLD_DAYS = {
 	"run.detail.read": 180,
+	"runs.list.read": 180,
+	"runs.filters.read": 180,
+	"sources.list.read": 180,
 	"run.orch_logs.read": 180,
 	"step.logs.read": 180,
 	"event_log.list.read": 180,
@@ -280,6 +288,8 @@ const ACCESS_LOG_COLD_DAYS = {
 	"env_binding.set": 730,
 	"held_run.approve": 730,
 	"held_run.reject": 730,
+	"held_run.request": 730,
+	"held_run.expire": 730,
 	"registration.disable": 730,
 	"registration.delete": 730,
 	"backend.sync": 730,

package/dist/environment/types.d.ts

@@ -4,6 +4,7 @@
  * Environments are org-level entities that group secrets, variables,
  * and protection rules for deployment targets (dev, staging, production).
  */
+import type { ApproverClause } from '../approval/types.js';
 /** Environment entity — org-level deployment target with protection rules. */
 export interface Environment {
     id: string;
@@ -94,5 +95,12 @@ export interface ProtectionGateResult {
     reason?: string;
     holdUntil?: string;
     holdType?: 'reviewer' | 'timer' | 'concurrency' | 'security';
+    /**
+     * Approver clauses for a reviewer hold, mapped from the environment's
+     * `requiredReviewers`. Each reviewer string maps to a `{ user }` clause
+     * (team-named reviewers are a documented follow-up). Empty/undefined means
+     * "any approval-capable member".
+     */
+    clauses?: ApproverClause[];
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/index.d.ts

@@ -18,6 +18,7 @@ export * from './protocol/messages/execution-status.js';
 export * from './protocol/messages/scaler-event.js';
 export * from './protocol/messages/event-log.js';
 export * from './protocol/messages/access-log.js';
+export * from './approval/types.js';
 export * from './audit/access-log-policy.js';
 export * from './audit/retention-policy.js';
 export * from './audit/activity.js';
@@ -45,7 +46,7 @@ export type { RateLimiterConfig, RateLimitResult } from './ws/rate-limiter.js';
 export * from './env/environment-allowlist.js';
 export * from './secrets/index.js';
 export * from './environment/index.js';
-export { deriveOsArchLabels, hostLabel, agentTypeLabel, scalerLabel, mergeAutoLabels, normalizeRunsOn, KNOWN_ROLES, resolveRoleLabels, validateNoReservedLabels, scalerAgentLabels, isSelfReportedLabel, SELF_REPORTED_LABEL_PREFIXES, } from './labels.js';
+export { deriveOsArchLabels, hostLabel, parseHostLabel, HOST_LABEL_PREFIX, agentTypeLabel, scalerLabel, mergeAutoLabels, normalizeRunsOn, KNOWN_ROLES, resolveRoleLabels, validateNoReservedLabels, scalerAgentLabels, isSelfReportedLabel, SELF_REPORTED_LABEL_PREFIXES, } from './labels.js';
 export type { NormalizedRunsOn } from './labels.js';
 export type { AgentRole } from './labels.js';
 export * from './scaler/scaler-backend-type.js';

package/dist/index.js

@@ -4,12 +4,14 @@ import { WS_MAX_PAYLOAD_BYTES, ackSchema, errorSchema, heartbeatSchema, nackSche
 import { ActorType, actorPrincipalSchema, apiKeyActorSchema, flattenActor, parseActor, platformOperatorActorSchema, serviceAccountActorSchema, stringifyActor, systemActorSchema, userActorSchema } from "./protocol/messages/actor.js";
 import { ORCH_CAPABILITIES, OrchRole, hasOrchCapability, orchCapabilitiesSchema } from "./protocol/messages/capabilities.js";
 import { authFailureSchema, authRequestSchema, authSuccessSchema } from "./protocol/messages/auth.js";
-import { ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema } from "./protocol/messages/execution-status.js";
+import { CacheOutcome, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema } from "./protocol/messages/execution-status.js";
 import { SourceProvider, SourceSubtype, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema } from "./protocol/messages/source-registration.js";
 import { AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, accessLogFilterSchema, accessLogItemSchema, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema } from "./protocol/messages/access-log.js";
 import { browserJobContextSchema, browserRunEventSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, jobContextMessageSchema, runEventMessageSchema } from "./protocol/messages/run-events.js";
