@kici-dev/engine 0.1.15 → 0.1.17

package/dist/approval/types.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Shared approval requirement + clause types.
+ *
+ * One normalized `ApprovalRequirement` is produced by both approval triggers —
+ * a mandatory environment policy and an explicit SDK `requireApproval` — and is
+ * consumed identically by the orchestrator gate, the resolver, the held-run
+ * store, and the agent step round-trip. Pure Zod (no node built-ins), so this
+ * module is safe in the browser-facing engine barrel.
+ */
+import { z } from 'zod';
+/**
+ * A single approver clause. `{ team }` is satisfied by any member of the named
+ * team; `{ user }` by that specific user. A flat AND list of clauses must all
+ * be satisfied to release a held element.
+ */
+export declare const approverClauseSchema: z.ZodUnion<readonly [z.ZodObject<{
+    team: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    user: z.ZodString;
+}, z.core.$strict>]>;
+export type ApproverClause = z.infer<typeof approverClauseSchema>;
+/** Granularity of a held element. */
+export declare const HoldScope: z.ZodEnum<{
+    job: "job";
+    step: "step";
+    workflow: "workflow";
+}>;
+export type HoldScope = z.infer<typeof HoldScope>;
+/** What triggered the hold: an environment policy (mandatory) or SDK code (explicit). */
+export declare const TriggerSource: z.ZodEnum<{
+    environment: "environment";
+    explicit: "explicit";
+}>;
+export type TriggerSource = z.infer<typeof TriggerSource>;
+/**
+ * The normalized requirement attached to a held element. `clauses` is a flat
+ * AND list; an empty list means "any approval-capable org member". `expiresAt`
+ * is an ISO timestamp; on expiry the element is rejected.
+ */
+export declare const approvalRequirementSchema: z.ZodObject<{
+    clauses: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        team: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        user: z.ZodString;
+    }, z.core.$strict>]>>;
+    expiresAt: z.ZodString;
+    reason: z.ZodString;
+}, z.core.$strip>;
+export type ApprovalRequirement = z.infer<typeof approvalRequirementSchema>;
+/** An individual approve/reject decision recorded against a held element. */
+export declare const ApprovalDecision: z.ZodEnum<{
+    approve: "approve";
+    reject: "reject";
+}>;
+export type ApprovalDecision = z.infer<typeof ApprovalDecision>;
+//# sourceMappingURL=types.d.ts.map

package/dist/approval/types.js

@@ -0,0 +1,42 @@
+import "../chunk-BTugEXQM.js";
+import { z } from "zod";
+//#region src/approval/types.ts
+/**
+* Shared approval requirement + clause types.
+*
+* One normalized `ApprovalRequirement` is produced by both approval triggers —
+* a mandatory environment policy and an explicit SDK `requireApproval` — and is
+* consumed identically by the orchestrator gate, the resolver, the held-run
+* store, and the agent step round-trip. Pure Zod (no node built-ins), so this
+* module is safe in the browser-facing engine barrel.
+*/
+/**
+* A single approver clause. `{ team }` is satisfied by any member of the named
+* team; `{ user }` by that specific user. A flat AND list of clauses must all
+* be satisfied to release a held element.
+*/
+const approverClauseSchema = z.union([z.object({ team: z.string().min(1) }).strict(), z.object({ user: z.string().min(1) }).strict()]);
+/** Granularity of a held element. */
+const HoldScope = z.enum([
+	"workflow",
+	"job",
+	"step"
+]);
+/** What triggered the hold: an environment policy (mandatory) or SDK code (explicit). */
+const TriggerSource = z.enum(["environment", "explicit"]);
+/**
+* The normalized requirement attached to a held element. `clauses` is a flat
+* AND list; an empty list means "any approval-capable org member". `expiresAt`
+* is an ISO timestamp; on expiry the element is rejected.
+*/
+const approvalRequirementSchema = z.object({
+	clauses: z.array(approverClauseSchema),
+	expiresAt: z.string(),
+	reason: z.string()
+});
+/** An individual approve/reject decision recorded against a held element. */
+const ApprovalDecision = z.enum(["approve", "reject"]);
+//#endregion
+export { ApprovalDecision, HoldScope, TriggerSource, approvalRequirementSchema, approverClauseSchema };
+
+//# sourceMappingURL=types.js.map

