@kici-dev/engine 0.1.16 → 0.1.18

package/dist/labels/compile.js

@@ -0,0 +1,91 @@
+import "../chunk-BTugEXQM.js";
+import picomatch from "picomatch";
+import safeRegex from "safe-regex";
+//#region src/labels/compile.ts
+/**
+* Reject a ReDoS-prone regex. `safe-regex` is a star-height heuristic — the
+* orchestrator is single-tenant, so a slipped-through pattern only stalls the
+* author's own orchestrator. Globs are linear by construction but pass through
+* here for uniformity.
+*/
+function assertSafeRegex(source, flags, ctx) {
+	if (!safeRegex(new RegExp(source, flags))) throw new Error(`${ctx}: regex /${source}/${flags} is ReDoS-prone — rejected`);
+}
+/**
+* Convert one author selector element into a `LabelMatcher`.
+* - `RegExp` → regex matcher (source + flags captured verbatim).
+* - string that picomatch detects as a glob → regex via `picomatch.makeRe`.
+* - any other string → exact.
+* `ctx` is a human label (e.g. "job 'web' runsOn") used in ReDoS errors.
+*/
+function toLabelMatcher(el, ctx) {
+	if (el instanceof RegExp) {
+		assertSafeRegex(el.source, el.flags, ctx);
+		return {
+			kind: "regex",
+			source: el.source,
+			flags: el.flags
+		};
+	}
+	if (picomatch.scan(el).isGlob) {
+		const re = picomatch.makeRe(el);
+		if (!(re instanceof RegExp)) throw new Error(`${ctx}: glob '${el}' is not a valid pattern`);
+		assertSafeRegex(re.source, re.flags, ctx);
+		return {
+			kind: "regex",
+			source: re.source,
+			flags: re.flags
+		};
+	}
+	return {
+		kind: "exact",
+		value: el
+	};
+}
+const asArray = (v) => Array.isArray(v) ? v : [v];
+/** Normalize a `runsOn` author value into include + exclude matchers. */
+function normalizeRunsOnToMatchers(runsOn, ctx) {
+	if (typeof runsOn === "string" || runsOn instanceof RegExp) return {
+		include: [toLabelMatcher(runsOn, ctx)],
+		exclude: []
+	};
+	if (Array.isArray(runsOn)) return {
+		include: runsOn.map((e) => toLabelMatcher(e, ctx)),
+		exclude: []
+	};
+	const sel = runsOn;
+	return {
+		include: asArray(sel.labels).map((e) => toLabelMatcher(e, ctx)),
+		exclude: sel.exclude ? asArray(sel.exclude).map((e) => toLabelMatcher(e, ctx)) : []
+	};
+}
+/** Normalize a `runsOnAll` author value into include groups + exclude matchers. */
+function normalizeRunsOnAllToMatchers(input, ctx) {
+	if (typeof input === "string" || input instanceof RegExp) return {
+		include: [[toLabelMatcher(input, ctx)]],
+		exclude: []
+	};
+	if (Array.isArray(input)) {
+		const include = [];
+		const exclude = [];
+		for (const entry of input) if (typeof entry === "string" && entry.startsWith("!")) exclude.push(toLabelMatcher(entry.slice(1), ctx));
+		else include.push(toLabelMatcher(entry, ctx));
+		return {
+			include: include.length ? [include] : [],
+			exclude
+		};
+	}
+	const obj = input;
+	return {
+		include: obj.include.map((g) => g.all.map((e) => toLabelMatcher(e, ctx))),
+		exclude: (obj.exclude ?? []).map((e) => toLabelMatcher(e, ctx))
+	};
+}
+/** Re-validate every regex matcher in a parsed lock selector (orchestrator lock-load). */
+function assertMatchersSafe(matchers, ctx) {
+	for (const m of matchers) if (m.kind === "regex") assertSafeRegex(m.source, m.flags, ctx);
+}
+//#endregion
+export { assertMatchersSafe, assertSafeRegex, normalizeRunsOnAllToMatchers, normalizeRunsOnToMatchers, toLabelMatcher };
+
+//# sourceMappingURL=compile.js.map