 import { EventLogSource, EventLogStatus, PayloadOmittedReason } from "./protocol/messages/event-log.js";
-import { EventLogPayloadStreamError, HeldRunQueueType, HeldRunStatus, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runRerunRequestSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
+import { ScalerBackendType } from "./scaler/scaler-backend-type.js";
+import { ApprovalDecision, HoldScope, TriggerSource, approvalRequirementSchema, approverClauseSchema } from "./approval/types.js";
+import { EnvDeleteErrorCode, EventLogPayloadStreamError, HeldRunQueueType, HeldRunStatus, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runRerunRequestSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
 import { WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, cacheStatsSchema, executionEventSchema, logChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema } from "./protocol/messages/platform-orchestrator.js";
 import { ScalerEventType } from "./protocol/messages/scaler-event.js";
 import { AccessLogPolicyKind, POLICY_BY_ACTION, fnv1a32, shouldRecordAccess, shouldRecordSecretResolve } from "./audit/access-log-policy.js";
@@ -19,8 +21,8 @@ import { logPullOrchToPlatformSchema, logPullPlatformToOrchSchema } from "./prot
 import { EVENT_LOG_PAYLOAD_CHUNK_BYTES } from "./protocol/event-log-payload.js";
 import { browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, platformToBrowserMessageSchema } from "./protocol/messages/browser.js";
 import { joinRequestSchema, joinResponseSchema } from "./protocol/messages/join.js";
-import { jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema } from "./protocol/messages/peer.js";
-import { agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, gitAuthSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobStatusSchema, orchestratorToAgentMessageSchema, registerAckSchema } from "./protocol/messages/orchestrator-agent.js";
+import { fleetSelectionSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema } from "./protocol/messages/peer.js";
+import { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, registerAckSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema } from "./protocol/messages/orchestrator-agent.js";
 import { testCancelResponseSchema, testCancelSchema, testEventSchema, testTriggerResponseSchema, testTriggerSchema } from "./protocol/messages/test-run.js";
 import { observeCompleteSchema, observeLogSchema, observeStatusSchema, observeStepSchema, observeSubscribeSchema } from "./protocol/messages/observe.js";
 import { NeedsEntrySchema, NeedsGroupEntrySchema, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob } from "./trigger/types.js";
@@ -29,18 +31,18 @@ import { createTraceEntry, createWorkflowDecision } from "./trigger/decision-tra
 import { matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchWorkflowTriggers } from "./trigger/matcher.js";
 import { isTerminal, transition } from "./state-machine/machine.js";
 import "./state-machine/index.js";
+import { LockFileParseError } from "./provider/lock-file-parse-error.js";
 import { CheckRunConclusion } from "./provider/check-run-conclusion.js";
 import "./provider/index.js";
-import { WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED } from "./ws/close-codes.js";
+import { WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED } from "./ws/close-codes.js";
 import { WsRateLimiter } from "./ws/rate-limiter.js";
 import { AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, KICI_AGENT_ENV_PREFIX, SANDBOX_DEFAULT_VARS } from "./env/environment-allowlist.js";
 import "./secrets/index.js";
 import { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix } from "./environment/scope-resolver.js";
 import "./environment/index.js";
-import { KNOWN_ROLES, SELF_REPORTED_LABEL_PREFIXES, agentTypeLabel, deriveOsArchLabels, hostLabel, isSelfReportedLabel, mergeAutoLabels, normalizeRunsOn, resolveRoleLabels, scalerAgentLabels, scalerLabel, validateNoReservedLabels } from "./labels.js";
