@kici-dev/engine 0.1.19 → 0.1.21

package/dist/check-mode.d.ts

@@ -0,0 +1,33 @@
+import { z } from 'zod';
+/**
+ * How a run executes idempotent steps.
+ *
+ * - `apply` (default): converge — per step, check(); on drift apply(); else in sync.
+ * - `check`: report what would change, changing nothing (always succeeds; report-only).
+ * - `check-fail-on-drift`: like check, but the run fails if any step reports drift.
+ */
+export declare const CheckMode: z.ZodEnum<{
+    apply: "apply";
+    check: "check";
+    "check-fail-on-drift": "check-fail-on-drift";
+}>;
+export type CheckMode = z.infer<typeof CheckMode>;
+/**
+ * Per-step idempotent outcome. The first four mirror the StepOutcome union in
+ * @kici-dev/core/idempotency verbatim (skipped | applied | declined | dry-run);
+ * `no_check` covers a plain step (no check facet) skipped under check mode
+ * because it cannot be safely previewed.
+ *
+ * Orthogonal to ExecutionStepStatus (success | failed | skipped), which stays the
+ * top-level status. Dashboard chips map: applied -> "applied", skipped -> "in sync",
+ * dry-run -> "would change", no_check -> "no check".
+ */
+export declare const CheckStepOutcome: z.ZodEnum<{
+    skipped: "skipped";
+    applied: "applied";
+    declined: "declined";
+    "dry-run": "dry-run";
+    no_check: "no_check";
+}>;
+export type CheckStepOutcome = z.infer<typeof CheckStepOutcome>;
+//# sourceMappingURL=check-mode.d.ts.map

package/dist/check-mode.js

@@ -0,0 +1,36 @@
+import "./chunk-BTugEXQM.js";
+import { z } from "zod";
+//#region src/check-mode.ts
+/**
+* How a run executes idempotent steps.
+*
+* - `apply` (default): converge — per step, check(); on drift apply(); else in sync.
+* - `check`: report what would change, changing nothing (always succeeds; report-only).
+* - `check-fail-on-drift`: like check, but the run fails if any step reports drift.
+*/
+const CheckMode = z.enum([
+	"apply",
+	"check",
+	"check-fail-on-drift"
+]);
+/**
+* Per-step idempotent outcome. The first four mirror the StepOutcome union in
+* @kici-dev/core/idempotency verbatim (skipped | applied | declined | dry-run);
+* `no_check` covers a plain step (no check facet) skipped under check mode
+* because it cannot be safely previewed.
+*
+* Orthogonal to ExecutionStepStatus (success | failed | skipped), which stays the
+* top-level status. Dashboard chips map: applied -> "applied", skipped -> "in sync",
+* dry-run -> "would change", no_check -> "no check".
+*/
+const CheckStepOutcome = z.enum([
+	"skipped",
+	"applied",
+	"declined",
+	"dry-run",
+	"no_check"
+]);
+//#endregion
+export { CheckMode, CheckStepOutcome };
+
+//# sourceMappingURL=check-mode.js.map

package/dist/index.d.ts

@@ -37,6 +37,7 @@ export * from './trigger/decision-trace.js';
 export * from './trigger/matcher.js';
 export * from './state-machine/index.js';
 export * from './provider/index.js';
+export { githubWebhookPath } from './webhook/webhook-url-format.js';
 export type { WsLike } from './ws/ws-like.js';
 export * from './ws/close-codes.js';
 export { WsRateLimiter } from './ws/rate-limiter.js';
@@ -48,6 +49,7 @@ export { deriveOsArchLabels, hostLabel, parseHostLabel, HOST_LABEL_PREFIX, agent
 export type { NormalizedRunsOn } from './labels.js';
 export type { AgentRole } from './labels.js';
 export { LabelMatcher, matcherMatches, matcherSatisfiedBy, partitionMatchers, compileRegexMatcher, } from './labels-match.js';
+export * from './inventory.js';
 export * from './scaler/scaler-backend-type.js';
 export * from './scaler/resource-types.js';
 export * from './registration/registerable-trigger-type.js';
@@ -55,4 +57,5 @@ export * from './bundler/index.js';
 export { expandSingleDimension, expandMultiDimension, expandMatrix, applyIncludeExclude, type StaticMatrixArray, type StaticMatrixObject, type MatrixInclude, type MatrixExclude, type MatrixValues, } from './matrix/expand.js';
 export { formatMatrixSuffix, formatExpandedJobName } from './matrix/format.js';
 export * from './fanout/materialize.js';
+export * from './check-mode.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,4 +1,5 @@
 import "./chunk-BTugEXQM.js";
+import { CheckMode, CheckStepOutcome } from "./check-mode.js";
 import { MIN_PROTOCOL_VERSION, PROTOCOL_VERSION } from "./protocol/version.js";
 import { WS_MAX_PAYLOAD_BYTES, ackSchema, errorSchema, heartbeatSchema, nackSchema } from "./protocol/messages/common.js";
 import { ActorType, actorPrincipalSchema, apiKeyActorSchema, flattenActor, parseActor, platformOperatorActorSchema, serviceAccountActorSchema, stringifyActor, systemActorSchema, userActorSchema } from "./protocol/messages/actor.js";
@@ -23,7 +24,7 @@ import { EVENT_LOG_PAYLOAD_CHUNK_BYTES } from "./protocol/event-log-payload.js";
 import { browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, platformToBrowserMessageSchema } from "./protocol/messages/browser.js";
 import { joinRequestSchema, joinResponseSchema } from "./protocol/messages/join.js";
 import { LabelMatcher, compileRegexMatcher, matcherMatches, matcherSatisfiedBy, partitionMatchers } from "./labels-match.js";
-import { fleetSelectionSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema } from "./protocol/messages/peer.js";
+import { fleetSelectionSchema, jobProgressAckSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema } from "./protocol/messages/peer.js";
 import { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema } from "./protocol/messages/orchestrator-agent.js";
 import { TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES } from "./trigger/trigger-event-type.js";
 import { createTraceEntry, createWorkflowDecision } from "./trigger/decision-trace.js";
@@ -33,6 +34,7 @@ import "./state-machine/index.js";
 import { LockFileParseError } from "./provider/lock-file-parse-error.js";
 import { CheckRunConclusion } from "./provider/check-run-conclusion.js";
 import "./provider/index.js";
+import { githubWebhookPath } from "./webhook/webhook-url-format.js";
 import { WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED } from "./ws/close-codes.js";
 import { WsRateLimiter } from "./ws/rate-limiter.js";
 import { AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, KICI_AGENT_ENV_PREFIX, SANDBOX_DEFAULT_VARS } from "./env/environment-allowlist.js";
@@ -40,6 +42,7 @@ import "./secrets/index.js";
 import { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix } from "./environment/scope-resolver.js";
 import "./environment/index.js";
 import { HOST_LABEL_PREFIX, KNOWN_ROLES, SELF_REPORTED_LABEL_PREFIXES, agentTypeLabel, deriveOsArchLabels, hostLabel, isSelfReportedLabel, mergeAutoLabels, normalizeRunsOn, parseHostLabel, resolveRoleLabels, scalerAgentLabels, scalerLabel, validateNoReservedLabels } from "./labels.js";
+import { HostInventoryEntry, HostPropertyValue, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, coerceHostPropertyValue, parseHostPropertyAssignments } from "./inventory.js";
 import { parseMemoryString, resourceRequestNestedSchema, resourceSpecSchema, validateResourceRequest } from "./scaler/resource-types.js";
 import { RegisterableTriggerType } from "./registration/registerable-trigger-type.js";
 import { createWorkflowBundleConfig } from "./bundler/rolldown-config.js";
@@ -47,4 +50,4 @@ import "./bundler/index.js";
 import { applyIncludeExclude, expandMatrix, expandMultiDimension, expandSingleDimension } from "./matrix/expand.js";
 import { formatExpandedJobName, formatMatrixSuffix } from "./matrix/format.js";
 import { FanoutError, MAX_FANOUT_JOBS, VariantKind, hostEnvelopeFields, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields } from "./fanout/materialize.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, ApprovalDecision, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckRunConclusion, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutError, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, IfFailedPolicy, InitFailureCategory, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, MAX_FANOUT_JOBS, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, ORCH_CAPABILITIES, OnUnreachableMode, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, StepApprovalOutcome, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TestRelayType, TimeoutReason, TriggerSource, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approverClauseSchema, attestationListItemSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, compileRegexMatcher, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, ApprovalDecision, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutError, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HostInventoryEntry, HostPropertyValue, IfFailedPolicy, InitFailureCategory, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, MAX_FANOUT_JOBS, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, ORCH_CAPABILITIES, OnUnreachableMode, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, StepApprovalOutcome, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TestRelayType, TimeoutReason, TriggerSource, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approverClauseSchema, attestationListItemSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, coerceHostPropertyValue, compileRegexMatcher, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, githubWebhookPath, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };

package/dist/inventory.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Canonical, workflow-queryable host inventory schema.
+ *
+ * One `HostInventoryEntry` is the single shape every inventory consumer reads:
+ * the orchestrator's roster store maps each `host_roster` row to it, the
+ * `inventory.query`/`inventory.get` agent-API RPC returns it, and the SDK's
+ * `ctx.kici.inventory` types it. Labels stay the flat-string grouping
+ * dimension (the shipped runsOnAll glob/regex matchers operate on flat
+ * strings); `properties` is the separate typed host-vars dimension.
+ */
+import { z } from 'zod';
+import { LabelMatcher } from './labels-match.js';
+/** A single host-property value — the typed host-vars dimension. */
+export declare const HostPropertyValue: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+export type HostPropertyValue = z.infer<typeof HostPropertyValue>;
+/**
+ * Lifecycle class of a roster host. Mirrors the orchestrator's `LifecycleClass`
+ * (the auth token's `agent_type` snapshot): `static` hosts persist and alarm on
+ * absence; `ephemeral` hosts are GC'd past their ttl.
+ */
+export declare const InventoryLifecycleClass: z.ZodEnum<{
+    static: "static";
+    ephemeral: "ephemeral";
+}>;
+export type InventoryLifecycleClass = z.infer<typeof InventoryLifecycleClass>;
+/**
+ * Read-time derived status of a roster host. Mirrors the orchestrator's
+ * `HostStatus` values: `ready` (live + fresh heartbeat), `unreachable`
+ * (declared static host not currently live), `stale` (ephemeral past ttl,
+ * awaiting reap).
+ */
+export declare const InventoryHostStatus: z.ZodEnum<{
+    unreachable: "unreachable";
+    ready: "ready";
+    stale: "stale";
+}>;
+export type InventoryHostStatus = z.infer<typeof InventoryHostStatus>;
+/** Canonical queryable inventory record for one roster host. */
+export declare const HostInventoryEntry: z.ZodObject<{
+    agentId: z.ZodString;
+    labels: z.ZodArray<z.ZodString>;
+    properties: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    hostname: z.ZodNullable<z.ZodString>;
+    platform: z.ZodNullable<z.ZodString>;
+    arch: z.ZodNullable<z.ZodString>;
+    lifecycleClass: z.ZodEnum<{
+        static: "static";
+        ephemeral: "ephemeral";
+    }>;
+    status: z.ZodEnum<{
+        unreachable: "unreachable";
+        ready: "ready";
+        stale: "stale";
+    }>;
+    lastSeen: z.ZodString;
+}, z.core.$strip>;
+export type HostInventoryEntry = z.infer<typeof HostInventoryEntry>;
+/**
+ * Label selector for `inventory.query`. Reuses the shipped `LabelMatcher`
+ * (glob/regex) semantics: `include` is an OR-of-AND group list, `exclude`
+ * removes any host whose labels satisfy a matcher. Omit ⇒ all hosts.
+ * Property filtering is done client-side in the workflow (full JS).
+ */
+export interface InventorySelector {
+    include?: (readonly LabelMatcher[])[];
+    exclude?: LabelMatcher[];
+}
+/** Zod validator for the `inventory.query` selector params on the wire. */
+export declare const InventorySelectorSchema: z.ZodObject<{
+    include: z.ZodOptional<z.ZodArray<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"exact">;
+        value: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"regex">;
+        source: z.ZodString;
+        flags: z.ZodString;
+    }, z.core.$strip>], "kind">>>>;
+    exclude: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"exact">;
+        value: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"regex">;
+        source: z.ZodString;
+        flags: z.ZodString;
+    }, z.core.$strip>], "kind">>>;
+}, z.core.$strip>;
+/**
+ * Coerce a raw string into a typed {@link HostPropertyValue}: `true`/`false` ⇒
+ * boolean, a finite integer/decimal literal ⇒ number, everything else ⇒ the
+ * verbatim string. The single source of truth for the `key=value` typing used
+ * by both `kici-admin host declare --prop` and the agent's `KICI_PROPERTIES`.
+ */
+export declare function coerceHostPropertyValue(raw: string): HostPropertyValue;
+/**
+ * Parse a list of `key=value` property assignments into a typed property bag.
+ * Values are typed via {@link coerceHostPropertyValue}. Throws on a malformed
+ * entry (missing `=`) or an empty key. Used by the host-declare CLI `--prop`
+ * option and the agent's `KICI_PROPERTIES` config parse.
+ */
+export declare function parseHostPropertyAssignments(values: string[]): Record<string, HostPropertyValue>;
+//# sourceMappingURL=inventory.d.ts.map