package/dist/labels-match.d.ts

@@ -0,0 +1,32 @@
+import { z } from 'zod';
+/**
+ * A single label selector element after compilation. Globs are converted to
+ * regex at compile time, so the lock file only ever carries `exact` or `regex`.
+ * This module is browser-safe (pure `RegExp`, zod only) and lives in the engine
+ * barrel; glob conversion and the ReDoS gate live in the Node-only
+ * `@kici-dev/engine/labels/compile` subpath.
+ */
+export declare const LabelMatcher: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"exact">;
+    value: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"regex">;
+    source: z.ZodString;
+    flags: z.ZodString;
+}, z.core.$strip>], "kind">;
+export type LabelMatcher = z.infer<typeof LabelMatcher>;
+/** Compile (and cache) the `RegExp` for a regex matcher. */
+export declare function compileRegexMatcher(m: {
+    source: string;
+    flags: string;
+}): RegExp;
+/** Whether a single label string satisfies the matcher. */
+export declare function matcherMatches(m: LabelMatcher, label: string): boolean;
+/** Whether some label in the set satisfies the matcher. */
+export declare function matcherSatisfiedBy(m: LabelMatcher, labels: ReadonlySet<string>): boolean;
+/** Split a matcher list into exact label strings and the remaining regex matchers. */
+export declare function partitionMatchers(ms: readonly LabelMatcher[]): {
+    exact: string[];
+    regex: LabelMatcher[];
+};
+//# sourceMappingURL=labels-match.d.ts.map

package/dist/labels-match.js

@@ -0,0 +1,55 @@
+import "./chunk-BTugEXQM.js";
+import { z } from "zod";
+//#region src/labels-match.ts
+/**
+* A single label selector element after compilation. Globs are converted to
+* regex at compile time, so the lock file only ever carries `exact` or `regex`.
+* This module is browser-safe (pure `RegExp`, zod only) and lives in the engine
+* barrel; glob conversion and the ReDoS gate live in the Node-only
+* `@kici-dev/engine/labels/compile` subpath.
+*/
+const LabelMatcher = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("exact"),
+	value: z.string()
+}), z.object({
+	kind: z.literal("regex"),
+	source: z.string(),
+	flags: z.string()
+})]);
+const regexCache = /* @__PURE__ */ new Map();
+/** Compile (and cache) the `RegExp` for a regex matcher. */
+function compileRegexMatcher(m) {
+	const key = `${m.flags} ${m.source}`;
+	let re = regexCache.get(key);
+	if (!re) {
+		re = new RegExp(m.source, m.flags);
+		regexCache.set(key, re);
+	}
+	return re;
+}
+/** Whether a single label string satisfies the matcher. */
+function matcherMatches(m, label) {
+	return m.kind === "exact" ? label === m.value : compileRegexMatcher(m).test(label);
+}
+/** Whether some label in the set satisfies the matcher. */
+function matcherSatisfiedBy(m, labels) {
+	if (m.kind === "exact") return labels.has(m.value);
+	const re = compileRegexMatcher(m);
+	for (const label of labels) if (re.test(label)) return true;
+	return false;
+}
+/** Split a matcher list into exact label strings and the remaining regex matchers. */
+function partitionMatchers(ms) {
+	const exact = [];
+	const regex = [];
+	for (const m of ms) if (m.kind === "exact") exact.push(m.value);
+	else regex.push(m);
+	return {
+		exact,
+		regex
+	};
+}
+//#endregion
+export { LabelMatcher, compileRegexMatcher, matcherMatches, matcherSatisfiedBy, partitionMatchers };
+
+//# sourceMappingURL=labels-match.js.map

package/dist/labels.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 //#region src/labels.ts
 /**
 * Structured auto-labels with category prefixes.