package/dist/audit/access-log-policy.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/audit/access-log-policy.ts
 /**
@@ -58,6 +58,7 @@ const POLICY_BY_ACTION = {
 		kind: "sample",
 		allowedRate: .1
 	},
+	"attestations.read": { kind: "always" },
 	"event_log.list.read": {
 		kind: "sample",
 		allowedRate: .05
@@ -114,6 +115,7 @@ const POLICY_BY_ACTION = {
 	"run.cancel": { kind: "always" },
 	"run.rerun": { kind: "always" },
 	"run.manual_schedule": { kind: "always" },
+	"run.trigger": { kind: "always" },
 	"job.cancel": { kind: "always" },
 	"event_log.detail.read": { kind: "always" },
 	"event_log.payload.read": { kind: "always" },
@@ -136,6 +138,8 @@ const POLICY_BY_ACTION = {
 	"secret_scope.delete": { kind: "always" },
 	"held_run.approve": { kind: "always" },
 	"held_run.reject": { kind: "always" },
+	"held_run.request": { kind: "always" },
+	"held_run.expire": { kind: "always" },
 	"registration.disable": { kind: "always" },
 	"registration.delete": { kind: "always" },
 	"backend.sync": { kind: "always" },

package/dist/audit/activity.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { ActorType } from "../protocol/messages/actor.js";
 import { AccessLogOutcome } from "../protocol/messages/access-log.js";
 import { z } from "zod";

package/dist/audit/retention-policy.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/audit/retention-policy.ts
 /**
 * Warm-retention days per `AccessLogAction`. Exhaustive over the enum so a
@@ -18,6 +18,7 @@ const ACCESS_LOG_WARM_DAYS = {
 	"sources.list.read": 30,
 	"run.orch_logs.read": 30,
 	"step.logs.read": 30,
+	"attestations.read": 30,
 	"event_log.list.read": 30,
 	"environment.list.read": 30,
 	"environment.get.read": 30,
@@ -41,6 +42,7 @@ const ACCESS_LOG_WARM_DAYS = {
 	"run.cancel": 180,
 	"run.rerun": 180,
 	"run.manual_schedule": 180,
+	"run.trigger": 180,
 	"job.cancel": 180,
 	"environment.create": 180,
 	"environment.update": 180,
@@ -52,6 +54,8 @@ const ACCESS_LOG_WARM_DAYS = {
 	"env_binding.set": 180,
 	"held_run.approve": 180,
 	"held_run.reject": 180,
+	"held_run.request": 180,
+	"held_run.expire": 180,
 	"registration.disable": 180,
 	"registration.delete": 180,
 	"backend.sync": 180,
@@ -252,6 +256,7 @@ const ACCESS_LOG_COLD_DAYS = {
 	"sources.list.read": 180,
 	"run.orch_logs.read": 180,
 	"step.logs.read": 180,
+	"attestations.read": 180,
 	"event_log.list.read": 180,
 	"environment.list.read": 180,
 	"environment.get.read": 180,
@@ -275,6 +280,7 @@ const ACCESS_LOG_COLD_DAYS = {
 	"run.cancel": 730,
 	"run.rerun": 730,
 	"run.manual_schedule": 730,
+	"run.trigger": 730,
 	"job.cancel": 730,
 	"environment.create": 730,
 	"environment.update": 730,
@@ -286,6 +292,8 @@ const ACCESS_LOG_COLD_DAYS = {
 	"env_binding.set": 730,
 	"held_run.approve": 730,
 	"held_run.reject": 730,
+	"held_run.request": 730,
+	"held_run.expire": 730,
 	"registration.disable": 730,
 	"registration.delete": 730,
 	"backend.sync": 730,

package/dist/bundler/index.js

@@ -1,3 +1,3 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { createWorkflowBundleConfig } from "./rolldown-config.js";
 export { createWorkflowBundleConfig };

package/dist/bundler/rolldown-config.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/bundler/rolldown-config.ts
 /**
 * Create a rolldown configuration for workflow bundling.

package/dist/env/environment-allowlist.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/env/environment-allowlist.ts
 /**
 * Shared environment allowlist constants for KiCI.