package/dist/inventory.js

@@ -0,0 +1,89 @@
+import "./chunk-BTugEXQM.js";
+import { LabelMatcher } from "./labels-match.js";
+import { z } from "zod";
+//#region src/inventory.ts
+/**
+* Canonical, workflow-queryable host inventory schema.
+*
+* One `HostInventoryEntry` is the single shape every inventory consumer reads:
+* the orchestrator's roster store maps each `host_roster` row to it, the
+* `inventory.query`/`inventory.get` agent-API RPC returns it, and the SDK's
+* `ctx.kici.inventory` types it. Labels stay the flat-string grouping
+* dimension (the shipped runsOnAll glob/regex matchers operate on flat
+* strings); `properties` is the separate typed host-vars dimension.
+*/
+/** A single host-property value — the typed host-vars dimension. */
+const HostPropertyValue = z.union([
+	z.string(),
+	z.number(),
+	z.boolean()
+]);
+/**
+* Lifecycle class of a roster host. Mirrors the orchestrator's `LifecycleClass`
+* (the auth token's `agent_type` snapshot): `static` hosts persist and alarm on
+* absence; `ephemeral` hosts are GC'd past their ttl.
+*/
+const InventoryLifecycleClass = z.enum(["static", "ephemeral"]);
+/**
+* Read-time derived status of a roster host. Mirrors the orchestrator's
+* `HostStatus` values: `ready` (live + fresh heartbeat), `unreachable`
+* (declared static host not currently live), `stale` (ephemeral past ttl,
+* awaiting reap).
+*/
+const InventoryHostStatus = z.enum([
+	"ready",
+	"unreachable",
+	"stale"
+]);
+/** Canonical queryable inventory record for one roster host. */
+const HostInventoryEntry = z.object({
+	agentId: z.string(),
+	/** Flat-string grouping/tags dimension (runsOnAll selectors operate on these). */
+	labels: z.array(z.string()),
+	/** Typed host-vars dimension (the ansible host-vars analogue). */
+	properties: z.record(z.string(), HostPropertyValue),
+	hostname: z.string().nullable(),
+	platform: z.string().nullable(),
+	arch: z.string().nullable(),
+	lifecycleClass: InventoryLifecycleClass,
+	status: InventoryHostStatus,
+	/** ISO 8601 timestamp of the last heartbeat. */
+	lastSeen: z.string()
+});
+/** Zod validator for the `inventory.query` selector params on the wire. */
+const InventorySelectorSchema = z.object({
+	include: z.array(z.array(LabelMatcher)).optional(),
+	exclude: z.array(LabelMatcher).optional()
+});
+/**
+* Coerce a raw string into a typed {@link HostPropertyValue}: `true`/`false` ⇒
+* boolean, a finite integer/decimal literal ⇒ number, everything else ⇒ the
+* verbatim string. The single source of truth for the `key=value` typing used
+* by both `kici-admin host declare --prop` and the agent's `KICI_PROPERTIES`.
+*/
+function coerceHostPropertyValue(raw) {
+	if (raw === "true") return true;
+	if (raw === "false") return false;
+	if (raw !== "" && /^-?\d+(\.\d+)?$/.test(raw) && Number.isFinite(Number(raw))) return Number(raw);
+	return raw;
+}
+/**
+* Parse a list of `key=value` property assignments into a typed property bag.
+* Values are typed via {@link coerceHostPropertyValue}. Throws on a malformed
+* entry (missing `=`) or an empty key. Used by the host-declare CLI `--prop`
+* option and the agent's `KICI_PROPERTIES` config parse.
+*/
+function parseHostPropertyAssignments(values) {
+	const out = {};
+	for (const entry of values) {
+		const eq = entry.indexOf("=");
+		if (eq <= 0) throw new Error(`Invalid property '${entry}': expected key=value`);
+		const key = entry.slice(0, eq);
+		out[key] = coerceHostPropertyValue(entry.slice(eq + 1));
+	}
+	return out;
+}
+//#endregion
+export { HostInventoryEntry, HostPropertyValue, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, coerceHostPropertyValue, parseHostPropertyAssignments };
+
+//# sourceMappingURL=inventory.js.map

package/dist/labels-match.js

@@ -43,7 +43,8 @@ function partitionMatchers(ms) {
 	const exact = [];
 	const regex = [];
 	for (const m of ms) if (m.kind === "exact") exact.push(m.value);
-	else regex.push(m);
+	else if (m.kind === "regex") regex.push(m);
+	else throw new Error(`partitionMatchers: invalid label matcher ${JSON.stringify(m)} — expected { kind: 'exact', value } or { kind: 'regex', source, flags }. The lock file is likely stale or compiled by an older engine — recompile with \`kici compile\`.`);
 	return {
 		exact,
 		regex