package/dist/matrix/expand.d.ts

@@ -0,0 +1,48 @@
+/** Single-dimension static matrix: array of values */
+export type StaticMatrixArray = string[];
+/** Multi-dimensional static matrix: named dimensions with values */
+export type StaticMatrixObject = Record<string, string[]>;
+/** Include entries for adding specific matrix combinations */
+export type MatrixInclude = Record<string, string>;
+/** Exclude entries for removing specific matrix combinations */
+export type MatrixExclude = Record<string, string>;
+/**
+ * Matrix values as exposed to steps.
+ * Single-dimension: {value: 'linux'}
+ * Multi-dimensional: {os: 'linux', node: '18'}
+ */
+export interface MatrixValues {
+    /** Single-dimension: the value */
+    value?: string;
+    /** Multi-dimensional: named properties */
+    [dimension: string]: string | undefined;
+}
+/**
+ * Compute the cartesian product of the given value sets in row-major order.
+ * An empty set list yields a single empty tuple; any empty set yields no tuples.
+ */
+export declare function cartesianProduct<T>(sets: T[][]): T[][];
+/**
+ * Expand single-dimension matrix (array form) to MatrixValues array.
+ * Each value becomes {value: string}.
+ */
+export declare function expandSingleDimension(matrix: StaticMatrixArray): MatrixValues[];
+/**
+ * Expand multi-dimensional matrix (object form) to MatrixValues array.
+ * Computes the cartesian product of all dimensions.
+ * Dimension names are sorted for deterministic output.
+ */
+export declare function expandMultiDimension(matrix: StaticMatrixObject): MatrixValues[];
+/**
+ * Unified expand function that dispatches to single or multi-dimensional expansion.
+ */
+export declare function expandMatrix(matrix: StaticMatrixArray | StaticMatrixObject): MatrixValues[];
+/**
+ * Apply include/exclude modifications to expanded matrix combinations.
+ * Exclude first (remove matching), then include (add new).
+ *
+ * Exclude matches if ALL specified dimensions match.
+ * Include adds new combinations if they don't already exist.
+ */
+export declare function applyIncludeExclude(expanded: MatrixValues[], include?: MatrixInclude[], exclude?: MatrixExclude[]): MatrixValues[];
+//# sourceMappingURL=expand.d.ts.map

package/dist/matrix/expand.js

@@ -0,0 +1,72 @@
+import "../chunk-BTugEXQM.js";
+//#region src/matrix/expand.ts
+/**
+* Compute the cartesian product of the given value sets in row-major order.
+* An empty set list yields a single empty tuple; any empty set yields no tuples.
+*/
+function cartesianProduct(sets) {
+	return sets.reduce((acc, set) => acc.flatMap((tuple) => set.map((value) => [...tuple, value])), [[]]);
+}
+/**
+* Expand single-dimension matrix (array form) to MatrixValues array.
+* Each value becomes {value: string}.
+*/
+function expandSingleDimension(matrix) {
+	return matrix.map((value) => ({ value }));
+}
+/**
+* Expand multi-dimensional matrix (object form) to MatrixValues array.
+* Computes the cartesian product of all dimensions.
+* Dimension names are sorted for deterministic output.
+*/
+function expandMultiDimension(matrix) {
+	const dimensions = Object.entries(matrix);
+	if (dimensions.length === 0) return [];
+	dimensions.sort((a, b) => a[0].localeCompare(b[0]));
+	const names = dimensions.map(([name]) => name);
+	return cartesianProduct(dimensions.map(([, values]) => values)).map((combo) => {
+		const result = {};
+		names.forEach((name, idx) => {
+			result[name] = combo[idx];
+		});
+		return result;
+	});
+}
+/**
+* Unified expand function that dispatches to single or multi-dimensional expansion.
+*/
+function expandMatrix(matrix) {
+	if (Array.isArray(matrix)) return expandSingleDimension(matrix);
+	return expandMultiDimension(matrix);
+}
+/**
+* Apply include/exclude modifications to expanded matrix combinations.
+* Exclude first (remove matching), then include (add new).
+*
+* Exclude matches if ALL specified dimensions match.
+* Include adds new combinations if they don't already exist.
+*/
+function applyIncludeExclude(expanded, include, exclude) {
+	let result = [...expanded];
+	if (exclude && exclude.length > 0) result = result.filter((combo) => {
+		return !exclude.some((excl) => {
+			const exclEntries = Object.entries(excl);
+			if (exclEntries.length === 0) return false;
+			return exclEntries.every(([key, value]) => combo[key] === value);
+		});
+	});
+	if (include && include.length > 0) for (const incl of include) {
+		const inclKeys = Object.keys(incl);
+		if (inclKeys.length === 0) continue;
+		if (!result.some((combo) => {
+			const comboKeys = Object.keys(combo);
+			if (inclKeys.length !== comboKeys.length) return false;
+			return inclKeys.every((key) => combo[key] === incl[key]);
+		})) result.push(incl);
+	}
+	return result;
+}
+//#endregion
+export { applyIncludeExclude, cartesianProduct, expandMatrix, expandMultiDimension, expandSingleDimension };
+
+//# sourceMappingURL=expand.js.map