-import { ScalerBackendType } from "./scaler/scaler-backend-type.js";
+import { HOST_LABEL_PREFIX, KNOWN_ROLES, SELF_REPORTED_LABEL_PREFIXES, agentTypeLabel, deriveOsArchLabels, hostLabel, isSelfReportedLabel, mergeAutoLabels, normalizeRunsOn, parseHostLabel, resolveRoleLabels, scalerAgentLabels, scalerLabel, validateNoReservedLabels } from "./labels.js";
 import { parseMemoryString, resourceRequestNestedSchema, resourceSpecSchema, validateResourceRequest } from "./scaler/resource-types.js";
 import { RegisterableTriggerType } from "./registration/registerable-trigger-type.js";
 import { createWorkflowBundleConfig } from "./bundler/rolldown-config.js";
 import "./bundler/index.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, CheckRunConclusion, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, HeldRunQueueType, HeldRunStatus, InitFailureCategory, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, ORCH_CAPABILITIES, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, flattenActor, fnv1a32, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostLabel, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, observeCompleteSchema, observeLogSchema, observeStatusSchema, observeStepSchema, observeSubscribeSchema, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseMemoryString, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testCancelResponseSchema, testCancelSchema, testEventSchema, testTriggerResponseSchema, testTriggerSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, ApprovalDecision, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckRunConclusion, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, InitFailureCategory, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LockFileParseError, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, ORCH_CAPABILITIES, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, StepApprovalOutcome, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TimeoutReason, TriggerSource, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, approvalRequirementSchema, approverClauseSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, fleetSelectionSchema, fnv1a32, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostLabel, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, observeCompleteSchema, observeLogSchema, observeStatusSchema, observeStepSchema, observeSubscribeSchema, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseMemoryString, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testCancelResponseSchema, testCancelSchema, testEventSchema, testTriggerResponseSchema, testTriggerSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };

package/dist/labels.d.ts

@@ -30,10 +30,17 @@
  * Derive kici:os: and kici:arch: labels from platform and architecture strings.
  */
 export declare function deriveOsArchLabels(platform: string, arch: string): string[];
+/** Prefix for the agent self-reported hostname label. */
+export declare const HOST_LABEL_PREFIX = "kici:host:";
 /**
  * Build a kici:host: label from a hostname.
  */
 export declare function hostLabel(hostname: string): string;
+/**
+ * Extract the hostname from a kici:host: label, or null if the label is not a
+ * host label. Inverse of {@link hostLabel}.
+ */
+export declare function parseHostLabel(label: string): string | null;
 /**
  * Build a kici:agent: label from the scaler backend type.
  */

package/dist/labels.js

@@ -56,11 +56,20 @@ function deriveOsArchLabels(platform, arch) {
 	}
 	return labels;
 }
+/** Prefix for the agent self-reported hostname label. */
+const HOST_LABEL_PREFIX = "kici:host:";
 /**
 * Build a kici:host: label from a hostname.
 */
 function hostLabel(hostname) {
-	return `kici:host:${hostname}`;
+	return `${HOST_LABEL_PREFIX}${hostname}`;
+}
+/**
+* Extract the hostname from a kici:host: label, or null if the label is not a
+* host label. Inverse of {@link hostLabel}.
+*/
+function parseHostLabel(label) {
+	return label.startsWith("kici:host:") ? label.slice(10) : null;
 }
 /**
 * Build a kici:agent: label from the scaler backend type.
