@kici-dev/engine 0.1.16 → 0.1.18

package/dist/approval/types.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/approval/types.ts
 /**

package/dist/audit/access-log-policy.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/audit/access-log-policy.ts
 /**
@@ -58,6 +58,7 @@ const POLICY_BY_ACTION = {
 		kind: "sample",
 		allowedRate: .1
 	},
+	"attestations.read": { kind: "always" },
 	"event_log.list.read": {
 		kind: "sample",
 		allowedRate: .05
@@ -114,6 +115,7 @@ const POLICY_BY_ACTION = {
 	"run.cancel": { kind: "always" },
 	"run.rerun": { kind: "always" },
 	"run.manual_schedule": { kind: "always" },
+	"run.trigger": { kind: "always" },
 	"job.cancel": { kind: "always" },
 	"event_log.detail.read": { kind: "always" },
 	"event_log.payload.read": { kind: "always" },

package/dist/audit/activity.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { ActorType } from "../protocol/messages/actor.js";
 import { AccessLogOutcome } from "../protocol/messages/access-log.js";
 import { z } from "zod";

package/dist/audit/retention-policy.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/audit/retention-policy.ts
 /**
 * Warm-retention days per `AccessLogAction`. Exhaustive over the enum so a
@@ -18,6 +18,7 @@ const ACCESS_LOG_WARM_DAYS = {
 	"sources.list.read": 30,
 	"run.orch_logs.read": 30,
 	"step.logs.read": 30,
+	"attestations.read": 30,
 	"event_log.list.read": 30,
 	"environment.list.read": 30,
 	"environment.get.read": 30,
@@ -41,6 +42,7 @@ const ACCESS_LOG_WARM_DAYS = {
 	"run.cancel": 180,
 	"run.rerun": 180,
 	"run.manual_schedule": 180,
+	"run.trigger": 180,
 	"job.cancel": 180,
 	"environment.create": 180,
 	"environment.update": 180,
@@ -254,6 +256,7 @@ const ACCESS_LOG_COLD_DAYS = {
 	"sources.list.read": 180,
 	"run.orch_logs.read": 180,
 	"step.logs.read": 180,
+	"attestations.read": 180,
 	"event_log.list.read": 180,
 	"environment.list.read": 180,
 	"environment.get.read": 180,
@@ -277,6 +280,7 @@ const ACCESS_LOG_COLD_DAYS = {
 	"run.cancel": 730,
 	"run.rerun": 730,
 	"run.manual_schedule": 730,
+	"run.trigger": 730,
 	"job.cancel": 730,
 	"environment.create": 730,
 	"environment.update": 730,

package/dist/bundler/index.js

@@ -1,3 +1,3 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { createWorkflowBundleConfig } from "./rolldown-config.js";
 export { createWorkflowBundleConfig };

package/dist/bundler/rolldown-config.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/bundler/rolldown-config.ts
 /**
 * Create a rolldown configuration for workflow bundling.

package/dist/env/environment-allowlist.d.ts

@@ -15,7 +15,7 @@
  * This is an explicit allowlist -- anything NOT listed here is stripped.
  * Adding new variables to the host process will NOT leak them downstream.
  */
-export declare const ALLOWED_SYSTEM_VARS: readonly ["PATH", "HOME", "USER", "SHELL", "LANG", "LC_ALL", "TERM", "TMPDIR", "NODE_PATH", "TZ"];
+export declare const ALLOWED_SYSTEM_VARS: readonly ["PATH", "HOME", "USER", "SHELL", "LANG", "LC_ALL", "TERM", "TMPDIR", "NODE_PATH", "TZ", "PATHEXT", "SystemRoot", "windir", "COMSPEC", "TEMP", "TMP", "USERPROFILE", "LOCALAPPDATA", "APPDATA", "PROCESSOR_ARCHITECTURE", "NUMBER_OF_PROCESSORS"];
 /**
  * Default environment variables injected into every sandbox execution.
  *

