@kici-dev/engine 0.1.16 → 0.1.17

package/dist/approval/types.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/approval/types.ts
 /**

package/dist/audit/access-log-policy.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/audit/access-log-policy.ts
 /**
@@ -58,6 +58,7 @@ const POLICY_BY_ACTION = {
 		kind: "sample",
 		allowedRate: .1
 	},
+	"attestations.read": { kind: "always" },
 	"event_log.list.read": {
 		kind: "sample",
 		allowedRate: .05
@@ -114,6 +115,7 @@ const POLICY_BY_ACTION = {
 	"run.cancel": { kind: "always" },
 	"run.rerun": { kind: "always" },
 	"run.manual_schedule": { kind: "always" },
+	"run.trigger": { kind: "always" },
 	"job.cancel": { kind: "always" },
 	"event_log.detail.read": { kind: "always" },
 	"event_log.payload.read": { kind: "always" },

package/dist/audit/activity.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { ActorType } from "../protocol/messages/actor.js";
 import { AccessLogOutcome } from "../protocol/messages/access-log.js";
 import { z } from "zod";

package/dist/audit/retention-policy.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/audit/retention-policy.ts
 /**
 * Warm-retention days per `AccessLogAction`. Exhaustive over the enum so a
@@ -18,6 +18,7 @@ const ACCESS_LOG_WARM_DAYS = {
 	"sources.list.read": 30,
 	"run.orch_logs.read": 30,
 	"step.logs.read": 30,
+	"attestations.read": 30,
 	"event_log.list.read": 30,
 	"environment.list.read": 30,
 	"environment.get.read": 30,
@@ -41,6 +42,7 @@ const ACCESS_LOG_WARM_DAYS = {
 	"run.cancel": 180,
 	"run.rerun": 180,
 	"run.manual_schedule": 180,
+	"run.trigger": 180,
 	"job.cancel": 180,
 	"environment.create": 180,
 	"environment.update": 180,
@@ -254,6 +256,7 @@ const ACCESS_LOG_COLD_DAYS = {
 	"sources.list.read": 180,
 	"run.orch_logs.read": 180,
 	"step.logs.read": 180,
+	"attestations.read": 180,
 	"event_log.list.read": 180,
 	"environment.list.read": 180,
 	"environment.get.read": 180,
@@ -277,6 +280,7 @@ const ACCESS_LOG_COLD_DAYS = {
 	"run.cancel": 730,
 	"run.rerun": 730,
 	"run.manual_schedule": 730,
+	"run.trigger": 730,
 	"job.cancel": 730,
 	"environment.create": 730,
 	"environment.update": 730,

package/dist/bundler/index.js

@@ -1,3 +1,3 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { createWorkflowBundleConfig } from "./rolldown-config.js";
 export { createWorkflowBundleConfig };

package/dist/bundler/rolldown-config.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/bundler/rolldown-config.ts
 /**
 * Create a rolldown configuration for workflow bundling.

package/dist/env/environment-allowlist.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/env/environment-allowlist.ts
 /**
 * Shared environment allowlist constants for KiCI.

package/dist/environment/index.js

@@ -1,3 +1,3 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix } from "./scope-resolver.js";
 export { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix };

package/dist/environment/scope-resolver.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import picomatch from "picomatch";
 //#region src/environment/scope-resolver.ts
 /**

package/dist/environment/types.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/fanout/materialize.d.ts