package/dist/environment/index.js

@@ -1,3 +1,3 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix } from "./scope-resolver.js";
 export { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix };

package/dist/environment/scope-resolver.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import picomatch from "picomatch";
 //#region src/environment/scope-resolver.ts
 /**

package/dist/environment/types.d.ts

@@ -4,6 +4,7 @@
  * Environments are org-level entities that group secrets, variables,
  * and protection rules for deployment targets (dev, staging, production).
  */
+import type { ApproverClause } from '../approval/types.js';
 /** Environment entity — org-level deployment target with protection rules. */
 export interface Environment {
     id: string;
@@ -94,5 +95,12 @@ export interface ProtectionGateResult {
     reason?: string;
     holdUntil?: string;
     holdType?: 'reviewer' | 'timer' | 'concurrency' | 'security';
+    /**
+     * Approver clauses for a reviewer hold, mapped from the environment's
+     * `requiredReviewers`. Each reviewer string maps to a `{ user }` clause
+     * (team-named reviewers are a documented follow-up). Empty/undefined means
+     * "any approval-capable member".
+     */
+    clauses?: ApproverClause[];
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/environment/types.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/fanout/materialize.d.ts

@@ -0,0 +1,67 @@
+import { type MatrixValues } from '../matrix/expand.js';
+import type { LockJob } from '../trigger/types.js';
+/** Hard cap on children per fanned job — mirrors the compiler's MAX_STATIC_MATRIX_JOBS. */
+export declare const MAX_FANOUT_JOBS = 256;
+/**
+ * Thrown when a job's matrix cannot be materialized into dispatchable children:
+ * zero combinations after exclude, or more combinations than {@link MAX_FANOUT_JOBS}.
+ * Callers map this onto the `matrix_expansion` init-failure category.
+ */
+export declare class FanoutError extends Error {
+    readonly jobName: string;
+    readonly name = "FanoutError";
+    constructor(jobName: string, message: string);
+}
+/**
+ * One dispatchable unit produced from a lock job. `variantKind` is `'matrix'`
+ * today; the shape is variant-agnostic so a future host fan-out can add `'host'`.
+ */
+export interface MaterializedJob {
+    /** The originating lock job. Its matrix/include/exclude are NOT dispatched as-is. */
+    lockJob: LockJob;
+    /** The lock job's name (the consumer-facing job identity). */
+    baseName: string;
+    /** `${baseName} (${suffix})` for fanned children, else `baseName`. */
+    expandedName: string;
+    /** Present only for fanned children. */
+    variantKind?: 'matrix';
+    /** The combination values for a fanned child; absent for non-fanned jobs. */
+    variantValues?: MatrixValues;
+    /**
+     * True when the job carries a dynamic matrix the orchestrator cannot expand —
+     * it must route through the agent-eval flow and be re-materialized from the result.
+     */
+    pendingDynamicMatrix?: boolean;
+}
+export interface FanoutResult {
+    jobs: MaterializedJob[];
+    /** baseName → expandedNames (length 1 for non-fanned jobs). Drives needs-edge expansion. */
+    expansionMap: Map<string, string[]>;
+}
+/**
+ * The job-config envelope fields that identify a materialized child: the
+ * expanded `name`, the `baseJobName` (what the agent exposes as `ctx.job.name`),
+ * and `matrixValues` (exposed as `ctx.matrix`). Every dispatch site spreads
+ * these into its job config so the envelopes stay identical. The raw
+ * matrix/include/exclude are intentionally NOT included — they are consumed at
+ * dispatch time, not shipped to the agent.
+ */
+export declare function matrixEnvelopeFields(mat: MaterializedJob): {
+    name: string;
+    baseJobName: string;
+    matrixValues?: MatrixValues;
+};
+/**
+ * Build materialized children from a resolved dynamic-matrix combination list
+ * (produced by the agent eval flow). Mirrors the static-matrix branch of
+ * {@link materializeFanout} but takes the already-resolved combinations and
+ * enforces the same cap / zero-combination guards.
+ */
+export declare function materializeResolvedMatrix(lockJob: LockJob, combos: readonly MatrixValues[]): FanoutResult;
+/**
+ * Expand each lock job's static matrix into N dispatchable children (one per
+ * combination), passing non-matrix and dynamic-matrix jobs through 1:1.
+ * Dynamic-matrix jobs are flagged `pendingDynamicMatrix` for the eval flow.
+ */
+export declare function materializeFanout(staticJobs: readonly LockJob[]): FanoutResult;
+//# sourceMappingURL=materialize.d.ts.map