package/dist/env/environment-allowlist.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/env/environment-allowlist.ts
 /**
 * Shared environment allowlist constants for KiCI.
@@ -27,7 +27,18 @@ const ALLOWED_SYSTEM_VARS = [
 	"TERM",
 	"TMPDIR",
 	"NODE_PATH",
-	"TZ"
+	"TZ",
+	"PATHEXT",
+	"SystemRoot",
+	"windir",
+	"COMSPEC",
+	"TEMP",
+	"TMP",
+	"USERPROFILE",
+	"LOCALAPPDATA",
+	"APPDATA",
+	"PROCESSOR_ARCHITECTURE",
+	"NUMBER_OF_PROCESSORS"
 ];
 /**
 * Default environment variables injected into every sandbox execution.

package/dist/environment/index.js

@@ -1,3 +1,3 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix } from "./scope-resolver.js";
 export { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix };

package/dist/environment/scope-resolver.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import picomatch from "picomatch";
 //#region src/environment/scope-resolver.ts
 /**

package/dist/environment/types.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/fanout/materialize.d.ts

@@ -0,0 +1,123 @@
+import { type MatrixValues } from '../matrix/expand.js';
+import type { LockJob } from '../trigger/types.js';
+/** Hard cap on children per fanned job — mirrors the compiler's MAX_STATIC_MATRIX_JOBS. */
+export declare const MAX_FANOUT_JOBS = 256;
+/**
+ * The kind of fan-out a materialized child belongs to. `matrix` children come
+ * from a matrix expansion (one per combination); `host` children come from a
+ * `runsOnAll` fan-out (one pinned execution per roster host).
+ */
+export declare enum VariantKind {
+    matrix = "matrix",
+    host = "host"
+}
+/**
+ * Thrown when a job's matrix cannot be materialized into dispatchable children:
+ * zero combinations after exclude, or more combinations than {@link MAX_FANOUT_JOBS}.
+ * Callers map this onto the `matrix_expansion` init-failure category.
+ */
+export declare class FanoutError extends Error {
+    readonly jobName: string;
+    readonly name = "FanoutError";
+    constructor(jobName: string, message: string);
+}
+/**
+ * A roster host resolved as a target of a `runsOnAll` fan-out. Carries the
+ * identity the dispatcher pins to and the agent facts exposed as `ctx.agent`.
+ */
+export interface ResolvedHostAgent {
+    /** Agent id the child pins to. */
+    agentId: string;
+    /** Hostname (falls back to agentId). */
+    host: string;
+    /** The host's label set. */
+    labels: readonly string[];
+    platform?: string;
+    arch?: string;
+    /** Which orchestrator owns the live WS (null = not currently connected). */
+    connectedInstanceId?: string | null;
+}
+/**
+ * One dispatchable unit produced from a lock job. `variantKind` is `matrix` for
+ * a matrix combination child and `host` for a `runsOnAll` per-host child; absent
+ * for a non-fanned job.
+ */
+export interface MaterializedJob {
+    /** The originating lock job. Its matrix/include/exclude are NOT dispatched as-is. */
+    lockJob: LockJob;
+    /** The lock job's name (the consumer-facing job identity). */
+    baseName: string;
+    /** `${baseName} (${suffix})` for fanned children, else `baseName`. */
+    expandedName: string;
+    /** Present only for fanned children. */
+    variantKind?: VariantKind;
+    /** The combination values for a matrix child; absent for non-matrix jobs. */
+    variantValues?: MatrixValues;
+    /**