package/dist/metrics/metric-catalog.generated.d.ts

@@ -95,6 +95,7 @@ export declare const MetricNames: {
     readonly KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "kici_platform_step_status_forwards_total";
     readonly KICI_REGISTRATIONS_TOTAL: "kici_registrations_total";
     readonly KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "kici_universal_git_registration_errors_total";
+    readonly KICI_USER_REGISTRATION_NOTIFY_TOTAL: "kici_user_registration_notify_total";
     readonly KICI_VALKEY_CONNECTION_STATUS: "kici_valkey_connection_status";
     readonly KICI_VALKEY_PUBLISH_TOTAL: "kici_valkey_publish_total";
     readonly KICI_VALKEY_RELAY_LATENCY_SECONDS: "kici_valkey_relay_latency_seconds";
@@ -230,6 +231,7 @@ export declare const MetricLabels: {
     readonly KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: readonly ["state"];
     readonly KICI_REGISTRATIONS_TOTAL: readonly [];
     readonly KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: readonly ["reason"];
+    readonly KICI_USER_REGISTRATION_NOTIFY_TOTAL: readonly ["result"];
     readonly KICI_VALKEY_CONNECTION_STATUS: readonly ["role"];
     readonly KICI_VALKEY_PUBLISH_TOTAL: readonly ["channel"];
     readonly KICI_VALKEY_RELAY_LATENCY_SECONDS: readonly ["status"];
@@ -364,6 +366,7 @@ export declare const MetricKind: {
     readonly KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "counter";
     readonly KICI_REGISTRATIONS_TOTAL: "counter";
     readonly KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "counter";
+    readonly KICI_USER_REGISTRATION_NOTIFY_TOTAL: "counter";
     readonly KICI_VALKEY_CONNECTION_STATUS: "observableGauge";
     readonly KICI_VALKEY_PUBLISH_TOTAL: "counter";
     readonly KICI_VALKEY_RELAY_LATENCY_SECONDS: "histogram";
@@ -498,6 +501,7 @@ export declare const MetricDescription: {
     readonly KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "Total step status forwards received";
     readonly KICI_REGISTRATIONS_TOTAL: "Total user registrations (new personal orgs created on first login)";
     readonly KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "Errors encountered while registering universal-git provider bundles";
+    readonly KICI_USER_REGISTRATION_NOTIFY_TOTAL: "New-user Telegram notifications by result (sent|failed)";
     readonly KICI_VALKEY_CONNECTION_STATUS: "Valkey connection status per role (1=connected, 0=disconnected)";
     readonly KICI_VALKEY_PUBLISH_TOTAL: "Total messages published to Valkey channels";
     readonly KICI_VALKEY_RELAY_LATENCY_SECONDS: "Latency of cross-instance Valkey relay operations in seconds";
@@ -639,6 +643,7 @@ export declare const MetricService: {
     readonly KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "platform";
     readonly KICI_REGISTRATIONS_TOTAL: "platform";
     readonly KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "orchestrator";
+    readonly KICI_USER_REGISTRATION_NOTIFY_TOTAL: "platform";
     readonly KICI_VALKEY_CONNECTION_STATUS: "platform";
     readonly KICI_VALKEY_PUBLISH_TOTAL: "platform";
     readonly KICI_VALKEY_RELAY_LATENCY_SECONDS: "platform";

package/dist/metrics/metric-catalog.generated.js

@@ -97,6 +97,7 @@ const MetricNames = {
 	KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "kici_platform_step_status_forwards_total",
 	KICI_REGISTRATIONS_TOTAL: "kici_registrations_total",
 	KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "kici_universal_git_registration_errors_total",
+	KICI_USER_REGISTRATION_NOTIFY_TOTAL: "kici_user_registration_notify_total",
 	KICI_VALKEY_CONNECTION_STATUS: "kici_valkey_connection_status",
 	KICI_VALKEY_PUBLISH_TOTAL: "kici_valkey_publish_total",
 	KICI_VALKEY_RELAY_LATENCY_SECONDS: "kici_valkey_relay_latency_seconds",
@@ -235,6 +236,7 @@ const MetricLabels = {
 	KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: ["state"],
 	KICI_REGISTRATIONS_TOTAL: [],
 	KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: ["reason"],
+	KICI_USER_REGISTRATION_NOTIFY_TOTAL: ["result"],
 	KICI_VALKEY_CONNECTION_STATUS: ["role"],
 	KICI_VALKEY_PUBLISH_TOTAL: ["channel"],
 	KICI_VALKEY_RELAY_LATENCY_SECONDS: ["status"],
@@ -373,6 +375,7 @@ const MetricKind = {
 	KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "counter",
 	KICI_REGISTRATIONS_TOTAL: "counter",
 	KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "counter",
+	KICI_USER_REGISTRATION_NOTIFY_TOTAL: "counter",
 	KICI_VALKEY_CONNECTION_STATUS: "observableGauge",
 	KICI_VALKEY_PUBLISH_TOTAL: "counter",
 	KICI_VALKEY_RELAY_LATENCY_SECONDS: "histogram",
@@ -507,6 +510,7 @@ const MetricDescription = {
 	KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "Total step status forwards received",
 	KICI_REGISTRATIONS_TOTAL: "Total user registrations (new personal orgs created on first login)",
 	KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "Errors encountered while registering universal-git provider bundles",
+	KICI_USER_REGISTRATION_NOTIFY_TOTAL: "New-user Telegram notifications by result (sent|failed)",
 	KICI_VALKEY_CONNECTION_STATUS: "Valkey connection status per role (1=connected, 0=disconnected)",
 	KICI_VALKEY_PUBLISH_TOTAL: "Total messages published to Valkey channels",
 	KICI_VALKEY_RELAY_LATENCY_SECONDS: "Latency of cross-instance Valkey relay operations in seconds",
@@ -648,6 +652,7 @@ const MetricService = {
 	KICI_PLATFORM_STEP_STATUS_FORWARDS_TOTAL: "platform",
 	KICI_REGISTRATIONS_TOTAL: "platform",
 	KICI_UNIVERSAL_GIT_REGISTRATION_ERRORS_TOTAL: "orchestrator",
+	KICI_USER_REGISTRATION_NOTIFY_TOTAL: "platform",
 	KICI_VALKEY_CONNECTION_STATUS: "platform",
 	KICI_VALKEY_PUBLISH_TOTAL: "platform",
 	KICI_VALKEY_RELAY_LATENCY_SECONDS: "platform",
@@ -783,6 +788,7 @@ const ALL_METRIC_NAMES = [
 	"kici_platform_step_status_forwards_total",
 	"kici_registrations_total",
 	"kici_universal_git_registration_errors_total",
+	"kici_user_registration_notify_total",
 	"kici_valkey_connection_status",
 	"kici_valkey_publish_total",
 	"kici_valkey_relay_latency_seconds",