@@ -0,0 +1,67 @@
+import { type MatrixValues } from '../matrix/expand.js';
+import type { LockJob } from '../trigger/types.js';
+/** Hard cap on children per fanned job — mirrors the compiler's MAX_STATIC_MATRIX_JOBS. */
+export declare const MAX_FANOUT_JOBS = 256;
+/**
+ * Thrown when a job's matrix cannot be materialized into dispatchable children:
+ * zero combinations after exclude, or more combinations than {@link MAX_FANOUT_JOBS}.
+ * Callers map this onto the `matrix_expansion` init-failure category.
+ */
+export declare class FanoutError extends Error {
+    readonly jobName: string;
+    readonly name = "FanoutError";
+    constructor(jobName: string, message: string);
+}
+/**
+ * One dispatchable unit produced from a lock job. `variantKind` is `'matrix'`
+ * today; the shape is variant-agnostic so a future host fan-out can add `'host'`.
+ */
+export interface MaterializedJob {
+    /** The originating lock job. Its matrix/include/exclude are NOT dispatched as-is. */
+    lockJob: LockJob;
+    /** The lock job's name (the consumer-facing job identity). */
+    baseName: string;
+    /** `${baseName} (${suffix})` for fanned children, else `baseName`. */
+    expandedName: string;
+    /** Present only for fanned children. */
+    variantKind?: 'matrix';
+    /** The combination values for a fanned child; absent for non-fanned jobs. */
+    variantValues?: MatrixValues;
+    /**
+     * True when the job carries a dynamic matrix the orchestrator cannot expand —
+     * it must route through the agent-eval flow and be re-materialized from the result.
+     */
+    pendingDynamicMatrix?: boolean;
+}
+export interface FanoutResult {
+    jobs: MaterializedJob[];
+    /** baseName → expandedNames (length 1 for non-fanned jobs). Drives needs-edge expansion. */
+    expansionMap: Map<string, string[]>;
+}
+/**
+ * The job-config envelope fields that identify a materialized child: the
+ * expanded `name`, the `baseJobName` (what the agent exposes as `ctx.job.name`),
+ * and `matrixValues` (exposed as `ctx.matrix`). Every dispatch site spreads
+ * these into its job config so the envelopes stay identical. The raw
+ * matrix/include/exclude are intentionally NOT included — they are consumed at
+ * dispatch time, not shipped to the agent.
+ */
+export declare function matrixEnvelopeFields(mat: MaterializedJob): {
+    name: string;
+    baseJobName: string;
+    matrixValues?: MatrixValues;
+};
+/**
+ * Build materialized children from a resolved dynamic-matrix combination list
+ * (produced by the agent eval flow). Mirrors the static-matrix branch of
+ * {@link materializeFanout} but takes the already-resolved combinations and
+ * enforces the same cap / zero-combination guards.
+ */
+export declare function materializeResolvedMatrix(lockJob: LockJob, combos: readonly MatrixValues[]): FanoutResult;
+/**
+ * Expand each lock job's static matrix into N dispatchable children (one per
+ * combination), passing non-matrix and dynamic-matrix jobs through 1:1.
+ * Dynamic-matrix jobs are flagged `pendingDynamicMatrix` for the eval flow.
+ */
+export declare function materializeFanout(staticJobs: readonly LockJob[]): FanoutResult;
+//# sourceMappingURL=materialize.d.ts.map