package/dist/fanout/materialize.js

@@ -0,0 +1,119 @@
+import "../chunk-BTugEXQM.js";
+import { applyIncludeExclude, expandMatrix } from "../matrix/expand.js";
+import { formatExpandedJobName } from "../matrix/format.js";
+//#region src/fanout/materialize.ts
+/** Hard cap on children per fanned job — mirrors the compiler's MAX_STATIC_MATRIX_JOBS. */
+const MAX_FANOUT_JOBS = 256;
+/**
+* Thrown when a job's matrix cannot be materialized into dispatchable children:
+* zero combinations after exclude, or more combinations than {@link MAX_FANOUT_JOBS}.
+* Callers map this onto the `matrix_expansion` init-failure category.
+*/
+var FanoutError = class FanoutError extends Error {
+	jobName;
+	name = "FanoutError";
+	constructor(jobName, message) {
+		super(message);
+		this.jobName = jobName;
+		Object.setPrototypeOf(this, FanoutError.prototype);
+	}
+};
+/**
+* The job-config envelope fields that identify a materialized child: the
+* expanded `name`, the `baseJobName` (what the agent exposes as `ctx.job.name`),
+* and `matrixValues` (exposed as `ctx.matrix`). Every dispatch site spreads
+* these into its job config so the envelopes stay identical. The raw
+* matrix/include/exclude are intentionally NOT included — they are consumed at
+* dispatch time, not shipped to the agent.
+*/
+function matrixEnvelopeFields(mat) {
+	return {
+		name: mat.expandedName,
+		baseJobName: mat.baseName,
+		...mat.variantValues && { matrixValues: mat.variantValues }
+	};
+}
+/**
+* Build materialized children from a resolved dynamic-matrix combination list
+* (produced by the agent eval flow). Mirrors the static-matrix branch of
+* {@link materializeFanout} but takes the already-resolved combinations and
+* enforces the same cap / zero-combination guards.
+*/
+function materializeResolvedMatrix(lockJob, combos) {
+	if (combos.length === 0) throw new FanoutError(lockJob.name, `dynamic matrix for job '${lockJob.name}' resolved to zero combinations`);
+	if (combos.length > 256) throw new FanoutError(lockJob.name, `dynamic matrix for job '${lockJob.name}' resolved to ${combos.length} combinations (max 256)`);
+	const jobs = [];
+	const names = [];
+	for (const variantValues of combos) {
+		const expandedName = formatExpandedJobName(lockJob.name, variantValues);
+		names.push(expandedName);
+		jobs.push({
+			lockJob,
+			baseName: lockJob.name,
+			expandedName,
+			variantKind: "matrix",
+			variantValues
+		});
+	}
+	return {
+		jobs,
+		expansionMap: new Map([[lockJob.name, names]])
+	};
+}
+/**
+* Expand each lock job's static matrix into N dispatchable children (one per
+* combination), passing non-matrix and dynamic-matrix jobs through 1:1.
+* Dynamic-matrix jobs are flagged `pendingDynamicMatrix` for the eval flow.
+*/
+function materializeFanout(staticJobs) {
+	const jobs = [];
+	const expansionMap = /* @__PURE__ */ new Map();
+	for (const lockJob of staticJobs) {
+		const matrix = lockJob.matrix;
+		if (!matrix) {
+			jobs.push({
+				lockJob,
+				baseName: lockJob.name,
+				expandedName: lockJob.name
+			});
+			expansionMap.set(lockJob.name, [lockJob.name]);
+			continue;
+		}
+		if (matrix._type === "dynamic") {
+			jobs.push({
+				lockJob,
+				baseName: lockJob.name,
+				expandedName: lockJob.name,
+				pendingDynamicMatrix: true
+			});
+			expansionMap.set(lockJob.name, [lockJob.name]);
+			continue;
+		}
+		const values = matrix.values;
+		if (!values) throw new FanoutError(lockJob.name, `static matrix for job '${lockJob.name}' has no values`);
+		const combos = applyIncludeExclude(expandMatrix(values), lockJob.include, lockJob.exclude);
+		if (combos.length === 0) throw new FanoutError(lockJob.name, `matrix for job '${lockJob.name}' expands to zero combinations`);
+		if (combos.length > 256) throw new FanoutError(lockJob.name, `matrix for job '${lockJob.name}' expands to ${combos.length} combinations (max 256)`);
+		const names = [];
+		for (const variantValues of combos) {
+			const expandedName = formatExpandedJobName(lockJob.name, variantValues);
+			names.push(expandedName);
+			jobs.push({
+				lockJob,
+				baseName: lockJob.name,
+				expandedName,
+				variantKind: "matrix",
+				variantValues
+			});
+		}
+		expansionMap.set(lockJob.name, names);
+	}
+	return {
+		jobs,
+		expansionMap
+	};
+}
+//#endregion
+export { FanoutError, MAX_FANOUT_JOBS, materializeFanout, materializeResolvedMatrix, matrixEnvelopeFields };
+
+//# sourceMappingURL=materialize.js.map