package/dist/protocol/messages/dashboard.d.ts

@@ -105,6 +105,14 @@ export declare const dashboardJobDetailSchema: z.ZodObject<{
         errorMessage: z.ZodNullable<z.ZodString>;
         stepType: z.ZodOptional<z.ZodString>;
         secretsAccessed: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        checkOutcome: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            skipped: "skipped";
+            applied: "applied";
+            declined: "declined";
+            "dry-run": "dry-run";
+            no_check: "no_check";
+        }>>>;
+        driftSummary: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
 /** Response with full run detail (correlates to dashboard.run.detail). */
@@ -164,6 +172,14 @@ export declare const dashboardRunDetailResponseSchema: z.ZodObject<{
             errorMessage: z.ZodNullable<z.ZodString>;
             stepType: z.ZodOptional<z.ZodString>;
             secretsAccessed: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+            checkOutcome: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+                skipped: "skipped";
+                applied: "applied";
+                declined: "declined";
+                "dry-run": "dry-run";
+                no_check: "no_check";
+            }>>>;
+            driftSummary: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
     trustContext: z.ZodOptional<z.ZodObject<{
@@ -2615,6 +2631,11 @@ export declare const testRelayTriggerRequestSchema: z.ZodObject<{
     cliPublicKey: z.ZodOptional<z.ZodString>;
     inlineLockFile: z.ZodOptional<z.ZodString>;
     fullRepo: z.ZodOptional<z.ZodBoolean>;
+    checkMode: z.ZodOptional<z.ZodEnum<{
+        apply: "apply";
+        check: "check";
+        "check-fail-on-drift": "check-fail-on-drift";
+    }>>;
     secrets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     encryptedSecrets: z.ZodOptional<z.ZodString>;
     encryptedSecretsKey: z.ZodOptional<z.ZodString>;
@@ -4313,6 +4334,11 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
     cliPublicKey: z.ZodOptional<z.ZodString>;
     inlineLockFile: z.ZodOptional<z.ZodString>;
     fullRepo: z.ZodOptional<z.ZodBoolean>;
+    checkMode: z.ZodOptional<z.ZodEnum<{
+        apply: "apply";
+        check: "check";
+        "check-fail-on-drift": "check-fail-on-drift";
+    }>>;
     secrets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     encryptedSecrets: z.ZodOptional<z.ZodString>;
     encryptedSecretsKey: z.ZodOptional<z.ZodString>;
@@ -4445,6 +4471,14 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             errorMessage: z.ZodNullable<z.ZodString>;
             stepType: z.ZodOptional<z.ZodString>;
             secretsAccessed: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+            checkOutcome: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+                skipped: "skipped";
+                applied: "applied";
+                declined: "declined";
+                "dry-run": "dry-run";
+                no_check: "no_check";
+            }>>>;
+            driftSummary: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
     trustContext: z.ZodOptional<z.ZodObject<{
@@ -5552,6 +5586,14 @@ export declare const dashboardRunDetailApiResponseSchema: z.ZodObject<{
             errorMessage: z.ZodNullable<z.ZodString>;
             stepType: z.ZodOptional<z.ZodString>;
             secretsAccessed: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+            checkOutcome: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+                skipped: "skipped";
+                applied: "applied";
+                declined: "declined";
+                "dry-run": "dry-run";
+                no_check: "no_check";
+            }>>>;
+            driftSummary: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
     trustContext: z.ZodOptional<z.ZodObject<{
@@ -5566,6 +5608,11 @@ export declare const dashboardRunDetailApiResponseSchema: z.ZodObject<{
         }>>;
         contributorUsername: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>>;
+    checkMode: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        apply: "apply";
+        check: "check";
+        "check-fail-on-drift": "check-fail-on-drift";
+    }>>>;
     initFailure: z.ZodOptional<z.ZodObject<{
         scope: z.ZodEnum<{
             run: "run";

package/dist/protocol/messages/dashboard.js

@@ -1,4 +1,5 @@
 import "../../chunk-BTugEXQM.js";
+import { CheckMode, CheckStepOutcome } from "../../check-mode.js";
 import { actorPrincipalSchema } from "./actor.js";
 import { initFailureSchema } from "./execution-status.js";
 import { SourceSubtype } from "./source-registration.js";
@@ -41,7 +42,11 @@ const dashboardStepDetailSchema = z.object({
 	/** Step type (e.g., 'hook:onCancel', 'hook:cleanup'). Omitted for regular steps. */
 	stepType: z.string().optional(),
 	/** Secret context names accessed by this step. null = tracking not available. */
-	secretsAccessed: z.array(z.string()).nullable().optional()
+	secretsAccessed: z.array(z.string()).nullable().optional(),
+	/** Idempotent per-step outcome under a check mode. null/absent for non-check runs. */
+	checkOutcome: CheckStepOutcome.nullable().optional(),
+	/** Human-readable drift summary, present when the step reported drift. */
+	driftSummary: z.string().nullable().optional()
 });
 /** Job detail within a run detail response. */
 const dashboardJobDetailSchema = z.object({
@@ -1424,6 +1429,8 @@ const testRelayTriggerRequestSchema = z.object({
 	cliPublicKey: z.string().optional(),
 	inlineLockFile: z.string().optional(),
 	fullRepo: z.boolean().optional(),
+	/** Run mode for idempotent steps; relayed onto the dispatch event. Omitted = apply. */
+	checkMode: CheckMode.optional(),
 	secrets: z.record(z.string(), z.string()).optional(),
 	encryptedSecrets: z.string().optional(),
 	encryptedSecretsKey: z.string().optional()
@@ -1625,6 +1632,8 @@ const dashboardOrchToPlatformSchema = z.discriminatedUnion("type", [
 const dashboardRunDetailApiResponseSchema = z.object({
 	jobs: z.array(dashboardJobDetailSchema),
 	trustContext: trustContextSchema.optional(),
+	/** Run mode for idempotent steps. A non-apply value labels the run a check-mode preview. */
+	checkMode: CheckMode.nullable().optional(),
 	/**
 	* Structured init-failure signal for runs that never started a step. Set
 	* when the run row was created via `recordInitFailureRun()` on the