package/dist/matrix/format.d.ts

@@ -0,0 +1,10 @@
+import type { MatrixValues } from './expand.js';
+/**
+ * Format matrix values into a display string for the job name.
+ * Single-dimension: "node-18"
+ * Multi-dimensional: "linux, 18"
+ */
+export declare function formatMatrixSuffix(matrixValues: MatrixValues): string;
+/** Expanded child job name: `${baseName} (${suffix})`. MUST match the local executor. */
+export declare function formatExpandedJobName(baseName: string, matrixValues: MatrixValues): string;
+//# sourceMappingURL=format.d.ts.map

package/dist/matrix/format.js

@@ -0,0 +1,20 @@
+import "../chunk-BTugEXQM.js";
+//#region src/matrix/format.ts
+/**
+* Format matrix values into a display string for the job name.
+* Single-dimension: "node-18"
+* Multi-dimensional: "linux, 18"
+*/
+function formatMatrixSuffix(matrixValues) {
+	const defined = Object.entries(matrixValues).filter(([, v]) => v !== void 0);
+	if (defined.length === 1 && defined[0][0] === "value") return defined[0][1];
+	return defined.map(([, v]) => v).join(", ");
+}
+/** Expanded child job name: `${baseName} (${suffix})`. MUST match the local executor. */
+function formatExpandedJobName(baseName, matrixValues) {
+	return `${baseName} (${formatMatrixSuffix(matrixValues)})`;
+}
+//#endregion
+export { formatExpandedJobName, formatMatrixSuffix };
+
+//# sourceMappingURL=format.js.map

package/dist/metrics/catalog-policy.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { MetricNames, MetricService } from "./metric-catalog.generated.js";
 //#region src/metrics/catalog-policy.ts
 /**
@@ -138,7 +138,11 @@ const METRIC_LABEL_POLICY = {
 		machinePool: { maxUniqueValues: 50 }
 	},
 	kici_orch_install_secrets_decisions_total: {
-		decision: { values: ["pass", "reject"] },
+		decision: { values: [
+			"pass",
+			"reject",
+			"hold"
+		] },
 		reason: { values: [
 			"ok",
 			"malformed_ref",
@@ -148,7 +152,8 @@ const METRIC_LABEL_POLICY = {
 			"env_not_found",
 			"protection_rule_block",
 			"missing_token",
-			"missing_install_env"
+			"missing_install_env",
+			"held"
 		] }
 	},
 	kici_orch_install_secrets_npm_registry_used_total: {