+     * True when the job carries a dynamic matrix the orchestrator cannot expand —
+     * it must route through the agent-eval flow and be re-materialized from the result.
+     */
+    pendingDynamicMatrix?: boolean;
+    /** The agent this child is pinned to. */
+    pinnedAgentId?: string;
+    /** The host this child runs on (also the variant label / name suffix). */
+    host?: string;
+    /** The resolved host agent facts, exposed to the step as `ctx.agent`. */
+    agent?: ResolvedHostAgent;
+    /** Which orchestrator owns the pinned agent's live WS (null = not connected). */
+    connectedInstanceId?: string | null;
+}
+export interface FanoutResult {
+    jobs: MaterializedJob[];
+    /** baseName → expandedNames (length 1 for non-fanned jobs). Drives needs-edge expansion. */
+    expansionMap: Map<string, string[]>;
+}
+/**
+ * The job-config envelope fields that identify a materialized child: the
+ * expanded `name`, the `baseJobName` (what the agent exposes as `ctx.job.name`),
+ * and `matrixValues` (exposed as `ctx.matrix`). Every dispatch site spreads
+ * these into its job config so the envelopes stay identical. The raw
+ * matrix/include/exclude are intentionally NOT included — they are consumed at
+ * dispatch time, not shipped to the agent.
+ */
+export declare function matrixEnvelopeFields(mat: MaterializedJob): {
+    name: string;
+    baseJobName: string;
+    matrixValues?: MatrixValues;
+};
+/**
+ * Build materialized children from a resolved dynamic-matrix combination list
+ * (produced by the agent eval flow). Mirrors the static-matrix branch of
+ * {@link materializeFanout} but takes the already-resolved combinations and
+ * enforces the same cap / zero-combination guards.
+ */
+export declare function materializeResolvedMatrix(lockJob: LockJob, combos: readonly MatrixValues[]): FanoutResult;
+/**
+ * The job-config envelope fields that identify a materialized host child: the
+ * expanded `name`, the `baseJobName`, the `pinnedAgentId`, the `host` (exposed as
+ * `ctx.host` and persisted as `variant_label`), and the resolved `agent` facts
+ * (exposed as `ctx.agent`). The matrix sibling is {@link matrixEnvelopeFields}.
+ */
+export declare function hostEnvelopeFields(mat: MaterializedJob): {
+    name: string;
+    baseJobName: string;
+    pinnedAgentId?: string;
+    host?: string;
+    agent?: ResolvedHostAgent;
+    connectedInstanceId?: string | null;
+};
+/**
+ * Build materialized host children from a resolved target-host list (produced by
+ * the roster-backed resolution branch at dispatch time). Emits one pinned child
+ * per host, sibling to {@link materializeResolvedMatrix}. `maxHosts` is the
+ * orchestrator `maxFanoutHosts` config (default 1024) — NOT {@link MAX_FANOUT_JOBS}
+ * (the 256 matrix cap is GitHub-Actions author-error parity, irrelevant to fleet size).
+ */
+export declare function materializeResolvedHosts(lockJob: LockJob, agents: readonly ResolvedHostAgent[], maxHosts: number): FanoutResult;
+/**
+ * Expand each lock job's static matrix into N dispatchable children (one per
+ * combination), passing non-matrix and dynamic-matrix jobs through 1:1.
+ * Dynamic-matrix jobs are flagged `pendingDynamicMatrix` for the eval flow.
+ */
+export declare function materializeFanout(staticJobs: readonly LockJob[]): FanoutResult;
+//# sourceMappingURL=materialize.d.ts.map