@@ -194,6 +203,6 @@ function separateLabels(labels) {
 	};
 }
 //#endregion
-export { KNOWN_ROLES, RESERVED_LABEL_PREFIX, ROLE_LABEL_PREFIX, SELF_REPORTED_LABEL_PREFIXES, agentTypeLabel, deriveOsArchLabels, hostLabel, isAutoLabel, isSelfReportedLabel, mergeAutoLabels, normalizeRunsOn, resolveRoleLabels, roleToLabel, scalerAgentLabels, scalerLabel, separateLabels, validateNoReservedLabels };
+export { HOST_LABEL_PREFIX, KNOWN_ROLES, RESERVED_LABEL_PREFIX, ROLE_LABEL_PREFIX, SELF_REPORTED_LABEL_PREFIXES, agentTypeLabel, deriveOsArchLabels, hostLabel, isAutoLabel, isSelfReportedLabel, mergeAutoLabels, normalizeRunsOn, parseHostLabel, resolveRoleLabels, roleToLabel, scalerAgentLabels, scalerLabel, separateLabels, validateNoReservedLabels };
 
 //# sourceMappingURL=labels.js.map

package/dist/metrics/metric-catalog.generated.d.ts

@@ -44,6 +44,7 @@ export declare const MetricNames: {
     readonly KICI_ORCH_JOB_RUNS_TOTAL: "kici_orch_job_runs_total";
     readonly KICI_ORCH_LOG_BYTES_STORED_TOTAL: "kici_orch_log_bytes_stored_total";
     readonly KICI_ORCH_LOG_CHUNKS_RECEIVED_TOTAL: "kici_orch_log_chunks_received_total";
+    readonly KICI_ORCH_PG_POOL_CLIENT_ERRORS_TOTAL: "kici_orch_pg_pool_client_errors_total";
     readonly KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "kici_orch_scaler_config_reloads_total";
     readonly KICI_ORCH_SCALER_CPUS_USED: "kici_orch_scaler_cpus_used";
     readonly KICI_ORCH_SCALER_MEMORY_BYTES_USED: "kici_orch_scaler_memory_bytes_used";
@@ -86,16 +87,25 @@ export declare const MetricNames: {
     readonly KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: "kici_platform_mimir_relay_errors_total";
     readonly KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: "kici_platform_orch_metrics_filtered_total";
     readonly KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: "kici_platform_orphan_connections_swept_total";
+    readonly KICI_PLATFORM_PG_POOL_CLIENT_ERRORS_TOTAL: "kici_platform_pg_pool_client_errors_total";
     readonly KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: "kici_platform_stale_orchestrators_total";
     readonly KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: "kici_platform_stale_platform_connections_evicted_total";
     readonly KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: "kici_platform_stale_runs_failed_total";
     readonly KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "kici_platform_step_status_forwards_total";
+    readonly KICI_REGISTRATIONS_TOTAL: "kici_registrations_total";
     readonly KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "kici_universal_git_registration_errors_total";
     readonly KICI_VALKEY_CONNECTION_STATUS: "kici_valkey_connection_status";
     readonly KICI_VALKEY_PUBLISH_TOTAL: "kici_valkey_publish_total";
     readonly KICI_VALKEY_RELAY_LATENCY_SECONDS: "kici_valkey_relay_latency_seconds";
     readonly KICI_VALKEY_SUBSCRIBE_RECEIVE_TOTAL: "kici_valkey_subscribe_receive_total";
+    readonly KICI_WEBHOOK_BUFFER_BYTES: "kici_webhook_buffer_bytes";
+    readonly KICI_WEBHOOK_BUFFER_DEPTH: "kici_webhook_buffer_depth";
+    readonly KICI_WEBHOOK_BUFFER_OLDEST_AGE_SECONDS: "kici_webhook_buffer_oldest_age_seconds";
+    readonly KICI_WEBHOOK_PG_BREAKER_STATE: "kici_webhook_pg_breaker_state";
+    readonly KICI_WEBHOOK_PG_BREAKER_TRANSITIONS_TOTAL: "kici_webhook_pg_breaker_transitions_total";
+    readonly KICI_WEBHOOK_PG_DEGRADED_TOTAL: "kici_webhook_pg_degraded_total";
     readonly KICI_WEBHOOK_PROCESSING_SECONDS: "kici_webhook_processing_seconds";
+    readonly KICI_WEBHOOK_REPLAY_DURATION_SECONDS: "kici_webhook_replay_duration_seconds";
     readonly KICI_WEBHOOK_SIGNATURE_FAILURES_TOTAL: "kici_webhook_signature_failures_total";