package/dist/fanout/materialize.js

@@ -0,0 +1,119 @@
+import "../chunk-BTugEXQM.js";
+import { applyIncludeExclude, expandMatrix } from "../matrix/expand.js";
+import { formatExpandedJobName } from "../matrix/format.js";
+//#region src/fanout/materialize.ts
+/** Hard cap on children per fanned job — mirrors the compiler's MAX_STATIC_MATRIX_JOBS. */
+const MAX_FANOUT_JOBS = 256;
+/**
+* Thrown when a job's matrix cannot be materialized into dispatchable children:
+* zero combinations after exclude, or more combinations than {@link MAX_FANOUT_JOBS}.
+* Callers map this onto the `matrix_expansion` init-failure category.
+*/
+var FanoutError = class FanoutError extends Error {
+	jobName;
+	name = "FanoutError";
+	constructor(jobName, message) {
+		super(message);
+		this.jobName = jobName;
+		Object.setPrototypeOf(this, FanoutError.prototype);
+	}
+};
+/**
+* The job-config envelope fields that identify a materialized child: the
+* expanded `name`, the `baseJobName` (what the agent exposes as `ctx.job.name`),
+* and `matrixValues` (exposed as `ctx.matrix`). Every dispatch site spreads
+* these into its job config so the envelopes stay identical. The raw
+* matrix/include/exclude are intentionally NOT included — they are consumed at
+* dispatch time, not shipped to the agent.
+*/
+function matrixEnvelopeFields(mat) {
+	return {
+		name: mat.expandedName,
+		baseJobName: mat.baseName,
+		...mat.variantValues && { matrixValues: mat.variantValues }
+	};
+}
+/**
+* Build materialized children from a resolved dynamic-matrix combination list
+* (produced by the agent eval flow). Mirrors the static-matrix branch of
+* {@link materializeFanout} but takes the already-resolved combinations and
+* enforces the same cap / zero-combination guards.
+*/
+function materializeResolvedMatrix(lockJob, combos) {
+	if (combos.length === 0) throw new FanoutError(lockJob.name, `dynamic matrix for job '${lockJob.name}' resolved to zero combinations`);
+	if (combos.length > 256) throw new FanoutError(lockJob.name, `dynamic matrix for job '${lockJob.name}' resolved to ${combos.length} combinations (max 256)`);
+	const jobs = [];
+	const names = [];
+	for (const variantValues of combos) {
+		const expandedName = formatExpandedJobName(lockJob.name, variantValues);
+		names.push(expandedName);
+		jobs.push({
+			lockJob,
+			baseName: lockJob.name,
+			expandedName,
+			variantKind: "matrix",
+			variantValues
+		});
+	}
+	return {
+		jobs,
+		expansionMap: new Map([[lockJob.name, names]])
+	};
+}
+/**
+* Expand each lock job's static matrix into N dispatchable children (one per
+* combination), passing non-matrix and dynamic-matrix jobs through 1:1.
+* Dynamic-matrix jobs are flagged `pendingDynamicMatrix` for the eval flow.
+*/
+function materializeFanout(staticJobs) {
+	const jobs = [];
+	const expansionMap = /* @__PURE__ */ new Map();
+	for (const lockJob of staticJobs) {
+		const matrix = lockJob.matrix;
+		if (!matrix) {
+			jobs.push({
+				lockJob,
+				baseName: lockJob.name,
+				expandedName: lockJob.name
+			});
+			expansionMap.set(lockJob.name, [lockJob.name]);
+			continue;
+		}
+		if (matrix._type === "dynamic") {
+			jobs.push({
+				lockJob,
+				baseName: lockJob.name,
+				expandedName: lockJob.name,
+				pendingDynamicMatrix: true
+			});
+			expansionMap.set(lockJob.name, [lockJob.name]);
+			continue;
+		}
+		const values = matrix.values;
+		if (!values) throw new FanoutError(lockJob.name, `static matrix for job '${lockJob.name}' has no values`);
+		const combos = applyIncludeExclude(expandMatrix(values), lockJob.include, lockJob.exclude);
+		if (combos.length === 0) throw new FanoutError(lockJob.name, `matrix for job '${lockJob.name}' expands to zero combinations`);
+		if (combos.length > 256) throw new FanoutError(lockJob.name, `matrix for job '${lockJob.name}' expands to ${combos.length} combinations (max 256)`);
+		const names = [];
+		for (const variantValues of combos) {
+			const expandedName = formatExpandedJobName(lockJob.name, variantValues);
+			names.push(expandedName);
+			jobs.push({
+				lockJob,
+				baseName: lockJob.name,
+				expandedName,
+				variantKind: "matrix",
+				variantValues
+			});
+		}
+		expansionMap.set(lockJob.name, names);
+	}
+	return {
+		jobs,
+		expansionMap
+	};
+}
+//#endregion
+export { FanoutError, MAX_FANOUT_JOBS, materializeFanout, materializeResolvedMatrix, matrixEnvelopeFields };
+
+//# sourceMappingURL=materialize.js.map