package/dist/fanout/materialize.js

@@ -0,0 +1,176 @@
+import "../chunk-BTugEXQM.js";
+import { applyIncludeExclude, expandMatrix } from "../matrix/expand.js";
+import { formatExpandedJobName } from "../matrix/format.js";
+//#region src/fanout/materialize.ts
+/** Hard cap on children per fanned job — mirrors the compiler's MAX_STATIC_MATRIX_JOBS. */
+const MAX_FANOUT_JOBS = 256;
+/**
+* The kind of fan-out a materialized child belongs to. `matrix` children come
+* from a matrix expansion (one per combination); `host` children come from a
+* `runsOnAll` fan-out (one pinned execution per roster host).
+*/
+let VariantKind = /* @__PURE__ */ function(VariantKind) {
+	VariantKind["matrix"] = "matrix";
+	VariantKind["host"] = "host";
+	return VariantKind;
+}({});
+/**
+* Thrown when a job's matrix cannot be materialized into dispatchable children:
+* zero combinations after exclude, or more combinations than {@link MAX_FANOUT_JOBS}.
+* Callers map this onto the `matrix_expansion` init-failure category.
+*/
+var FanoutError = class FanoutError extends Error {
+	jobName;
+	name = "FanoutError";
+	constructor(jobName, message) {
+		super(message);
+		this.jobName = jobName;
+		Object.setPrototypeOf(this, FanoutError.prototype);
+	}
+};
+/**
+* The job-config envelope fields that identify a materialized child: the
+* expanded `name`, the `baseJobName` (what the agent exposes as `ctx.job.name`),
+* and `matrixValues` (exposed as `ctx.matrix`). Every dispatch site spreads
+* these into its job config so the envelopes stay identical. The raw
+* matrix/include/exclude are intentionally NOT included — they are consumed at
+* dispatch time, not shipped to the agent.
+*/
+function matrixEnvelopeFields(mat) {
+	return {
+		name: mat.expandedName,
+		baseJobName: mat.baseName,
+		...mat.variantValues && { matrixValues: mat.variantValues }
+	};
+}
+/**
+* Build materialized children from a resolved dynamic-matrix combination list
+* (produced by the agent eval flow). Mirrors the static-matrix branch of
+* {@link materializeFanout} but takes the already-resolved combinations and
+* enforces the same cap / zero-combination guards.
+*/
+function materializeResolvedMatrix(lockJob, combos) {
+	if (combos.length === 0) throw new FanoutError(lockJob.name, `dynamic matrix for job '${lockJob.name}' resolved to zero combinations`);
+	if (combos.length > 256) throw new FanoutError(lockJob.name, `dynamic matrix for job '${lockJob.name}' resolved to ${combos.length} combinations (max 256)`);
+	const jobs = [];
+	const names = [];
+	for (const variantValues of combos) {
+		const expandedName = formatExpandedJobName(lockJob.name, variantValues);
+		names.push(expandedName);
+		jobs.push({
+			lockJob,
+			baseName: lockJob.name,
+			expandedName,
+			variantKind: "matrix",
+			variantValues
+		});
+	}
+	return {
+		jobs,
+		expansionMap: new Map([[lockJob.name, names]])
+	};
+}
+/**
+* The job-config envelope fields that identify a materialized host child: the
+* expanded `name`, the `baseJobName`, the `pinnedAgentId`, the `host` (exposed as
+* `ctx.host` and persisted as `variant_label`), and the resolved `agent` facts
+* (exposed as `ctx.agent`). The matrix sibling is {@link matrixEnvelopeFields}.
+*/
+function hostEnvelopeFields(mat) {
+	return {
+		name: mat.expandedName,
+		baseJobName: mat.baseName,
+		...mat.pinnedAgentId && { pinnedAgentId: mat.pinnedAgentId },