package/dist/protocol/messages/execution-status.d.ts

@@ -21,6 +21,7 @@ export declare const ExecutionRunStatus: z.ZodEnum<{
 export type ExecutionRunStatus = z.infer<typeof ExecutionRunStatus>;
 /** Status values for execution jobs (execution_jobs table + job.status protocol messages). */
 export declare const ExecutionJobStatus: z.ZodEnum<{
+    skipped: "skipped";
     success: "success";
     pending: "pending";
     running: "running";
@@ -29,17 +30,16 @@ export declare const ExecutionJobStatus: z.ZodEnum<{
     cancelling: "cancelling";
     queued: "queued";
     recovering: "recovering";
-    skipped: "skipped";
     timed_out_stale: "timed_out_stale";
     drift_dropped: "drift_dropped";
 }>;
 export type ExecutionJobStatus = z.infer<typeof ExecutionJobStatus>;
 /** Status values for execution steps (execution_steps table + step.status protocol messages). */
 export declare const ExecutionStepStatus: z.ZodEnum<{
+    skipped: "skipped";
     success: "success";
     running: "running";
     failed: "failed";
-    skipped: "skipped";
 }>;
 export type ExecutionStepStatus = z.infer<typeof ExecutionStepStatus>;
 /**
@@ -112,8 +112,8 @@ export type CacheRunEventType = z.infer<typeof CacheRunEventType>;
  *  - `error`   — the restore/save failed (pack/extract/transport error).
  */
 export declare const CacheOutcome: z.ZodEnum<{
-    error: "error";
     skipped: "skipped";
+    error: "error";
     hit: "hit";
     miss: "miss";
     saved: "saved";
@@ -202,10 +202,10 @@ export declare const stepStatusForwardSchema: z.ZodObject<{
     stepIndex: z.ZodNumber;
     stepName: z.ZodString;
     state: z.ZodEnum<{
+        skipped: "skipped";
         success: "success";
         running: "running";
         failed: "failed";
-        skipped: "skipped";
     }>;
     timestamp: z.ZodNumber;
     data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -219,6 +219,7 @@ export declare const jobStatusForwardSchema: z.ZodObject<{
     jobId: z.ZodString;
     jobName: z.ZodString;
     status: z.ZodEnum<{
+        skipped: "skipped";
         success: "success";
         pending: "pending";
         running: "running";
@@ -227,7 +228,6 @@ export declare const jobStatusForwardSchema: z.ZodObject<{
         cancelling: "cancelling";
         queued: "queued";
         recovering: "recovering";
-        skipped: "skipped";
         timed_out_stale: "timed_out_stale";
         drift_dropped: "drift_dropped";
     }>;

package/dist/protocol/messages/orchestrator-agent.d.ts

@@ -158,6 +158,7 @@ export declare const agentRegisterSchema: z.ZodObject<{
     nodeVersion: z.ZodOptional<z.ZodString>;
     runningAsUser: z.ZodOptional<z.ZodString>;
     runningAsUid: z.ZodOptional<z.ZodNumber>;
+    properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
 }, z.core.$strip>;
 /** Periodic agent status update. */
 export declare const agentStatusSchema: z.ZodObject<{
@@ -176,6 +177,7 @@ export declare const jobStatusSchema: z.ZodObject<{
     runId: z.ZodString;
     jobId: z.ZodString;
     state: z.ZodEnum<{
+        skipped: "skipped";
         success: "success";
         pending: "pending";
         running: "running";
@@ -184,7 +186,6 @@ export declare const jobStatusSchema: z.ZodObject<{
         cancelling: "cancelling";
         queued: "queued";
         recovering: "recovering";
-        skipped: "skipped";
         timed_out_stale: "timed_out_stale";
         drift_dropped: "drift_dropped";
     }>;
@@ -267,10 +268,10 @@ export declare const agentStepStatusSchema: z.ZodObject<{
     stepIndex: z.ZodNumber;
     stepName: z.ZodString;
     state: z.ZodEnum<{
+        skipped: "skipped";
         success: "success";
         running: "running";
         failed: "failed";
-        skipped: "skipped";
     }>;
     timestamp: z.ZodNumber;
     data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -698,6 +699,7 @@ export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[
     nodeVersion: z.ZodOptional<z.ZodString>;
     runningAsUser: z.ZodOptional<z.ZodString>;
     runningAsUid: z.ZodOptional<z.ZodNumber>;
+    properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"agent.status">;
     messageId: z.ZodString;
@@ -712,6 +714,7 @@ export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[
     runId: z.ZodString;
     jobId: z.ZodString;
     state: z.ZodEnum<{
+        skipped: "skipped";
         success: "success";
         pending: "pending";
         running: "running";
@@ -720,7 +723,6 @@ export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[
         cancelling: "cancelling";
         queued: "queued";
         recovering: "recovering";
-        skipped: "skipped";
         timed_out_stale: "timed_out_stale";
         drift_dropped: "drift_dropped";
     }>;
@@ -763,10 +765,10 @@ export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[
     stepIndex: z.ZodNumber;
     stepName: z.ZodString;
     state: z.ZodEnum<{
+        skipped: "skipped";
         success: "success";
         running: "running";
         failed: "failed";
-        skipped: "skipped";
     }>;
     timestamp: z.ZodNumber;
     data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;