     readonly KICI_WEBHOOKS_RECEIVED_TOTAL: "kici_webhooks_received_total";
     readonly KICI_WS_CONNECTIONS_ACTIVE: "kici_ws_connections_active";
@@ -167,6 +177,7 @@ export declare const MetricLabels: {
     readonly KICI_ORCH_JOB_RUNS_TOTAL: readonly ["job", "result"];
     readonly KICI_ORCH_LOG_BYTES_STORED_TOTAL: readonly [];
     readonly KICI_ORCH_LOG_CHUNKS_RECEIVED_TOTAL: readonly [];
+    readonly KICI_ORCH_PG_POOL_CLIENT_ERRORS_TOTAL: readonly ["source"];
     readonly KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: readonly ["result"];
     readonly KICI_ORCH_SCALER_CPUS_USED: readonly ["scaler", "machinePool"];
     readonly KICI_ORCH_SCALER_MEMORY_BYTES_USED: readonly ["scaler", "machinePool"];
@@ -209,16 +220,25 @@ export declare const MetricLabels: {
     readonly KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: readonly ["reason"];
     readonly KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: readonly ["reason", "metric"];
     readonly KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: readonly [];
+    readonly KICI_PLATFORM_PG_POOL_CLIENT_ERRORS_TOTAL: readonly ["source"];
     readonly KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: readonly [];
     readonly KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: readonly ["org_id"];
     readonly KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: readonly [];
     readonly KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: readonly ["state"];
+    readonly KICI_REGISTRATIONS_TOTAL: readonly [];
     readonly KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: readonly ["reason"];
     readonly KICI_VALKEY_CONNECTION_STATUS: readonly ["role"];
     readonly KICI_VALKEY_PUBLISH_TOTAL: readonly ["channel"];
     readonly KICI_VALKEY_RELAY_LATENCY_SECONDS: readonly ["status"];
     readonly KICI_VALKEY_SUBSCRIBE_RECEIVE_TOTAL: readonly ["channel"];
+    readonly KICI_WEBHOOK_BUFFER_BYTES: readonly [];
+    readonly KICI_WEBHOOK_BUFFER_DEPTH: readonly [];
+    readonly KICI_WEBHOOK_BUFFER_OLDEST_AGE_SECONDS: readonly [];
+    readonly KICI_WEBHOOK_PG_BREAKER_STATE: readonly [];
+    readonly KICI_WEBHOOK_PG_BREAKER_TRANSITIONS_TOTAL: readonly [];
+    readonly KICI_WEBHOOK_PG_DEGRADED_TOTAL: readonly ["outcome", "org_id"];
     readonly KICI_WEBHOOK_PROCESSING_SECONDS: readonly ["event"];
+    readonly KICI_WEBHOOK_REPLAY_DURATION_SECONDS: readonly [];
     readonly KICI_WEBHOOK_SIGNATURE_FAILURES_TOTAL: readonly ["source", "org_id"];
     readonly KICI_WEBHOOKS_RECEIVED_TOTAL: readonly ["event", "status", "org_id"];
     readonly KICI_WS_CONNECTIONS_ACTIVE: readonly ["routing_key"];
@@ -289,6 +309,7 @@ export declare const MetricKind: {
     readonly KICI_ORCH_JOB_RUNS_TOTAL: "counter";
     readonly KICI_ORCH_LOG_BYTES_STORED_TOTAL: "counter";
     readonly KICI_ORCH_LOG_CHUNKS_RECEIVED_TOTAL: "counter";
+    readonly KICI_ORCH_PG_POOL_CLIENT_ERRORS_TOTAL: "counter";
     readonly KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "counter";
     readonly KICI_ORCH_SCALER_CPUS_USED: "observableGauge";
     readonly KICI_ORCH_SCALER_MEMORY_BYTES_USED: "observableGauge";
@@ -331,16 +352,25 @@ export declare const MetricKind: {
     readonly KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: "counter";
     readonly KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: "counter";
     readonly KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: "counter";
+    readonly KICI_PLATFORM_PG_POOL_CLIENT_ERRORS_TOTAL: "counter";
     readonly KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: "counter";
     readonly KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: "counter";