package/dist/index.d.ts

@@ -18,6 +18,7 @@ export * from './protocol/messages/execution-status.js';
 export * from './protocol/messages/scaler-event.js';
 export * from './protocol/messages/event-log.js';
 export * from './protocol/messages/access-log.js';
+export * from './approval/types.js';
 export * from './audit/access-log-policy.js';
 export * from './audit/retention-policy.js';
 export * from './audit/activity.js';
@@ -30,8 +31,6 @@ export { sourceRegistrationSchema, sourceRegistrationAckSchema, sourceDeregister
 export * from './protocol/messages/join.js';
 export * from './protocol/messages/peer.js';
 export * from './protocol/messages/orchestrator-agent.js';
-export * from './protocol/messages/test-run.js';
-export * from './protocol/messages/observe.js';
 export * from './trigger/types.js';
 export * from './trigger/trigger-event-type.js';
 export * from './trigger/decision-trace.js';
@@ -52,4 +51,7 @@ export * from './scaler/scaler-backend-type.js';
 export * from './scaler/resource-types.js';
 export * from './registration/registerable-trigger-type.js';
 export * from './bundler/index.js';
+export { expandSingleDimension, expandMultiDimension, expandMatrix, applyIncludeExclude, type StaticMatrixArray, type StaticMatrixObject, type MatrixInclude, type MatrixExclude, type MatrixValues, } from './matrix/expand.js';
+export { formatMatrixSuffix, formatExpandedJobName } from './matrix/format.js';
+export * from './fanout/materialize.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { MIN_PROTOCOL_VERSION, PROTOCOL_VERSION } from "./protocol/version.js";
 import { WS_MAX_PAYLOAD_BYTES, ackSchema, errorSchema, heartbeatSchema, nackSchema } from "./protocol/messages/common.js";
 import { ActorType, actorPrincipalSchema, apiKeyActorSchema, flattenActor, parseActor, platformOperatorActorSchema, serviceAccountActorSchema, stringifyActor, systemActorSchema, userActorSchema } from "./protocol/messages/actor.js";
@@ -10,7 +10,9 @@ import { AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType
 import { browserJobContextSchema, browserRunEventSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, jobContextMessageSchema, runEventMessageSchema } from "./protocol/messages/run-events.js";
 import { EventLogSource, EventLogStatus, PayloadOmittedReason } from "./protocol/messages/event-log.js";
 import { ScalerBackendType } from "./scaler/scaler-backend-type.js";
-import { EnvDeleteErrorCode, EventLogPayloadStreamError, HeldRunQueueType, HeldRunStatus, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runRerunRequestSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
+import { ApprovalDecision, HoldScope, TriggerSource, approvalRequirementSchema, approverClauseSchema } from "./approval/types.js";
+import { IfFailedPolicy, NeedsEntrySchema, NeedsGroupEntrySchema, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob } from "./trigger/types.js";
+import { EnvDeleteErrorCode, EventLogPayloadStreamError, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListItemSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
 import { WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, cacheStatsSchema, executionEventSchema, logChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema } from "./protocol/messages/platform-orchestrator.js";
 import { ScalerEventType } from "./protocol/messages/scaler-event.js";
 import { AccessLogPolicyKind, POLICY_BY_ACTION, fnv1a32, shouldRecordAccess, shouldRecordSecretResolve } from "./audit/access-log-policy.js";
@@ -20,11 +22,8 @@ import { logPullOrchToPlatformSchema, logPullPlatformToOrchSchema } from "./prot
 import { EVENT_LOG_PAYLOAD_CHUNK_BYTES } from "./protocol/event-log-payload.js";
 import { browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, platformToBrowserMessageSchema } from "./protocol/messages/browser.js";
 import { joinRequestSchema, joinResponseSchema } from "./protocol/messages/join.js";
-import { jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema } from "./protocol/messages/peer.js";
-import { CacheRefScope, JobRejectReason, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, registerAckSchema } from "./protocol/messages/orchestrator-agent.js";
-import { testCancelResponseSchema, testCancelSchema, testEventSchema, testTriggerResponseSchema, testTriggerSchema } from "./protocol/messages/test-run.js";
-import { observeCompleteSchema, observeLogSchema, observeStatusSchema, observeStepSchema, observeSubscribeSchema } from "./protocol/messages/observe.js";
-import { NeedsEntrySchema, NeedsGroupEntrySchema, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob } from "./trigger/types.js";
+import { fleetSelectionSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema } from "./protocol/messages/peer.js";
+import { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema } from "./protocol/messages/orchestrator-agent.js";
 import { TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES } from "./trigger/trigger-event-type.js";
 import { createTraceEntry, createWorkflowDecision } from "./trigger/decision-trace.js";
 import { matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchWorkflowTriggers } from "./trigger/matcher.js";
@@ -44,4 +43,7 @@ import { parseMemoryString, resourceRequestNestedSchema, resourceSpecSchema, val
 import { RegisterableTriggerType } from "./registration/registerable-trigger-type.js";
 import { createWorkflowBundleConfig } from "./bundler/rolldown-config.js";
 import "./bundler/index.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckRunConclusion, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, InitFailureCategory, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LockFileParseError, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, ORCH_CAPABILITIES, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TimeoutReason, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, flattenActor, fnv1a32, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostLabel, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, observeCompleteSchema, observeLogSchema, observeStatusSchema, observeStepSchema, observeSubscribeSchema, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseMemoryString, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testCancelResponseSchema, testCancelSchema, testEventSchema, testTriggerResponseSchema, testTriggerSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };
+import { applyIncludeExclude, expandMatrix, expandMultiDimension, expandSingleDimension } from "./matrix/expand.js";
+import { formatExpandedJobName, formatMatrixSuffix } from "./matrix/format.js";
+import { FanoutError, MAX_FANOUT_JOBS, materializeFanout, materializeResolvedMatrix, matrixEnvelopeFields } from "./fanout/materialize.js";
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, ApprovalDecision, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckRunConclusion, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutError, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, IfFailedPolicy, InitFailureCategory, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LockFileParseError, MAX_FANOUT_JOBS, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, ORCH_CAPABILITIES, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, StepApprovalOutcome, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TestRelayType, TimeoutReason, TriggerSource, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approverClauseSchema, attestationListItemSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostLabel, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, materializeFanout, materializeResolvedMatrix, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseMemoryString, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };

package/dist/labels.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 //#region src/labels.ts
 /**
 * Structured auto-labels with category prefixes.

package/dist/matrix/expand.d.ts

@@ -0,0 +1,43 @@
+/** Single-dimension static matrix: array of values */
+export type StaticMatrixArray = string[];
+/** Multi-dimensional static matrix: named dimensions with values */
+export type StaticMatrixObject = Record<string, string[]>;
+/** Include entries for adding specific matrix combinations */
+export type MatrixInclude = Record<string, string>;
+/** Exclude entries for removing specific matrix combinations */
+export type MatrixExclude = Record<string, string>;
+/**
+ * Matrix values as exposed to steps.
+ * Single-dimension: {value: 'linux'}
+ * Multi-dimensional: {os: 'linux', node: '18'}
+ */
+export interface MatrixValues {
+    /** Single-dimension: the value */
+    value?: string;
+    /** Multi-dimensional: named properties */
+    [dimension: string]: string | undefined;
+}
+/**
+ * Expand single-dimension matrix (array form) to MatrixValues array.
+ * Each value becomes {value: string}.
+ */
+export declare function expandSingleDimension(matrix: StaticMatrixArray): MatrixValues[];
+/**
+ * Expand multi-dimensional matrix (object form) to MatrixValues array.
+ * Uses fast-cartesian to compute cartesian product of all dimensions.
+ * Dimension names are sorted for deterministic output.
+ */
+export declare function expandMultiDimension(matrix: StaticMatrixObject): MatrixValues[];
+/**
+ * Unified expand function that dispatches to single or multi-dimensional expansion.
+ */
+export declare function expandMatrix(matrix: StaticMatrixArray | StaticMatrixObject): MatrixValues[];
+/**
+ * Apply include/exclude modifications to expanded matrix combinations.
+ * Exclude first (remove matching), then include (add new).
+ *
+ * Exclude matches if ALL specified dimensions match.
+ * Include adds new combinations if they don't already exist.
+ */
+export declare function applyIncludeExclude(expanded: MatrixValues[], include?: MatrixInclude[], exclude?: MatrixExclude[]): MatrixValues[];
+//# sourceMappingURL=expand.d.ts.map