@kici-dev/engine 0.1.15 → 0.1.17

package/dist/matrix/expand.js

@@ -0,0 +1,66 @@
+import "../chunk-BTugEXQM.js";
+import fastCartesian from "fast-cartesian";
+//#region src/matrix/expand.ts
+/**
+* Expand single-dimension matrix (array form) to MatrixValues array.
+* Each value becomes {value: string}.
+*/
+function expandSingleDimension(matrix) {
+	return matrix.map((value) => ({ value }));
+}
+/**
+* Expand multi-dimensional matrix (object form) to MatrixValues array.
+* Uses fast-cartesian to compute cartesian product of all dimensions.
+* Dimension names are sorted for deterministic output.
+*/
+function expandMultiDimension(matrix) {
+	const dimensions = Object.entries(matrix);
+	if (dimensions.length === 0) return [];
+	dimensions.sort((a, b) => a[0].localeCompare(b[0]));
+	const names = dimensions.map(([name]) => name);
+	return fastCartesian(dimensions.map(([, values]) => values)).map((combo) => {
+		const result = {};
+		names.forEach((name, idx) => {
+			result[name] = combo[idx];
+		});
+		return result;
+	});
+}
+/**
+* Unified expand function that dispatches to single or multi-dimensional expansion.
+*/
+function expandMatrix(matrix) {
+	if (Array.isArray(matrix)) return expandSingleDimension(matrix);
+	return expandMultiDimension(matrix);
+}
+/**
+* Apply include/exclude modifications to expanded matrix combinations.
+* Exclude first (remove matching), then include (add new).
+*
+* Exclude matches if ALL specified dimensions match.
+* Include adds new combinations if they don't already exist.
+*/
+function applyIncludeExclude(expanded, include, exclude) {
+	let result = [...expanded];
+	if (exclude && exclude.length > 0) result = result.filter((combo) => {
+		return !exclude.some((excl) => {
+			const exclEntries = Object.entries(excl);
+			if (exclEntries.length === 0) return false;
+			return exclEntries.every(([key, value]) => combo[key] === value);
+		});
+	});
+	if (include && include.length > 0) for (const incl of include) {
+		const inclKeys = Object.keys(incl);
+		if (inclKeys.length === 0) continue;
+		if (!result.some((combo) => {
+			const comboKeys = Object.keys(combo);
+			if (inclKeys.length !== comboKeys.length) return false;
+			return inclKeys.every((key) => combo[key] === incl[key]);
+		})) result.push(incl);
+	}
+	return result;
+}
+//#endregion
+export { applyIncludeExclude, expandMatrix, expandMultiDimension, expandSingleDimension };
+
+//# sourceMappingURL=expand.js.map

package/dist/matrix/format.d.ts

@@ -0,0 +1,10 @@
+import type { MatrixValues } from './expand.js';
+/**
+ * Format matrix values into a display string for the job name.
+ * Single-dimension: "node-18"
+ * Multi-dimensional: "linux, 18"
+ */
+export declare function formatMatrixSuffix(matrixValues: MatrixValues): string;
+/** Expanded child job name: `${baseName} (${suffix})`. MUST match the local executor. */
+export declare function formatExpandedJobName(baseName: string, matrixValues: MatrixValues): string;
+//# sourceMappingURL=format.d.ts.map

package/dist/matrix/format.js

@@ -0,0 +1,19 @@
+import "../chunk-BTugEXQM.js";
+//#region src/matrix/format.ts
+/**
+* Format matrix values into a display string for the job name.
+* Single-dimension: "node-18"
+* Multi-dimensional: "linux, 18"
+*/
+function formatMatrixSuffix(matrixValues) {
+	if ("value" in matrixValues && matrixValues.value !== void 0) return matrixValues.value;
+	return Object.values(matrixValues).filter((v) => v !== void 0).join(", ");
+}
+/** Expanded child job name: `${baseName} (${suffix})`. MUST match the local executor. */
+function formatExpandedJobName(baseName, matrixValues) {
+	return `${baseName} (${formatMatrixSuffix(matrixValues)})`;
+}
+//#endregion
+export { formatExpandedJobName, formatMatrixSuffix };
+
+//# sourceMappingURL=format.js.map