package/dist/index.d.ts

@@ -31,8 +31,6 @@ export { sourceRegistrationSchema, sourceRegistrationAckSchema, sourceDeregister
 export * from './protocol/messages/join.js';
 export * from './protocol/messages/peer.js';
 export * from './protocol/messages/orchestrator-agent.js';
-export * from './protocol/messages/test-run.js';
-export * from './protocol/messages/observe.js';
 export * from './trigger/types.js';
 export * from './trigger/trigger-event-type.js';
 export * from './trigger/decision-trace.js';
@@ -53,4 +51,7 @@ export * from './scaler/scaler-backend-type.js';
 export * from './scaler/resource-types.js';
 export * from './registration/registerable-trigger-type.js';
 export * from './bundler/index.js';
+export { expandSingleDimension, expandMultiDimension, expandMatrix, applyIncludeExclude, type StaticMatrixArray, type StaticMatrixObject, type MatrixInclude, type MatrixExclude, type MatrixValues, } from './matrix/expand.js';
+export { formatMatrixSuffix, formatExpandedJobName } from './matrix/format.js';
+export * from './fanout/materialize.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { MIN_PROTOCOL_VERSION, PROTOCOL_VERSION } from "./protocol/version.js";
 import { WS_MAX_PAYLOAD_BYTES, ackSchema, errorSchema, heartbeatSchema, nackSchema } from "./protocol/messages/common.js";
 import { ActorType, actorPrincipalSchema, apiKeyActorSchema, flattenActor, parseActor, platformOperatorActorSchema, serviceAccountActorSchema, stringifyActor, systemActorSchema, userActorSchema } from "./protocol/messages/actor.js";
@@ -11,7 +11,8 @@ import { browserJobContextSchema, browserRunEventSchema, dashboardOrchLogsReques
 import { EventLogSource, EventLogStatus, PayloadOmittedReason } from "./protocol/messages/event-log.js";
 import { ScalerBackendType } from "./scaler/scaler-backend-type.js";
 import { ApprovalDecision, HoldScope, TriggerSource, approvalRequirementSchema, approverClauseSchema } from "./approval/types.js";
-import { EnvDeleteErrorCode, EventLogPayloadStreamError, HeldRunQueueType, HeldRunStatus, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runRerunRequestSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
+import { IfFailedPolicy, NeedsEntrySchema, NeedsGroupEntrySchema, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob } from "./trigger/types.js";
+import { EnvDeleteErrorCode, EventLogPayloadStreamError, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListItemSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
 import { WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, cacheStatsSchema, executionEventSchema, logChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema } from "./protocol/messages/platform-orchestrator.js";
 import { ScalerEventType } from "./protocol/messages/scaler-event.js";
 import { AccessLogPolicyKind, POLICY_BY_ACTION, fnv1a32, shouldRecordAccess, shouldRecordSecretResolve } from "./audit/access-log-policy.js";
@@ -22,10 +23,7 @@ import { EVENT_LOG_PAYLOAD_CHUNK_BYTES } from "./protocol/event-log-payload.js";
 import { browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, platformToBrowserMessageSchema } from "./protocol/messages/browser.js";
 import { joinRequestSchema, joinResponseSchema } from "./protocol/messages/join.js";
 import { fleetSelectionSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema } from "./protocol/messages/peer.js";
-import { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, registerAckSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema } from "./protocol/messages/orchestrator-agent.js";
-import { testCancelResponseSchema, testCancelSchema, testEventSchema, testTriggerResponseSchema, testTriggerSchema } from "./protocol/messages/test-run.js";
-import { observeCompleteSchema, observeLogSchema, observeStatusSchema, observeStepSchema, observeSubscribeSchema } from "./protocol/messages/observe.js";
-import { NeedsEntrySchema, NeedsGroupEntrySchema, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob } from "./trigger/types.js";
+import { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema } from "./protocol/messages/orchestrator-agent.js";
 import { TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES } from "./trigger/trigger-event-type.js";
 import { createTraceEntry, createWorkflowDecision } from "./trigger/decision-trace.js";
 import { matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchWorkflowTriggers } from "./trigger/matcher.js";
@@ -45,4 +43,7 @@ import { parseMemoryString, resourceRequestNestedSchema, resourceSpecSchema, val
 import { RegisterableTriggerType } from "./registration/registerable-trigger-type.js";
 import { createWorkflowBundleConfig } from "./bundler/rolldown-config.js";
 import "./bundler/index.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, ApprovalDecision, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckRunConclusion, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, InitFailureCategory, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LockFileParseError, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, ORCH_CAPABILITIES, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, StepApprovalOutcome, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TimeoutReason, TriggerSource, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, approvalRequirementSchema, approverClauseSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, fleetSelectionSchema, fnv1a32, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostLabel, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, observeCompleteSchema, observeLogSchema, observeStatusSchema, observeStepSchema, observeSubscribeSchema, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseMemoryString, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testCancelResponseSchema, testCancelSchema, testEventSchema, testTriggerResponseSchema, testTriggerSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };
+import { applyIncludeExclude, expandMatrix, expandMultiDimension, expandSingleDimension } from "./matrix/expand.js";
+import { formatExpandedJobName, formatMatrixSuffix } from "./matrix/format.js";
+import { FanoutError, MAX_FANOUT_JOBS, materializeFanout, materializeResolvedMatrix, matrixEnvelopeFields } from "./fanout/materialize.js";
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, ApprovalDecision, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckRunConclusion, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutError, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, IfFailedPolicy, InitFailureCategory, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LockFileParseError, MAX_FANOUT_JOBS, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, ORCH_CAPABILITIES, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, StepApprovalOutcome, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TestRelayType, TimeoutReason, TriggerSource, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approverClauseSchema, attestationListItemSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostLabel, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, materializeFanout, materializeResolvedMatrix, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseMemoryString, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };

package/dist/labels.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 //#region src/labels.ts
 /**
 * Structured auto-labels with category prefixes.

package/dist/matrix/expand.d.ts

@@ -0,0 +1,43 @@
+/** Single-dimension static matrix: array of values */
+export type StaticMatrixArray = string[];
+/** Multi-dimensional static matrix: named dimensions with values */
+export type StaticMatrixObject = Record<string, string[]>;
+/** Include entries for adding specific matrix combinations */
+export type MatrixInclude = Record<string, string>;
+/** Exclude entries for removing specific matrix combinations */
+export type MatrixExclude = Record<string, string>;
+/**
+ * Matrix values as exposed to steps.
+ * Single-dimension: {value: 'linux'}
+ * Multi-dimensional: {os: 'linux', node: '18'}
+ */
+export interface MatrixValues {
+    /** Single-dimension: the value */
+    value?: string;
+    /** Multi-dimensional: named properties */
+    [dimension: string]: string | undefined;
+}
+/**
+ * Expand single-dimension matrix (array form) to MatrixValues array.
+ * Each value becomes {value: string}.
+ */
+export declare function expandSingleDimension(matrix: StaticMatrixArray): MatrixValues[];
+/**
+ * Expand multi-dimensional matrix (object form) to MatrixValues array.
+ * Uses fast-cartesian to compute cartesian product of all dimensions.
+ * Dimension names are sorted for deterministic output.
+ */
+export declare function expandMultiDimension(matrix: StaticMatrixObject): MatrixValues[];
+/**
+ * Unified expand function that dispatches to single or multi-dimensional expansion.
+ */
+export declare function expandMatrix(matrix: StaticMatrixArray | StaticMatrixObject): MatrixValues[];
+/**
+ * Apply include/exclude modifications to expanded matrix combinations.
+ * Exclude first (remove matching), then include (add new).
+ *
+ * Exclude matches if ALL specified dimensions match.
+ * Include adds new combinations if they don't already exist.
+ */
+export declare function applyIncludeExclude(expanded: MatrixValues[], include?: MatrixInclude[], exclude?: MatrixExclude[]): MatrixValues[];
+//# sourceMappingURL=expand.d.ts.map