package/dist/metrics/metric-catalog.generated.d.ts

@@ -19,6 +19,7 @@ export declare const MetricNames: {
     readonly KICI_ORCH_BUILD_DURATION_SECONDS: "kici_orch_build_duration_seconds";
     readonly KICI_ORCH_CONFIG_RELOAD_TOTAL: "kici_orch_config_reload_total";
     readonly KICI_ORCH_CONFIG_VERSION: "kici_orch_config_version";
+    readonly KICI_ORCH_DECLARED_HOSTS_UNREACHABLE: "kici_orch_declared_hosts_unreachable";
     readonly KICI_ORCH_DEDUP_HITS_TOTAL: "kici_orch_dedup_hits_total";
     readonly KICI_ORCH_DEP_CACHE_HITS_TOTAL: "kici_orch_dep_cache_hits_total";
     readonly KICI_ORCH_DEP_CACHE_MISSES_TOTAL: "kici_orch_dep_cache_misses_total";
@@ -128,6 +129,7 @@ export declare const MetricNames: {
     readonly V8JS_MEMORY_HEAP_LIMIT: "v8js.memory.heap.limit";
     readonly V8JS_MEMORY_HEAP_SPACE_AVAILABLE_SIZE: "v8js.memory.heap.space.available_size";
     readonly V8JS_MEMORY_HEAP_SPACE_PHYSICAL_SIZE: "v8js.memory.heap.space.physical_size";
+    readonly V8JS_MEMORY_HEAP_SPACE_SIZE: "v8js.memory.heap.space.size";
     readonly V8JS_MEMORY_HEAP_USED: "v8js.memory.heap.used";
 };
 export type MetricName = (typeof MetricNames)[keyof typeof MetricNames];
@@ -152,6 +154,7 @@ export declare const MetricLabels: {
     readonly KICI_ORCH_BUILD_DURATION_SECONDS: readonly [];
     readonly KICI_ORCH_CONFIG_RELOAD_TOTAL: readonly ["result", "source"];
     readonly KICI_ORCH_CONFIG_VERSION: readonly [];
+    readonly KICI_ORCH_DECLARED_HOSTS_UNREACHABLE: readonly [];
     readonly KICI_ORCH_DEDUP_HITS_TOTAL: readonly [];
     readonly KICI_ORCH_DEP_CACHE_HITS_TOTAL: readonly [];
     readonly KICI_ORCH_DEP_CACHE_MISSES_TOTAL: readonly [];
@@ -261,6 +264,7 @@ export declare const MetricLabels: {
     readonly V8JS_MEMORY_HEAP_LIMIT: readonly ["v8js.heap.space.name", "scaler"];
     readonly V8JS_MEMORY_HEAP_SPACE_AVAILABLE_SIZE: readonly ["v8js.heap.space.name", "scaler"];
     readonly V8JS_MEMORY_HEAP_SPACE_PHYSICAL_SIZE: readonly ["v8js.heap.space.name", "scaler"];
+    readonly V8JS_MEMORY_HEAP_SPACE_SIZE: readonly ["v8js.heap.space.name", "scaler"];
     readonly V8JS_MEMORY_HEAP_USED: readonly ["v8js.heap.space.name", "scaler"];
 };
 export declare const MetricKind: {
@@ -284,6 +288,7 @@ export declare const MetricKind: {
     readonly KICI_ORCH_BUILD_DURATION_SECONDS: "histogram";
     readonly KICI_ORCH_CONFIG_RELOAD_TOTAL: "counter";
     readonly KICI_ORCH_CONFIG_VERSION: "observableGauge";
+    readonly KICI_ORCH_DECLARED_HOSTS_UNREACHABLE: "observableGauge";
     readonly KICI_ORCH_DEDUP_HITS_TOTAL: "counter";
     readonly KICI_ORCH_DEP_CACHE_HITS_TOTAL: "counter";
     readonly KICI_ORCH_DEP_CACHE_MISSES_TOTAL: "counter";
@@ -393,6 +398,7 @@ export declare const MetricKind: {
     readonly V8JS_MEMORY_HEAP_LIMIT: "gauge";
     readonly V8JS_MEMORY_HEAP_SPACE_AVAILABLE_SIZE: "gauge";
     readonly V8JS_MEMORY_HEAP_SPACE_PHYSICAL_SIZE: "gauge";
+    readonly V8JS_MEMORY_HEAP_SPACE_SIZE: "gauge";
     readonly V8JS_MEMORY_HEAP_USED: "gauge";
 };
 export declare const MetricDescription: {
@@ -416,6 +422,7 @@ export declare const MetricDescription: {