package/dist/metrics/catalog-policy.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { MetricNames, MetricService } from "./metric-catalog.generated.js";
 //#region src/metrics/catalog-policy.ts
 /**
@@ -138,7 +138,11 @@ const METRIC_LABEL_POLICY = {
 		machinePool: { maxUniqueValues: 50 }
 	},
 	kici_orch_install_secrets_decisions_total: {
-		decision: { values: ["pass", "reject"] },
+		decision: { values: [
+			"pass",
+			"reject",
+			"hold"
+		] },
 		reason: { values: [
 			"ok",
 			"malformed_ref",
@@ -148,7 +152,8 @@ const METRIC_LABEL_POLICY = {
 			"env_not_found",
 			"protection_rule_block",
 			"missing_token",
-			"missing_install_env"
+			"missing_install_env",
+			"held"
 		] }
 	},
 	kici_orch_install_secrets_npm_registry_used_total: {

package/dist/metrics/metric-catalog.generated.d.ts

@@ -431,7 +431,7 @@ export declare const MetricDescription: {
     readonly KICI_ORCH_EXECUTIONS_TOTAL: "Total number of execution runs";
     readonly KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: "Total number of GitHub check run API calls";
     readonly KICI_ORCH_INSTALL_SECRETS_CONTRIBUTOR_STRIPPED_TOTAL: "Dispatches where registry tokens were stripped because the contributor tier was not `trusted`";
-    readonly KICI_ORCH_INSTALL_SECRETS_DECISIONS_TOTAL: "Total install-secrets resolution decisions (pass / reject + reason)";
+    readonly KICI_ORCH_INSTALL_SECRETS_DECISIONS_TOTAL: "Total install-secrets resolution decisions (pass / reject / hold + reason)";
     readonly KICI_ORCH_INSTALL_SECRETS_NPM_REGISTRY_USED_TOTAL: "Total registry / installEnv entries successfully resolved per channel / provider / scope";
     readonly KICI_ORCH_INSTALL_SECRETS_TOKEN_RESOLUTION_DURATION_SECONDS: "Duration of per-environment secret resolution during install-secrets evaluation";
     readonly KICI_ORCH_JOB_CONSECUTIVE_FAILURES: "Consecutive failures for each scheduled job since its last success";

package/dist/metrics/metric-catalog.generated.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/metrics/metric-catalog.generated.ts
 const MetricNames = {
 	KICI_AGENT_CLONE_DURATION_SECONDS: "kici_agent_clone_duration_seconds",
@@ -440,7 +440,7 @@ const MetricDescription = {
 	KICI_ORCH_EXECUTIONS_TOTAL: "Total number of execution runs",
 	KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: "Total number of GitHub check run API calls",
 	KICI_ORCH_INSTALL_SECRETS_CONTRIBUTOR_STRIPPED_TOTAL: "Dispatches where registry tokens were stripped because the contributor tier was not `trusted`",
-	KICI_ORCH_INSTALL_SECRETS_DECISIONS_TOTAL: "Total install-secrets resolution decisions (pass / reject + reason)",
+	KICI_ORCH_INSTALL_SECRETS_DECISIONS_TOTAL: "Total install-secrets resolution decisions (pass / reject / hold + reason)",
 	KICI_ORCH_INSTALL_SECRETS_NPM_REGISTRY_USED_TOTAL: "Total registry / installEnv entries successfully resolved per channel / provider / scope",
 	KICI_ORCH_INSTALL_SECRETS_TOKEN_RESOLUTION_DURATION_SECONDS: "Duration of per-environment secret resolution during install-secrets evaluation",
 	KICI_ORCH_JOB_CONSECUTIVE_FAILURES: "Consecutive failures for each scheduled job since its last success",