     readonly KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: "counter";
     readonly KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "counter";
+    readonly KICI_REGISTRATIONS_TOTAL: "counter";
     readonly KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "counter";
     readonly KICI_VALKEY_CONNECTION_STATUS: "observableGauge";
     readonly KICI_VALKEY_PUBLISH_TOTAL: "counter";
     readonly KICI_VALKEY_RELAY_LATENCY_SECONDS: "histogram";
     readonly KICI_VALKEY_SUBSCRIBE_RECEIVE_TOTAL: "counter";
+    readonly KICI_WEBHOOK_BUFFER_BYTES: "observableGauge";
+    readonly KICI_WEBHOOK_BUFFER_DEPTH: "observableGauge";
+    readonly KICI_WEBHOOK_BUFFER_OLDEST_AGE_SECONDS: "observableGauge";
+    readonly KICI_WEBHOOK_PG_BREAKER_STATE: "observableGauge";
+    readonly KICI_WEBHOOK_PG_BREAKER_TRANSITIONS_TOTAL: "counter";
+    readonly KICI_WEBHOOK_PG_DEGRADED_TOTAL: "counter";
     readonly KICI_WEBHOOK_PROCESSING_SECONDS: "histogram";
+    readonly KICI_WEBHOOK_REPLAY_DURATION_SECONDS: "histogram";
     readonly KICI_WEBHOOK_SIGNATURE_FAILURES_TOTAL: "counter";
     readonly KICI_WEBHOOKS_RECEIVED_TOTAL: "counter";
     readonly KICI_WS_CONNECTIONS_ACTIVE: "upDownCounter";
@@ -411,6 +441,7 @@ export declare const MetricDescription: {
     readonly KICI_ORCH_JOB_RUNS_TOTAL: "Scheduled job run outcomes, by job and result (success/failure)";
     readonly KICI_ORCH_LOG_BYTES_STORED_TOTAL: "Total bytes of log data written to storage";
     readonly KICI_ORCH_LOG_CHUNKS_RECEIVED_TOTAL: "Total number of log chunks received from agents";
+    readonly KICI_ORCH_PG_POOL_CLIENT_ERRORS_TOTAL: "Total pg connection errors absorbed without a process restart";
     readonly KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "Total number of scaler config reload operations";
     readonly KICI_ORCH_SCALER_CPUS_USED: "Current CPU reservations summed by scaler / pool. scaler=\"__global__\" is the orchestrator-wide total; machinePool=\"<name>\" rows reflect the on-disk ledger.";
     readonly KICI_ORCH_SCALER_MEMORY_BYTES_USED: "Current memory reservations (bytes) summed by scaler / pool. scaler=\"__global__\" is the orchestrator-wide total; machinePool=\"<name>\" rows reflect the on-disk ledger.";
@@ -453,16 +484,25 @@ export declare const MetricDescription: {
     readonly KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: "Total Mimir push-relay errors (Platform-embedded metrics). Labels: reason.";
     readonly KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: "Orchestrator-pushed metric data points dropped or rewritten by the catalog allow-list. Labels: reason, metric.";
     readonly KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: "Total orphan connections swept from platform_connections";
+    readonly KICI_PLATFORM_PG_POOL_CLIENT_ERRORS_TOTAL: "Total pg connection errors absorbed without a process restart";
     readonly KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: "Total orchestrators detected as permanently disconnected";
     readonly KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: "platform_connections rows evicted by source.register DB dedup (same-instance reconnect path)";
     readonly KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: "Total execution runs failed due to orchestrator staleness";
     readonly KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "Total step status forwards received";
+    readonly KICI_REGISTRATIONS_TOTAL: "Total user registrations (new personal orgs created on first login)";
     readonly KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "Errors encountered while registering universal-git provider bundles";