     readonly KICI_ORCH_BUILD_DURATION_SECONDS: "Duration of build agent operations in seconds";
     readonly KICI_ORCH_CONFIG_RELOAD_TOTAL: "Total number of config reload operations";
     readonly KICI_ORCH_CONFIG_VERSION: "Current shared config version number";
+    readonly KICI_ORCH_DECLARED_HOSTS_UNREACHABLE: "Number of declared (static) roster hosts currently unreachable";
     readonly KICI_ORCH_DEDUP_HITS_TOTAL: "Total number of deduplication cache hits";
     readonly KICI_ORCH_DEP_CACHE_HITS_TOTAL: "Total number of dep cache hits";
     readonly KICI_ORCH_DEP_CACHE_MISSES_TOTAL: "Total number of dep cache misses";
@@ -431,7 +438,7 @@ export declare const MetricDescription: {
     readonly KICI_ORCH_EXECUTIONS_TOTAL: "Total number of execution runs";
     readonly KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: "Total number of GitHub check run API calls";
     readonly KICI_ORCH_INSTALL_SECRETS_CONTRIBUTOR_STRIPPED_TOTAL: "Dispatches where registry tokens were stripped because the contributor tier was not `trusted`";
-    readonly KICI_ORCH_INSTALL_SECRETS_DECISIONS_TOTAL: "Total install-secrets resolution decisions (pass / reject + reason)";
+    readonly KICI_ORCH_INSTALL_SECRETS_DECISIONS_TOTAL: "Total install-secrets resolution decisions (pass / reject / hold + reason)";
     readonly KICI_ORCH_INSTALL_SECRETS_NPM_REGISTRY_USED_TOTAL: "Total registry / installEnv entries successfully resolved per channel / provider / scope";
     readonly KICI_ORCH_INSTALL_SECRETS_TOKEN_RESOLUTION_DURATION_SECONDS: "Duration of per-environment secret resolution during install-secrets evaluation";
     readonly KICI_ORCH_JOB_CONSECUTIVE_FAILURES: "Consecutive failures for each scheduled job since its last success";
@@ -525,6 +532,7 @@ export declare const MetricDescription: {
     readonly V8JS_MEMORY_HEAP_LIMIT: "V8 heap size limit by heap space";
     readonly V8JS_MEMORY_HEAP_SPACE_AVAILABLE_SIZE: "V8 available heap size by heap space";
     readonly V8JS_MEMORY_HEAP_SPACE_PHYSICAL_SIZE: "V8 physical heap size by heap space";
+    readonly V8JS_MEMORY_HEAP_SPACE_SIZE: "V8 total heap size by heap space";
     readonly V8JS_MEMORY_HEAP_USED: "V8 used heap size by heap space";
 };
 /**
@@ -555,6 +563,7 @@ export declare const MetricService: {
     readonly KICI_ORCH_BUILD_DURATION_SECONDS: "orchestrator";
     readonly KICI_ORCH_CONFIG_RELOAD_TOTAL: "orchestrator";
     readonly KICI_ORCH_CONFIG_VERSION: "orchestrator";
+    readonly KICI_ORCH_DECLARED_HOSTS_UNREACHABLE: "orchestrator";
     readonly KICI_ORCH_DEDUP_HITS_TOTAL: "orchestrator";
     readonly KICI_ORCH_DEP_CACHE_HITS_TOTAL: "orchestrator";
     readonly KICI_ORCH_DEP_CACHE_MISSES_TOTAL: "orchestrator";
@@ -664,6 +673,7 @@ export declare const MetricService: {
     readonly V8JS_MEMORY_HEAP_LIMIT: "runtime";
     readonly V8JS_MEMORY_HEAP_SPACE_AVAILABLE_SIZE: "runtime";
     readonly V8JS_MEMORY_HEAP_SPACE_PHYSICAL_SIZE: "runtime";
+    readonly V8JS_MEMORY_HEAP_SPACE_SIZE: "runtime";
     readonly V8JS_MEMORY_HEAP_USED: "runtime";
 };
 export type MetricService = (typeof MetricService)[keyof typeof MetricService];