package/dist/protocol/analytics-events.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/protocol/analytics-events.ts
 const AnalyticsEvent = z.enum([

package/dist/protocol/cluster-name.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/protocol/cluster-name.ts
 /**

package/dist/protocol/dashboard-global-workflows.js

@@ -1,3 +1,3 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { globalWorkflowSettingsSchema, globalWorkflowsGetRequestSchema, globalWorkflowsGetResponseSchema, globalWorkflowsUpdateRequestSchema, globalWorkflowsUpdateResponseSchema, repoPatternEntrySchema } from "./messages/dashboard-global-workflows.js";
 export { globalWorkflowSettingsSchema, globalWorkflowsGetRequestSchema, globalWorkflowsGetResponseSchema, globalWorkflowsUpdateRequestSchema, globalWorkflowsUpdateResponseSchema, repoPatternEntrySchema };

package/dist/protocol/dashboard-write-operations.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/protocol/dashboard-write-operations.ts
 /**

package/dist/protocol/event-log-payload.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/protocol/event-log-payload.ts
 /**
 * Constants for the chunked event-log payload streaming transport.

package/dist/protocol/messages/access-log.d.ts

@@ -29,8 +29,8 @@ export type AccessLogOutcome = z.infer<typeof AccessLogOutcome>;
 export declare const AccessLogTargetType: z.ZodEnum<{
     run: "run";
     job: "job";
-    step: "step";
     payload: "payload";
+    step: "step";
     event_log: "event_log";
     event_log_payload: "event_log_payload";
     secret_scope: "secret_scope";
@@ -63,9 +63,11 @@ export declare const AccessLogAction: z.ZodEnum<{
     "run.payload.read": "run.payload.read";
     "run.orch_logs.read": "run.orch_logs.read";
     "step.logs.read": "step.logs.read";
+    "attestations.read": "attestations.read";
     "run.cancel": "run.cancel";
     "run.rerun": "run.rerun";
     "run.manual_schedule": "run.manual_schedule";
+    "run.trigger": "run.trigger";
     "job.cancel": "job.cancel";
     "event_log.list.read": "event_log.list.read";
     "event_log.detail.read": "event_log.detail.read";
@@ -94,6 +96,8 @@ export declare const AccessLogAction: z.ZodEnum<{
     "held_run.list.read": "held_run.list.read";
     "held_run.approve": "held_run.approve";
     "held_run.reject": "held_run.reject";
+    "held_run.request": "held_run.request";
+    "held_run.expire": "held_run.expire";
     "registration.list.read": "registration.list.read";
     "diagnostics.read": "diagnostics.read";
     "scaler.capacity.read": "scaler.capacity.read";
@@ -147,9 +151,11 @@ export declare const accessLogItemSchema: z.ZodObject<{
         "run.payload.read": "run.payload.read";
         "run.orch_logs.read": "run.orch_logs.read";
         "step.logs.read": "step.logs.read";
+        "attestations.read": "attestations.read";
         "run.cancel": "run.cancel";
         "run.rerun": "run.rerun";
         "run.manual_schedule": "run.manual_schedule";
+        "run.trigger": "run.trigger";
         "job.cancel": "job.cancel";
         "event_log.list.read": "event_log.list.read";
         "event_log.detail.read": "event_log.detail.read";
@@ -178,6 +184,8 @@ export declare const accessLogItemSchema: z.ZodObject<{
         "held_run.list.read": "held_run.list.read";
         "held_run.approve": "held_run.approve";
         "held_run.reject": "held_run.reject";
+        "held_run.request": "held_run.request";
+        "held_run.expire": "held_run.expire";
         "registration.list.read": "registration.list.read";
         "diagnostics.read": "diagnostics.read";
         "scaler.capacity.read": "scaler.capacity.read";
@@ -198,8 +206,8 @@ export declare const accessLogItemSchema: z.ZodObject<{
     targetType: z.ZodNullable<z.ZodEnum<{
         run: "run";
         job: "job";
-        step: "step";
         payload: "payload";
+        step: "step";
         event_log: "event_log";
         event_log_payload: "event_log_payload";
         secret_scope: "secret_scope";
@@ -253,9 +261,11 @@ export declare const accessLogFilterSchema: z.ZodObject<{
         "run.payload.read": "run.payload.read";
         "run.orch_logs.read": "run.orch_logs.read";
         "step.logs.read": "step.logs.read";
+        "attestations.read": "attestations.read";