package/dist/protocol/messages/orchestrator-agent.js

@@ -224,7 +224,17 @@ const agentRegisterSchema = z.object({
 	/** Username of the OS user running the agent process */
 	runningAsUser: z.string().optional(),
 	/** UID of the OS user running the agent process */
-	runningAsUid: z.number().optional()
+	runningAsUid: z.number().optional(),
+	/**
+	* Agent-reported typed host-vars (the `KICI_PROPERTIES` bag). Values are
+	* `string | number | boolean`; shallow-merged into the host roster's
+	* `host_properties` (agent-reported keys win). Optional — omitted ⇒ none.
+	*/
+	properties: z.record(z.string(), z.union([
+		z.string(),
+		z.number(),
+		z.boolean()
+	])).optional()
 });
 /** Periodic agent status update. */
 const agentStatusSchema = z.object({

package/dist/protocol/messages/peer.d.ts

@@ -214,6 +214,7 @@ export declare const jobProgressSchema: z.ZodObject<{
     stepIndex: z.ZodNumber;
     stepName: z.ZodString;
     state: z.ZodEnum<{
+        skipped: "skipped";
         success: "success";
         pending: "pending";
         running: "running";
@@ -222,13 +223,36 @@ export declare const jobProgressSchema: z.ZodObject<{
         cancelling: "cancelling";
         queued: "queued";
         recovering: "recovering";
-        skipped: "skipped";
         timed_out_stale: "timed_out_stale";
         drift_dropped: "drift_dropped";
     }>;
     timestamp: z.ZodNumber;
     data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strip>;
+/**
+ * Acknowledgement sent coordinator -> worker once the coordinator has applied
+ * a terminal `job.progress` (kind='job') to its run/job DB rows. The worker
+ * uses it to prune the matching record from its durable outbox. Carries
+ * `state` for debuggability; `(runId, jobId)` is the dedup key.
+ */
+export declare const jobProgressAckSchema: z.ZodObject<{
+    type: z.ZodLiteral<"job.progress.ack">;
+    runId: z.ZodString;
+    jobId: z.ZodString;
+    state: z.ZodEnum<{
+        skipped: "skipped";
+        success: "success";
+        pending: "pending";
+        running: "running";
+        failed: "failed";
+        cancelled: "cancelled";
+        cancelling: "cancelling";
+        queued: "queued";
+        recovering: "recovering";
+        timed_out_stale: "timed_out_stale";
+        drift_dropped: "drift_dropped";
+    }>;
+}, z.core.$strip>;
 /** Request to cancel a job on a peer orchestrator. */
 export declare const peerJobCancelSchema: z.ZodObject<{
     type: z.ZodLiteral<"peer.job.cancel">;
@@ -555,6 +579,7 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     stepIndex: z.ZodNumber;
     stepName: z.ZodString;
     state: z.ZodEnum<{
+        skipped: "skipped";
         success: "success";
         pending: "pending";
         running: "running";
@@ -563,12 +588,28 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
         cancelling: "cancelling";
         queued: "queued";
         recovering: "recovering";
-        skipped: "skipped";
         timed_out_stale: "timed_out_stale";
         drift_dropped: "drift_dropped";
     }>;
     timestamp: z.ZodNumber;
     data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"job.progress.ack">;
+    runId: z.ZodString;
+    jobId: z.ZodString;
+    state: z.ZodEnum<{
+        skipped: "skipped";
+        success: "success";
+        pending: "pending";
+        running: "running";
+        failed: "failed";
+        cancelled: "cancelled";
+        cancelling: "cancelling";
+        queued: "queued";
+        recovering: "recovering";
+        timed_out_stale: "timed_out_stale";
+        drift_dropped: "drift_dropped";
+    }>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"peer.job.cancel">;
     runId: z.ZodString;
@@ -839,6 +880,7 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     stepIndex: z.ZodNumber;
     stepName: z.ZodString;
     state: z.ZodEnum<{
+        skipped: "skipped";
         success: "success";
         pending: "pending";
         running: "running";
@@ -847,12 +889,28 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
         cancelling: "cancelling";
         queued: "queued";
         recovering: "recovering";
-        skipped: "skipped";
         timed_out_stale: "timed_out_stale";
         drift_dropped: "drift_dropped";
     }>;
     timestamp: z.ZodNumber;
     data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"job.progress.ack">;
+    runId: z.ZodString;
+    jobId: z.ZodString;
+    state: z.ZodEnum<{
+        skipped: "skipped";
+        success: "success";
+        pending: "pending";
+        running: "running";
+        failed: "failed";
+        cancelled: "cancelled";
+        cancelling: "cancelling";
+        queued: "queued";
+        recovering: "recovering";
+        timed_out_stale: "timed_out_stale";
+        drift_dropped: "drift_dropped";
+    }>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"peer.job.cancel">;
     runId: z.ZodString;
@@ -964,6 +1022,7 @@ export type ScalerCapacitySummary = z.infer<typeof scalerCapacitySummarySchema>;
 export type PeerHeartbeat = z.infer<typeof peerHeartbeatSchema>;
 export type JobReroute = z.infer<typeof jobRerouteSchema>;
 export type JobProgress = z.infer<typeof jobProgressSchema>;
+export type JobProgressAck = z.infer<typeof jobProgressAckSchema>;
 export type PeerScalerEvent = z.infer<typeof peerScalerEventSchema>;
 export type PeerJobCancel = z.infer<typeof peerJobCancelSchema>;
 export type RaftVoteRequest = z.infer<typeof raftVoteRequestSchema>;