package/dist/metrics/metric-catalog.generated.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/metrics/metric-catalog.generated.ts
 const MetricNames = {
 	KICI_AGENT_CLONE_DURATION_SECONDS: "kici_agent_clone_duration_seconds",
@@ -21,6 +21,7 @@ const MetricNames = {
 	KICI_ORCH_BUILD_DURATION_SECONDS: "kici_orch_build_duration_seconds",
 	KICI_ORCH_CONFIG_RELOAD_TOTAL: "kici_orch_config_reload_total",
 	KICI_ORCH_CONFIG_VERSION: "kici_orch_config_version",
+	KICI_ORCH_DECLARED_HOSTS_UNREACHABLE: "kici_orch_declared_hosts_unreachable",
 	KICI_ORCH_DEDUP_HITS_TOTAL: "kici_orch_dedup_hits_total",
 	KICI_ORCH_DEP_CACHE_HITS_TOTAL: "kici_orch_dep_cache_hits_total",
 	KICI_ORCH_DEP_CACHE_MISSES_TOTAL: "kici_orch_dep_cache_misses_total",
@@ -130,6 +131,7 @@ const MetricNames = {
 	V8JS_MEMORY_HEAP_LIMIT: "v8js.memory.heap.limit",
 	V8JS_MEMORY_HEAP_SPACE_AVAILABLE_SIZE: "v8js.memory.heap.space.available_size",
 	V8JS_MEMORY_HEAP_SPACE_PHYSICAL_SIZE: "v8js.memory.heap.space.physical_size",
+	V8JS_MEMORY_HEAP_SPACE_SIZE: "v8js.memory.heap.space.size",
 	V8JS_MEMORY_HEAP_USED: "v8js.memory.heap.used"
 };
 const MetricLabels = {
@@ -153,6 +155,7 @@ const MetricLabels = {
 	KICI_ORCH_BUILD_DURATION_SECONDS: [],
 	KICI_ORCH_CONFIG_RELOAD_TOTAL: ["result", "source"],
 	KICI_ORCH_CONFIG_VERSION: [],
+	KICI_ORCH_DECLARED_HOSTS_UNREACHABLE: [],
 	KICI_ORCH_DEDUP_HITS_TOTAL: [],
 	KICI_ORCH_DEP_CACHE_HITS_TOTAL: [],
 	KICI_ORCH_DEP_CACHE_MISSES_TOTAL: [],
@@ -270,6 +273,7 @@ const MetricLabels = {
 	V8JS_MEMORY_HEAP_LIMIT: ["v8js.heap.space.name", "scaler"],
 	V8JS_MEMORY_HEAP_SPACE_AVAILABLE_SIZE: ["v8js.heap.space.name", "scaler"],
 	V8JS_MEMORY_HEAP_SPACE_PHYSICAL_SIZE: ["v8js.heap.space.name", "scaler"],
+	V8JS_MEMORY_HEAP_SPACE_SIZE: ["v8js.heap.space.name", "scaler"],
 	V8JS_MEMORY_HEAP_USED: ["v8js.heap.space.name", "scaler"]
 };
 const MetricKind = {
@@ -293,6 +297,7 @@ const MetricKind = {
 	KICI_ORCH_BUILD_DURATION_SECONDS: "histogram",
 	KICI_ORCH_CONFIG_RELOAD_TOTAL: "counter",
 	KICI_ORCH_CONFIG_VERSION: "observableGauge",
+	KICI_ORCH_DECLARED_HOSTS_UNREACHABLE: "observableGauge",
 	KICI_ORCH_DEDUP_HITS_TOTAL: "counter",
 	KICI_ORCH_DEP_CACHE_HITS_TOTAL: "counter",
 	KICI_ORCH_DEP_CACHE_MISSES_TOTAL: "counter",
@@ -402,6 +407,7 @@ const MetricKind = {
 	V8JS_MEMORY_HEAP_LIMIT: "gauge",
 	V8JS_MEMORY_HEAP_SPACE_AVAILABLE_SIZE: "gauge",
 	V8JS_MEMORY_HEAP_SPACE_PHYSICAL_SIZE: "gauge",
+	V8JS_MEMORY_HEAP_SPACE_SIZE: "gauge",
 	V8JS_MEMORY_HEAP_USED: "gauge"
 };
 const MetricDescription = {
@@ -425,6 +431,7 @@ const MetricDescription = {
 	KICI_ORCH_BUILD_DURATION_SECONDS: "Duration of build agent operations in seconds",
 	KICI_ORCH_CONFIG_RELOAD_TOTAL: "Total number of config reload operations",
 	KICI_ORCH_CONFIG_VERSION: "Current shared config version number",
+	KICI_ORCH_DECLARED_HOSTS_UNREACHABLE: "Number of declared (static) roster hosts currently unreachable",
 	KICI_ORCH_DEDUP_HITS_TOTAL: "Total number of deduplication cache hits",
 	KICI_ORCH_DEP_CACHE_HITS_TOTAL: "Total number of dep cache hits",
 	KICI_ORCH_DEP_CACHE_MISSES_TOTAL: "Total number of dep cache misses",
@@ -440,7 +447,7 @@ const MetricDescription = {
 	KICI_ORCH_EXECUTIONS_TOTAL: "Total number of execution runs",
 	KICI_ORCH_GITHUB_CHECK_RUN_TOTAL: "Total number of GitHub check run API calls",
 	KICI_ORCH_INSTALL_SECRETS_CONTRIBUTOR_STRIPPED_TOTAL: "Dispatches where registry tokens were stripped because the contributor tier was not `trusted`",