         "run.cancel": "run.cancel";
         "run.rerun": "run.rerun";
         "run.manual_schedule": "run.manual_schedule";
+        "run.trigger": "run.trigger";
         "job.cancel": "job.cancel";
         "event_log.list.read": "event_log.list.read";
         "event_log.detail.read": "event_log.detail.read";
@@ -284,6 +294,8 @@ export declare const accessLogFilterSchema: z.ZodObject<{
         "held_run.list.read": "held_run.list.read";
         "held_run.approve": "held_run.approve";
         "held_run.reject": "held_run.reject";
+        "held_run.request": "held_run.request";
+        "held_run.expire": "held_run.expire";
         "registration.list.read": "registration.list.read";
         "diagnostics.read": "diagnostics.read";
         "scaler.capacity.read": "scaler.capacity.read";
@@ -314,8 +326,8 @@ export declare const accessLogFilterSchema: z.ZodObject<{
     targetType: z.ZodOptional<z.ZodEnum<{
         run: "run";
         job: "job";
-        step: "step";
         payload: "payload";
+        step: "step";
         event_log: "event_log";
         event_log_payload: "event_log_payload";
         secret_scope: "secret_scope";
@@ -381,9 +393,11 @@ export declare const dashboardAccessLogListRequestSchema: z.ZodObject<{
         "run.payload.read": "run.payload.read";
         "run.orch_logs.read": "run.orch_logs.read";
         "step.logs.read": "step.logs.read";
+        "attestations.read": "attestations.read";
         "run.cancel": "run.cancel";
         "run.rerun": "run.rerun";
         "run.manual_schedule": "run.manual_schedule";
+        "run.trigger": "run.trigger";
         "job.cancel": "job.cancel";
         "event_log.list.read": "event_log.list.read";
         "event_log.detail.read": "event_log.detail.read";
@@ -412,6 +426,8 @@ export declare const dashboardAccessLogListRequestSchema: z.ZodObject<{
         "held_run.list.read": "held_run.list.read";
         "held_run.approve": "held_run.approve";
         "held_run.reject": "held_run.reject";
+        "held_run.request": "held_run.request";
+        "held_run.expire": "held_run.expire";
         "registration.list.read": "registration.list.read";
         "diagnostics.read": "diagnostics.read";
         "scaler.capacity.read": "scaler.capacity.read";
@@ -442,8 +458,8 @@ export declare const dashboardAccessLogListRequestSchema: z.ZodObject<{
     targetType: z.ZodOptional<z.ZodEnum<{
         run: "run";
         job: "job";
-        step: "step";
         payload: "payload";
+        step: "step";
         event_log: "event_log";
         event_log_payload: "event_log_payload";
         secret_scope: "secret_scope";
@@ -497,9 +513,11 @@ export declare const dashboardAccessLogListResponseSchema: z.ZodObject<{
             "run.payload.read": "run.payload.read";
             "run.orch_logs.read": "run.orch_logs.read";
             "step.logs.read": "step.logs.read";
+            "attestations.read": "attestations.read";
             "run.cancel": "run.cancel";
             "run.rerun": "run.rerun";
             "run.manual_schedule": "run.manual_schedule";
+            "run.trigger": "run.trigger";
             "job.cancel": "job.cancel";
             "event_log.list.read": "event_log.list.read";
             "event_log.detail.read": "event_log.detail.read";
@@ -528,6 +546,8 @@ export declare const dashboardAccessLogListResponseSchema: z.ZodObject<{
             "held_run.list.read": "held_run.list.read";
             "held_run.approve": "held_run.approve";
             "held_run.reject": "held_run.reject";
+            "held_run.request": "held_run.request";
+            "held_run.expire": "held_run.expire";
             "registration.list.read": "registration.list.read";
             "diagnostics.read": "diagnostics.read";
             "scaler.capacity.read": "scaler.capacity.read";
@@ -548,8 +568,8 @@ export declare const dashboardAccessLogListResponseSchema: z.ZodObject<{
         targetType: z.ZodNullable<z.ZodEnum<{
             run: "run";
             job: "job";
-            step: "step";
             payload: "payload";
+            step: "step";
             event_log: "event_log";
             event_log_payload: "event_log_payload";
             secret_scope: "secret_scope";