+		...mat.host && { host: mat.host },
+		...mat.agent && { agent: mat.agent },
+		...mat.connectedInstanceId !== void 0 && { connectedInstanceId: mat.connectedInstanceId }
+	};
+}
+/**
+* Build materialized host children from a resolved target-host list (produced by
+* the roster-backed resolution branch at dispatch time). Emits one pinned child
+* per host, sibling to {@link materializeResolvedMatrix}. `maxHosts` is the
+* orchestrator `maxFanoutHosts` config (default 1024) — NOT {@link MAX_FANOUT_JOBS}
+* (the 256 matrix cap is GitHub-Actions author-error parity, irrelevant to fleet size).
+*/
+function materializeResolvedHosts(lockJob, agents, maxHosts) {
+	if (agents.length === 0) throw new FanoutError(lockJob.name, `runsOnAll for job '${lockJob.name}' matched zero matching hosts`);
+	if (agents.length > maxHosts) throw new FanoutError(lockJob.name, `runsOnAll for job '${lockJob.name}' matched ${agents.length} hosts (max ${maxHosts})`);
+	const jobs = [];
+	const names = [];
+	for (const agent of agents) {
+		const expandedName = `${lockJob.name} (${agent.host})`;
+		names.push(expandedName);
+		jobs.push({
+			lockJob,
+			baseName: lockJob.name,
+			expandedName,
+			variantKind: "host",
+			pinnedAgentId: agent.agentId,
+			host: agent.host,
+			agent,
+			connectedInstanceId: agent.connectedInstanceId ?? null
+		});
+	}
+	return {
+		jobs,
+		expansionMap: new Map([[lockJob.name, names]])
+	};
+}
+/**
+* Expand each lock job's static matrix into N dispatchable children (one per
+* combination), passing non-matrix and dynamic-matrix jobs through 1:1.
+* Dynamic-matrix jobs are flagged `pendingDynamicMatrix` for the eval flow.
+*/
+function materializeFanout(staticJobs) {
+	const jobs = [];
+	const expansionMap = /* @__PURE__ */ new Map();
+	for (const lockJob of staticJobs) {
+		const matrix = lockJob.matrix;
+		if (!matrix) {
+			jobs.push({
+				lockJob,
+				baseName: lockJob.name,
+				expandedName: lockJob.name
+			});
+			expansionMap.set(lockJob.name, [lockJob.name]);
+			continue;
+		}
+		if (matrix._type === "dynamic") {
+			jobs.push({
+				lockJob,
+				baseName: lockJob.name,
+				expandedName: lockJob.name,
+				pendingDynamicMatrix: true
+			});
+			expansionMap.set(lockJob.name, [lockJob.name]);
+			continue;
+		}
+		const values = matrix.values;
+		if (!values) throw new FanoutError(lockJob.name, `static matrix for job '${lockJob.name}' has no values`);
+		const combos = applyIncludeExclude(expandMatrix(values), lockJob.include, lockJob.exclude);
+		if (combos.length === 0) throw new FanoutError(lockJob.name, `matrix for job '${lockJob.name}' expands to zero combinations`);
+		if (combos.length > 256) throw new FanoutError(lockJob.name, `matrix for job '${lockJob.name}' expands to ${combos.length} combinations (max 256)`);
+		const names = [];
+		for (const variantValues of combos) {
+			const expandedName = formatExpandedJobName(lockJob.name, variantValues);
+			names.push(expandedName);
+			jobs.push({
+				lockJob,
+				baseName: lockJob.name,
+				expandedName,
+				variantKind: "matrix",
+				variantValues
+			});
+		}
+		expansionMap.set(lockJob.name, names);
+	}
+	return {
+		jobs,
+		expansionMap
+	};
+}
+//#endregion
+export { FanoutError, MAX_FANOUT_JOBS, VariantKind, hostEnvelopeFields, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields };
+
+//# sourceMappingURL=materialize.js.map