package/dist/matrix/expand.js

@@ -0,0 +1,66 @@
+import "../chunk-BTugEXQM.js";
+import fastCartesian from "fast-cartesian";
+//#region src/matrix/expand.ts
+/**
+* Expand single-dimension matrix (array form) to MatrixValues array.
+* Each value becomes {value: string}.
+*/
+function expandSingleDimension(matrix) {
+	return matrix.map((value) => ({ value }));
+}
+/**
+* Expand multi-dimensional matrix (object form) to MatrixValues array.
+* Uses fast-cartesian to compute cartesian product of all dimensions.
+* Dimension names are sorted for deterministic output.
+*/
+function expandMultiDimension(matrix) {
+	const dimensions = Object.entries(matrix);
+	if (dimensions.length === 0) return [];
+	dimensions.sort((a, b) => a[0].localeCompare(b[0]));
+	const names = dimensions.map(([name]) => name);
+	return fastCartesian(dimensions.map(([, values]) => values)).map((combo) => {
+		const result = {};
+		names.forEach((name, idx) => {
+			result[name] = combo[idx];
+		});
+		return result;
+	});
+}
+/**
+* Unified expand function that dispatches to single or multi-dimensional expansion.
+*/
+function expandMatrix(matrix) {
+	if (Array.isArray(matrix)) return expandSingleDimension(matrix);
+	return expandMultiDimension(matrix);
+}
+/**
+* Apply include/exclude modifications to expanded matrix combinations.
+* Exclude first (remove matching), then include (add new).
+*
+* Exclude matches if ALL specified dimensions match.
+* Include adds new combinations if they don't already exist.
+*/
+function applyIncludeExclude(expanded, include, exclude) {
+	let result = [...expanded];
+	if (exclude && exclude.length > 0) result = result.filter((combo) => {
+		return !exclude.some((excl) => {
+			const exclEntries = Object.entries(excl);
+			if (exclEntries.length === 0) return false;
+			return exclEntries.every(([key, value]) => combo[key] === value);
+		});
+	});
+	if (include && include.length > 0) for (const incl of include) {
+		const inclKeys = Object.keys(incl);
+		if (inclKeys.length === 0) continue;
+		if (!result.some((combo) => {
+			const comboKeys = Object.keys(combo);
+			if (inclKeys.length !== comboKeys.length) return false;
+			return inclKeys.every((key) => combo[key] === incl[key]);
+		})) result.push(incl);
+	}
+	return result;
+}
+//#endregion
+export { applyIncludeExclude, expandMatrix, expandMultiDimension, expandSingleDimension };
+
+//# sourceMappingURL=expand.js.map

package/dist/matrix/format.d.ts

@@ -0,0 +1,10 @@
+import type { MatrixValues } from './expand.js';
+/**
+ * Format matrix values into a display string for the job name.
+ * Single-dimension: "node-18"
+ * Multi-dimensional: "linux, 18"
+ */
+export declare function formatMatrixSuffix(matrixValues: MatrixValues): string;
+/** Expanded child job name: `${baseName} (${suffix})`. MUST match the local executor. */
+export declare function formatExpandedJobName(baseName: string, matrixValues: MatrixValues): string;
+//# sourceMappingURL=format.d.ts.map

package/dist/matrix/format.js

@@ -0,0 +1,19 @@
+import "../chunk-BTugEXQM.js";
+//#region src/matrix/format.ts
+/**
+* Format matrix values into a display string for the job name.
+* Single-dimension: "node-18"
+* Multi-dimensional: "linux, 18"
+*/
+function formatMatrixSuffix(matrixValues) {
+	if ("value" in matrixValues && matrixValues.value !== void 0) return matrixValues.value;
+	return Object.values(matrixValues).filter((v) => v !== void 0).join(", ");
+}
+/** Expanded child job name: `${baseName} (${suffix})`. MUST match the local executor. */
+function formatExpandedJobName(baseName, matrixValues) {
+	return `${baseName} (${formatMatrixSuffix(matrixValues)})`;
+}
+//#endregion
+export { formatExpandedJobName, formatMatrixSuffix };
+
+//# sourceMappingURL=format.js.map

package/dist/metrics/catalog-policy.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { MetricNames, MetricService } from "./metric-catalog.generated.js";
 //#region src/metrics/catalog-policy.ts
 /**
@@ -138,7 +138,11 @@ const METRIC_LABEL_POLICY = {
 		machinePool: { maxUniqueValues: 50 }
 	},
 	kici_orch_install_secrets_decisions_total: {
-		decision: { values: ["pass", "reject"] },
+		decision: { values: [
+			"pass",
+			"reject",
+			"hold"
+		] },
 		reason: { values: [
 			"ok",
 			"malformed_ref",
@@ -148,7 +152,8 @@ const METRIC_LABEL_POLICY = {
 			"env_not_found",
 			"protection_rule_block",
 			"missing_token",
-			"missing_install_env"
+			"missing_install_env",
+			"held"
 		] }
 	},
 	kici_orch_install_secrets_npm_registry_used_total: {