     readonly KICI_VALKEY_CONNECTION_STATUS: "Valkey connection status per role (1=connected, 0=disconnected)";
     readonly KICI_VALKEY_PUBLISH_TOTAL: "Total messages published to Valkey channels";
     readonly KICI_VALKEY_RELAY_LATENCY_SECONDS: "Latency of cross-instance Valkey relay operations in seconds";
     readonly KICI_VALKEY_SUBSCRIBE_RECEIVE_TOTAL: "Total messages received from Valkey subscriptions";
+    readonly KICI_WEBHOOK_BUFFER_BYTES: "Total buffered webhook bytes (global Valkey counter)";
+    readonly KICI_WEBHOOK_BUFFER_DEPTH: "Buffered webhook count per org";
+    readonly KICI_WEBHOOK_BUFFER_OLDEST_AGE_SECONDS: "Age of the oldest buffered webhook per org, in seconds";
+    readonly KICI_WEBHOOK_PG_BREAKER_STATE: "PG circuit-breaker state on this instance (0=closed,1=degraded,2=open)";
+    readonly KICI_WEBHOOK_PG_BREAKER_TRANSITIONS_TOTAL: "PG circuit-breaker state transitions";
+    readonly KICI_WEBHOOK_PG_DEGRADED_TOTAL: "Webhooks handled in PG-degraded mode, by outcome";
     readonly KICI_WEBHOOK_PROCESSING_SECONDS: "Webhook processing duration in seconds";
+    readonly KICI_WEBHOOK_REPLAY_DURATION_SECONDS: "Buffered-webhook replay latency (enqueue → delivered) in seconds";
     readonly KICI_WEBHOOK_SIGNATURE_FAILURES_TOTAL: "Total number of webhooks rejected at orchestrator signature verification";
     readonly KICI_WEBHOOKS_RECEIVED_TOTAL: "Total number of webhooks received";
     readonly KICI_WS_CONNECTIONS_ACTIVE: "Current number of active WebSocket connections";
@@ -540,6 +580,7 @@ export declare const MetricService: {
     readonly KICI_ORCH_JOB_RUNS_TOTAL: "orchestrator";
     readonly KICI_ORCH_LOG_BYTES_STORED_TOTAL: "orchestrator";
     readonly KICI_ORCH_LOG_CHUNKS_RECEIVED_TOTAL: "orchestrator";
+    readonly KICI_ORCH_PG_POOL_CLIENT_ERRORS_TOTAL: "orchestrator";
     readonly KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "orchestrator";
     readonly KICI_ORCH_SCALER_CPUS_USED: "orchestrator";
     readonly KICI_ORCH_SCALER_MEMORY_BYTES_USED: "orchestrator";
@@ -582,16 +623,25 @@ export declare const MetricService: {
     readonly KICI_PLATFORM_MIMIR_RELAY_ERRORS_TOTAL: "platform";
     readonly KICI_PLATFORM_ORCH_METRICS_FILTERED_TOTAL: "platform";
     readonly KICI_PLATFORM_ORPHAN_CONNECTIONS_SWEPT_TOTAL: "platform";
+    readonly KICI_PLATFORM_PG_POOL_CLIENT_ERRORS_TOTAL: "platform";
     readonly KICI_PLATFORM_STALE_ORCHESTRATORS_TOTAL: "platform";
     readonly KICI_PLATFORM_STALE_PLATFORM_CONNECTIONS_EVICTED_TOTAL: "platform";
     readonly KICI_PLATFORM_STALE_RUNS_FAILED_TOTAL: "platform";
     readonly KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "platform";
+    readonly KICI_REGISTRATIONS_TOTAL: "platform";
     readonly KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "orchestrator";
     readonly KICI_VALKEY_CONNECTION_STATUS: "platform";
     readonly KICI_VALKEY_PUBLISH_TOTAL: "platform";
     readonly KICI_VALKEY_RELAY_LATENCY_SECONDS: "platform";
     readonly KICI_VALKEY_SUBSCRIBE_RECEIVE_TOTAL: "platform";
+    readonly KICI_WEBHOOK_BUFFER_BYTES: "platform";
+    readonly KICI_WEBHOOK_BUFFER_DEPTH: "platform";
+    readonly KICI_WEBHOOK_BUFFER_OLDEST_AGE_SECONDS: "platform";
+    readonly KICI_WEBHOOK_PG_BREAKER_STATE: "platform";
+    readonly KICI_WEBHOOK_PG_BREAKER_TRANSITIONS_TOTAL: "platform";
+    readonly KICI_WEBHOOK_PG_DEGRADED_TOTAL: "platform";
     readonly KICI_WEBHOOK_PROCESSING_SECONDS: "platform";
+    readonly KICI_WEBHOOK_REPLAY_DURATION_SECONDS: "platform";
     readonly KICI_WEBHOOK_SIGNATURE_FAILURES_TOTAL: "platform";
     readonly KICI_WEBHOOKS_RECEIVED_TOTAL: "platform";
     readonly KICI_WS_CONNECTIONS_ACTIVE: "platform";