package/dist/index.d.ts

@@ -31,8 +31,6 @@ export { sourceRegistrationSchema, sourceRegistrationAckSchema, sourceDeregister
 export * from './protocol/messages/join.js';
 export * from './protocol/messages/peer.js';
 export * from './protocol/messages/orchestrator-agent.js';
-export * from './protocol/messages/test-run.js';
-export * from './protocol/messages/observe.js';
 export * from './trigger/types.js';
 export * from './trigger/trigger-event-type.js';
 export * from './trigger/decision-trace.js';
@@ -49,8 +47,12 @@ export * from './environment/index.js';
 export { deriveOsArchLabels, hostLabel, parseHostLabel, HOST_LABEL_PREFIX, agentTypeLabel, scalerLabel, mergeAutoLabels, normalizeRunsOn, KNOWN_ROLES, resolveRoleLabels, validateNoReservedLabels, scalerAgentLabels, isSelfReportedLabel, SELF_REPORTED_LABEL_PREFIXES, } from './labels.js';
 export type { NormalizedRunsOn } from './labels.js';
 export type { AgentRole } from './labels.js';
+export { LabelMatcher, matcherMatches, matcherSatisfiedBy, partitionMatchers, compileRegexMatcher, } from './labels-match.js';
 export * from './scaler/scaler-backend-type.js';
 export * from './scaler/resource-types.js';
 export * from './registration/registerable-trigger-type.js';
 export * from './bundler/index.js';
+export { expandSingleDimension, expandMultiDimension, expandMatrix, applyIncludeExclude, type StaticMatrixArray, type StaticMatrixObject, type MatrixInclude, type MatrixExclude, type MatrixValues, } from './matrix/expand.js';
+export { formatMatrixSuffix, formatExpandedJobName } from './matrix/format.js';
+export * from './fanout/materialize.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { MIN_PROTOCOL_VERSION, PROTOCOL_VERSION } from "./protocol/version.js";
 import { WS_MAX_PAYLOAD_BYTES, ackSchema, errorSchema, heartbeatSchema, nackSchema } from "./protocol/messages/common.js";
 import { ActorType, actorPrincipalSchema, apiKeyActorSchema, flattenActor, parseActor, platformOperatorActorSchema, serviceAccountActorSchema, stringifyActor, systemActorSchema, userActorSchema } from "./protocol/messages/actor.js";
@@ -11,7 +11,8 @@ import { browserJobContextSchema, browserRunEventSchema, dashboardOrchLogsReques
 import { EventLogSource, EventLogStatus, PayloadOmittedReason } from "./protocol/messages/event-log.js";
 import { ScalerBackendType } from "./scaler/scaler-backend-type.js";
 import { ApprovalDecision, HoldScope, TriggerSource, approvalRequirementSchema, approverClauseSchema } from "./approval/types.js";
-import { EnvDeleteErrorCode, EventLogPayloadStreamError, HeldRunQueueType, HeldRunStatus, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runRerunRequestSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
+import { IfFailedPolicy, NeedsEntrySchema, NeedsGroupEntrySchema, OnUnreachableMode, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob } from "./trigger/types.js";
+import { EnvDeleteErrorCode, EventLogPayloadStreamError, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListItemSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
 import { WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, cacheStatsSchema, executionEventSchema, logChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema } from "./protocol/messages/platform-orchestrator.js";
 import { ScalerEventType } from "./protocol/messages/scaler-event.js";
 import { AccessLogPolicyKind, POLICY_BY_ACTION, fnv1a32, shouldRecordAccess, shouldRecordSecretResolve } from "./audit/access-log-policy.js";
@@ -21,11 +22,9 @@ import { logPullOrchToPlatformSchema, logPullPlatformToOrchSchema } from "./prot
 import { EVENT_LOG_PAYLOAD_CHUNK_BYTES } from "./protocol/event-log-payload.js";
 import { browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, platformToBrowserMessageSchema } from "./protocol/messages/browser.js";
 import { joinRequestSchema, joinResponseSchema } from "./protocol/messages/join.js";
+import { LabelMatcher, compileRegexMatcher, matcherMatches, matcherSatisfiedBy, partitionMatchers } from "./labels-match.js";
 import { fleetSelectionSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema } from "./protocol/messages/peer.js";
-import { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, registerAckSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema } from "./protocol/messages/orchestrator-agent.js";
-import { testCancelResponseSchema, testCancelSchema, testEventSchema, testTriggerResponseSchema, testTriggerSchema } from "./protocol/messages/test-run.js";
-import { observeCompleteSchema, observeLogSchema, observeStatusSchema, observeStepSchema, observeSubscribeSchema } from "./protocol/messages/observe.js";
-import { NeedsEntrySchema, NeedsGroupEntrySchema, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob } from "./trigger/types.js";
+import { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema } from "./protocol/messages/orchestrator-agent.js";
 import { TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES } from "./trigger/trigger-event-type.js";
 import { createTraceEntry, createWorkflowDecision } from "./trigger/decision-trace.js";
 import { matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchWorkflowTriggers } from "./trigger/matcher.js";
@@ -45,4 +44,7 @@ import { parseMemoryString, resourceRequestNestedSchema, resourceSpecSchema, val
 import { RegisterableTriggerType } from "./registration/registerable-trigger-type.js";
 import { createWorkflowBundleConfig } from "./bundler/rolldown-config.js";
 import "./bundler/index.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, ApprovalDecision, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckRunConclusion, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, InitFailureCategory, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LockFileParseError, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, ORCH_CAPABILITIES, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, StepApprovalOutcome, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TimeoutReason, TriggerSource, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, approvalRequirementSchema, approverClauseSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, fleetSelectionSchema, fnv1a32, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostLabel, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, observeCompleteSchema, observeLogSchema, observeStatusSchema, observeStepSchema, observeSubscribeSchema, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseMemoryString, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testCancelResponseSchema, testCancelSchema, testEventSchema, testTriggerResponseSchema, testTriggerSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };
+import { applyIncludeExclude, expandMatrix, expandMultiDimension, expandSingleDimension } from "./matrix/expand.js";
+import { formatExpandedJobName, formatMatrixSuffix } from "./matrix/format.js";
+import { FanoutError, MAX_FANOUT_JOBS, VariantKind, hostEnvelopeFields, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields } from "./fanout/materialize.js";
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, ApprovalDecision, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckRunConclusion, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutError, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, IfFailedPolicy, InitFailureCategory, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, MAX_FANOUT_JOBS, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, ORCH_CAPABILITIES, OnUnreachableMode, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, StepApprovalOutcome, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TestRelayType, TimeoutReason, TriggerSource, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approverClauseSchema, attestationListItemSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, compileRegexMatcher, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };

package/dist/labels/compile.d.ts

@@ -0,0 +1,40 @@
+import type { LabelMatcher } from '../labels-match.js';
+/**
+ * Reject a ReDoS-prone regex. `safe-regex` is a star-height heuristic — the
+ * orchestrator is single-tenant, so a slipped-through pattern only stalls the
+ * author's own orchestrator. Globs are linear by construction but pass through
+ * here for uniformity.
+ */
+export declare function assertSafeRegex(source: string, flags: string, ctx: string): void;
+/**
+ * Convert one author selector element into a `LabelMatcher`.
+ * - `RegExp` → regex matcher (source + flags captured verbatim).
+ * - string that picomatch detects as a glob → regex via `picomatch.makeRe`.
+ * - any other string → exact.
+ * `ctx` is a human label (e.g. "job 'web' runsOn") used in ReDoS errors.
+ */
+export declare function toLabelMatcher(el: string | RegExp, ctx: string): LabelMatcher;
+export type SelectorEl = string | RegExp;
+export type RunsOnAuthorInput = SelectorEl | readonly SelectorEl[] | {
+    labels: SelectorEl | readonly SelectorEl[];
+    exclude?: SelectorEl | readonly SelectorEl[];
+};
+export type RunsOnAllAuthorInput = string | RegExp | readonly SelectorEl[] | {
+    include: readonly {
+        all: readonly SelectorEl[];
+    }[];
+    exclude?: readonly SelectorEl[];
+};
+/** Normalize a `runsOn` author value into include + exclude matchers. */
+export declare function normalizeRunsOnToMatchers(runsOn: RunsOnAuthorInput, ctx: string): {
+    include: LabelMatcher[];
+    exclude: LabelMatcher[];
+};
+/** Normalize a `runsOnAll` author value into include groups + exclude matchers. */
+export declare function normalizeRunsOnAllToMatchers(input: RunsOnAllAuthorInput, ctx: string): {
+    include: LabelMatcher[][];
+    exclude: LabelMatcher[];
+};
+/** Re-validate every regex matcher in a parsed lock selector (orchestrator lock-load). */
+export declare function assertMatchersSafe(matchers: readonly LabelMatcher[], ctx: string): void;
+//# sourceMappingURL=compile.d.ts.map