package/dist/metrics/metric-catalog.generated.d.ts

@@ -431,7 +431,7 @@ export declare const MetricDescription: {
     readonly KICI_ORCH_EXECUTIONS_TOTAL: "Total number of execution runs";
     readonly KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: "Total number of GitHub check run API calls";
     readonly KICI_ORCH_INSTALL_SECRETS_CONTRIBUTOR_STRIPPED_TOTAL: "Dispatches where registry tokens were stripped because the contributor tier was not `trusted`";
-    readonly KICI_ORCH_INSTALL_SECRETS_DECISIONS_TOTAL: "Total install-secrets resolution decisions (pass / reject + reason)";
+    readonly KICI_ORCH_INSTALL_SECRETS_DECISIONS_TOTAL: "Total install-secrets resolution decisions (pass / reject / hold + reason)";
     readonly KICI_ORCH_INSTALL_SECRETS_NPM_REGISTRY_USED_TOTAL: "Total registry / installEnv entries successfully resolved per channel / provider / scope";
     readonly KICI_ORCH_INSTALL_SECRETS_TOKEN_RESOLUTION_DURATION_SECONDS: "Duration of per-environment secret resolution during install-secrets evaluation";
     readonly KICI_ORCH_JOB_CONSECUTIVE_FAILURES: "Consecutive failures for each scheduled job since its last success";

package/dist/metrics/metric-catalog.generated.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/metrics/metric-catalog.generated.ts
 const MetricNames = {
 	KICI_AGENT_CLONE_DURATION_SECONDS: "kici_agent_clone_duration_seconds",
@@ -440,7 +440,7 @@ const MetricDescription = {
 	KICI_ORCH_EXECUTIONS_TOTAL: "Total number of execution runs",
 	KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: "Total number of GitHub check run API calls",
 	KICI_ORCH_INSTALL_SECRETS_CONTRIBUTOR_STRIPPED_TOTAL: "Dispatches where registry tokens were stripped because the contributor tier was not `trusted`",
-	KICI_ORCH_INSTALL_SECRETS_DECISIONS_TOTAL: "Total install-secrets resolution decisions (pass / reject + reason)",
+	KICI_ORCH_INSTALL_SECRETS_DECISIONS_TOTAL: "Total install-secrets resolution decisions (pass / reject / hold + reason)",
 	KICI_ORCH_INSTALL_SECRETS_NPM_REGISTRY_USED_TOTAL: "Total registry / installEnv entries successfully resolved per channel / provider / scope",
 	KICI_ORCH_INSTALL_SECRETS_TOKEN_RESOLUTION_DURATION_SECONDS: "Duration of per-environment secret resolution during install-secrets evaluation",
 	KICI_ORCH_JOB_CONSECUTIVE_FAILURES: "Consecutive failures for each scheduled job since its last success",

package/dist/protocol/analytics-events.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/protocol/analytics-events.ts
 const AnalyticsEvent = z.enum([

package/dist/protocol/cluster-name.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/protocol/cluster-name.ts
 /**

package/dist/protocol/dashboard-global-workflows.js

@@ -1,3 +1,3 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { globalWorkflowSettingsSchema, globalWorkflowsGetRequestSchema, globalWorkflowsGetResponseSchema, globalWorkflowsUpdateRequestSchema, globalWorkflowsUpdateResponseSchema, repoPatternEntrySchema } from "./messages/dashboard-global-workflows.js";
 export { globalWorkflowSettingsSchema, globalWorkflowsGetRequestSchema, globalWorkflowsGetResponseSchema, globalWorkflowsUpdateRequestSchema, globalWorkflowsUpdateResponseSchema, repoPatternEntrySchema };