-	KICI_ORCH_INSTALL_SECRETS_DECISIONS_TOTAL: "Total install-secrets resolution decisions (pass / reject + reason)",
+	KICI_ORCH_INSTALL_SECRETS_DECISIONS_TOTAL: "Total install-secrets resolution decisions (pass / reject / hold + reason)",
 	KICI_ORCH_INSTALL_SECRETS_NPM_REGISTRY_USED_TOTAL: "Total registry / installEnv entries successfully resolved per channel / provider / scope",
 	KICI_ORCH_INSTALL_SECRETS_TOKEN_RESOLUTION_DURATION_SECONDS: "Duration of per-environment secret resolution during install-secrets evaluation",
 	KICI_ORCH_JOB_CONSECUTIVE_FAILURES: "Consecutive failures for each scheduled job since its last success",
@@ -534,6 +541,7 @@ const MetricDescription = {
 	V8JS_MEMORY_HEAP_LIMIT: "V8 heap size limit by heap space",
 	V8JS_MEMORY_HEAP_SPACE_AVAILABLE_SIZE: "V8 available heap size by heap space",
 	V8JS_MEMORY_HEAP_SPACE_PHYSICAL_SIZE: "V8 physical heap size by heap space",
+	V8JS_MEMORY_HEAP_SPACE_SIZE: "V8 total heap size by heap space",
 	V8JS_MEMORY_HEAP_USED: "V8 used heap size by heap space"
 };
 /**
@@ -564,6 +572,7 @@ const MetricService = {
 	KICI_ORCH_BUILD_DURATION_SECONDS: "orchestrator",
 	KICI_ORCH_CONFIG_RELOAD_TOTAL: "orchestrator",
 	KICI_ORCH_CONFIG_VERSION: "orchestrator",
+	KICI_ORCH_DECLARED_HOSTS_UNREACHABLE: "orchestrator",
 	KICI_ORCH_DEDUP_HITS_TOTAL: "orchestrator",
 	KICI_ORCH_DEP_CACHE_HITS_TOTAL: "orchestrator",
 	KICI_ORCH_DEP_CACHE_MISSES_TOTAL: "orchestrator",
@@ -673,6 +682,7 @@ const MetricService = {
 	V8JS_MEMORY_HEAP_LIMIT: "runtime",
 	V8JS_MEMORY_HEAP_SPACE_AVAILABLE_SIZE: "runtime",
 	V8JS_MEMORY_HEAP_SPACE_PHYSICAL_SIZE: "runtime",
+	V8JS_MEMORY_HEAP_SPACE_SIZE: "runtime",
 	V8JS_MEMORY_HEAP_USED: "runtime"
 };
 /** Set of every catalog metric name — O(1) membership for lint / filter UI. */
@@ -697,6 +707,7 @@ const ALL_METRIC_NAMES = [
 	"kici_orch_build_duration_seconds",
 	"kici_orch_config_reload_total",
 	"kici_orch_config_version",
+	"kici_orch_declared_hosts_unreachable",
 	"kici_orch_dedup_hits_total",
 	"kici_orch_dep_cache_hits_total",
 	"kici_orch_dep_cache_misses_total",
@@ -806,6 +817,7 @@ const ALL_METRIC_NAMES = [
 	"v8js.memory.heap.limit",
 	"v8js.memory.heap.space.available_size",
 	"v8js.memory.heap.space.physical_size",
+	"v8js.memory.heap.space.size",
 	"v8js.memory.heap.used"
 ];
 //#endregion

package/dist/protocol/analytics-events.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/protocol/analytics-events.ts
 const AnalyticsEvent = z.enum([

package/dist/protocol/cluster-name.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/protocol/cluster-name.ts
 /**

package/dist/protocol/dashboard-global-workflows.js

@@ -1,3 +1,3 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { globalWorkflowSettingsSchema, globalWorkflowsGetRequestSchema, globalWorkflowsGetResponseSchema, globalWorkflowsUpdateRequestSchema, globalWorkflowsUpdateResponseSchema, repoPatternEntrySchema } from "./messages/dashboard-global-workflows.js";
 export { globalWorkflowSettingsSchema, globalWorkflowsGetRequestSchema, globalWorkflowsGetResponseSchema, globalWorkflowsUpdateRequestSchema, globalWorkflowsUpdateResponseSchema, repoPatternEntrySchema };

package/dist/protocol/dashboard-write-operations.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/protocol/dashboard-write-operations.ts
 /**

package/dist/protocol/event-log-payload.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/protocol/event-log-payload.ts
 /**
 * Constants for the chunked event-log payload streaming transport.