package/dist/protocol/messages/peer.js

@@ -242,6 +242,18 @@ const jobProgressSchema = z.object({
 	timestamp: z.number(),
 	data: z.record(z.string(), z.unknown()).optional()
 });
+/**
+* Acknowledgement sent coordinator -> worker once the coordinator has applied
+* a terminal `job.progress` (kind='job') to its run/job DB rows. The worker
+* uses it to prune the matching record from its durable outbox. Carries
+* `state` for debuggability; `(runId, jobId)` is the dedup key.
+*/
+const jobProgressAckSchema = z.object({
+	type: z.literal("job.progress.ack"),
+	runId: z.string(),
+	jobId: z.string(),
+	state: ExecutionJobStatus
+});
 /** Request to cancel a job on a peer orchestrator. */
 const peerJobCancelSchema = z.object({
 	type: z.literal("peer.job.cancel"),
@@ -408,6 +420,7 @@ const peerToPeerMessageSchema = z.discriminatedUnion("type", [
 	jobRerouteSchema,
 	jobRerouteAckSchema,
 	jobProgressSchema,
+	jobProgressAckSchema,
 	peerJobCancelSchema,
 	raftVoteRequestSchema,
 	raftVoteResponseSchema,
@@ -434,6 +447,7 @@ const peerFromPeerMessageSchema = z.discriminatedUnion("type", [
 	jobRerouteSchema,
 	jobRerouteAckSchema,
 	jobProgressSchema,
+	jobProgressAckSchema,
 	peerJobCancelSchema,
 	raftVoteRequestSchema,
 	raftVoteResponseSchema,
@@ -451,6 +465,6 @@ const peerFromPeerMessageSchema = z.discriminatedUnion("type", [
 	peerScalerEventSchema
 ]);
 //#endregion
-export { fleetSelectionSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema };
+export { fleetSelectionSchema, jobProgressAckSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema };
 
 //# sourceMappingURL=peer.js.map

package/dist/protocol/messages/platform-orchestrator.d.ts

@@ -2006,6 +2006,11 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     cliPublicKey: z.ZodOptional<z.ZodString>;
     inlineLockFile: z.ZodOptional<z.ZodString>;
     fullRepo: z.ZodOptional<z.ZodBoolean>;
+    checkMode: z.ZodOptional<z.ZodEnum<{
+        apply: "apply";
+        check: "check";
+        "check-fail-on-drift": "check-fail-on-drift";
+    }>>;
     secrets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     encryptedSecrets: z.ZodOptional<z.ZodString>;
     encryptedSecretsKey: z.ZodOptional<z.ZodString>;
@@ -2175,10 +2180,10 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
     stepIndex: z.ZodNumber;
     stepName: z.ZodString;
     state: z.ZodEnum<{
+        skipped: "skipped";
         success: "success";
         running: "running";
         failed: "failed";
-        skipped: "skipped";
     }>;
     timestamp: z.ZodNumber;
     data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -2190,6 +2195,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
     jobId: z.ZodString;
     jobName: z.ZodString;
     status: z.ZodEnum<{
+        skipped: "skipped";
         success: "success";
         pending: "pending";
         running: "running";
@@ -2198,7 +2204,6 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
         cancelling: "cancelling";
         queued: "queued";
         recovering: "recovering";
-        skipped: "skipped";
         timed_out_stale: "timed_out_stale";
         drift_dropped: "drift_dropped";
     }>;

package/dist/trigger/types.d.ts

@@ -21,7 +21,7 @@ import type { ProviderType } from '../provider/types.js';
 import type { ApproverClause } from '../approval/types.js';
 import { LabelMatcher } from '../labels-match.js';
 /** Schema version - increment on breaking changes */
-export declare const SCHEMA_VERSION: 20;
+export declare const SCHEMA_VERSION: 21;
 /**
  * Normalized approval config carried in the lock file. Produced by the compiler
  * from an SDK `requireApproval` at any of the three levels; consumed by the

package/dist/trigger/types.js

@@ -20,7 +20,7 @@ import { z } from "zod";
 * Schema version 20: runsOn/runsOnAll/excludeLabels carry LabelMatcher (exact|regex) for glob+regex selectors.
 */
 /** Schema version - increment on breaking changes */
-const SCHEMA_VERSION = 20;
+const SCHEMA_VERSION = 21;
 /** Type guard for inline expression values */
 function isLockInlineValue(value) {
 	return typeof value === "object" && value !== null && value._type === "inline";

package/dist/webhook/webhook-url-format.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Route shape for a GitHub App webhook. Org-scoped, NOT app-scoped — the app
+ * id does not appear, so the URL is resolvable before the App exists (the
+ * manifest setup flow needs it up front to bake into the App manifest). Shared
+ * by the Platform's webhook-URL builder and the orchestrator's manifest
+ * pre-flight so the two never drift.
+ */
+export declare function githubWebhookPath(orgId: string): string;
+//# sourceMappingURL=webhook-url-format.d.ts.map

package/dist/webhook/webhook-url-format.js

@@ -0,0 +1,16 @@
+import "../chunk-BTugEXQM.js";
+//#region src/webhook/webhook-url-format.ts
+/**
+* Route shape for a GitHub App webhook. Org-scoped, NOT app-scoped — the app
+* id does not appear, so the URL is resolvable before the App exists (the
+* manifest setup flow needs it up front to bake into the App manifest). Shared
+* by the Platform's webhook-URL builder and the orchestrator's manifest
+* pre-flight so the two never drift.
+*/
+function githubWebhookPath(orgId) {
+	return `/webhook/${orgId}/github`;
+}
+//#endregion
+export { githubWebhookPath };
+
+//# sourceMappingURL=webhook-url-format.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/engine",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
   "keywords": [
     "ci",

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/engine@0.1.19",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.1.19/b27c071d-c5fa-4ce5-8cc6-dee8f3175625",
+  "name": "@kici-dev/engine@0.1.21",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.1.21/e80a4720-81f4-4549-ae95-80ee7a5c127e",
   "creationInfo": {
-    "created": "2026-06-19T05:11:01Z",
+    "created": "2026-06-23T05:10:06Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -54,7 +54,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.19",
+      "versionInfo": "0.1.21",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -65,7 +65,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.19"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.21"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",