package/dist/protocol/messages/access-log.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { ActorType, actorPrincipalSchema } from "./actor.js";
 import { z } from "zod";
 //#region src/protocol/messages/access-log.ts
@@ -58,9 +58,11 @@ const AccessLogAction = z.enum([
 	"run.payload.read",
 	"run.orch_logs.read",
 	"step.logs.read",
+	"attestations.read",
 	"run.cancel",
 	"run.rerun",
 	"run.manual_schedule",
+	"run.trigger",
 	"job.cancel",
 	"event_log.list.read",
 	"event_log.detail.read",
@@ -89,6 +91,8 @@ const AccessLogAction = z.enum([
 	"held_run.list.read",
 	"held_run.approve",
 	"held_run.reject",
+	"held_run.request",
+	"held_run.expire",
 	"registration.list.read",
 	"registration.disable",
 	"registration.delete",

package/dist/protocol/messages/actor.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/protocol/messages/actor.ts
 /**

package/dist/protocol/messages/auth.d.ts

@@ -42,6 +42,7 @@ export declare const authSuccessSchema: z.ZodObject<{
     type: z.ZodLiteral<"auth.success">;
     connectionId: z.ZodString;
     orgPublicAlias: z.ZodOptional<z.ZodString>;
+    orgId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /** Auth failure response sent by Platform to orchestrator when authentication fails. */
 export declare const authFailureSchema: z.ZodObject<{

package/dist/protocol/messages/auth.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { orchCapabilitiesSchema } from "./capabilities.js";
 import { z } from "zod";
 //#region src/protocol/messages/auth.ts
@@ -23,7 +23,16 @@ const authSuccessSchema = z.object({
 	* that don't yet supply it; when absent, the orchestrator skips
 	* `details_url` (preserving today's behaviour).
 	*/
-	orgPublicAlias: z.string().optional()
+	orgPublicAlias: z.string().optional(),
+	/**
+	* Canonical org id (`org_<…>`) of the authenticated orchestrator's owning
+	* org. The orchestrator auto-provisions a `remote_sources` anchor
+	* (`remote:<orgId>`) from this so `kici run remote` relayed through the
+	* Platform resolves the real tenant. Optional for back-compat with Platforms
+	* that don't yet supply it; when absent, the orchestrator skips
+	* remote-source provisioning.
+	*/
+	orgId: z.string().optional()
 });
 /** Auth failure response sent by Platform to orchestrator when authentication fails. */
 const authFailureSchema = z.object({

package/dist/protocol/messages/browser.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { browserJobContextSchema, browserRunEventSchema } from "./run-events.js";
 import { browserEventLogPayloadChunkSchema } from "./dashboard.js";
 import { z } from "zod";

package/dist/protocol/messages/capabilities.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { dashboardWritePolicyMap } from "../dashboard-write-operations.js";
 import { z } from "zod";
 //#region src/protocol/messages/capabilities.ts

package/dist/protocol/messages/common.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/protocol/messages/common.ts
 /**

package/dist/protocol/messages/dashboard-global-workflows.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { actorPrincipalSchema } from "./actor.js";
 import { z } from "zod";
 //#region src/protocol/messages/dashboard-global-workflows.ts