@kici-dev/engine 0.1.20 → 0.1.22

package/dist/approval/types.d.ts

@@ -2,7 +2,7 @@
  * Shared approval requirement + clause types.
  *
  * One normalized `ApprovalRequirement` is produced by both approval triggers —
- * a mandatory environment policy and an explicit SDK `requireApproval` — and is
+ * a mandatory environment policy and an explicit SDK `approval` config — and is
  * consumed identically by the orchestrator gate, the resolver, the held-run
  * store, and the agent step round-trip. Pure Zod (no node built-ins), so this
  * module is safe in the browser-facing engine barrel.

package/dist/approval/types.js

@@ -5,7 +5,7 @@ import { z } from "zod";
 * Shared approval requirement + clause types.
 *
 * One normalized `ApprovalRequirement` is produced by both approval triggers —
-* a mandatory environment policy and an explicit SDK `requireApproval` — and is
+* a mandatory environment policy and an explicit SDK `approval` config — and is
 * consumed identically by the orchestrator gate, the resolver, the held-run
 * store, and the agent step round-trip. Pure Zod (no node built-ins), so this
 * module is safe in the browser-facing engine barrel.

package/dist/audit/access-log-policy.js

@@ -111,6 +111,10 @@ const POLICY_BY_ACTION = {
 		kind: "rate_limit",
 		perMinutePerActor: 1
 	},
+	"fleet.read": {
+		kind: "rate_limit",
+		perMinutePerActor: 1
+	},
 	"run.payload.read": { kind: "always" },
 	"run.cancel": { kind: "always" },
 	"run.rerun": { kind: "always" },
@@ -137,6 +141,7 @@ const POLICY_BY_ACTION = {
 	"secret_scope.rename": { kind: "always" },
 	"secret_scope.delete": { kind: "always" },
 	"held_run.approve": { kind: "always" },
+	"held_run.auto_approve": { kind: "always" },
 	"held_run.reject": { kind: "always" },
 	"held_run.request": { kind: "always" },
 	"held_run.expire": { kind: "always" },
@@ -145,6 +150,8 @@ const POLICY_BY_ACTION = {
 	"backend.sync": { kind: "always" },
 	"backend.sync.one": { kind: "always" },
 	"backend.test": { kind: "always" },
+	"fleet.host.declare": { kind: "always" },
+	"fleet.host.remove": { kind: "always" },
 	"global_workflows.update": { kind: "always" },
 	"org_settings.dashboard_write_policy.update": { kind: "always" },
 	"cluster_name.update": { kind: "always" },

package/dist/audit/retention-policy.js

@@ -32,6 +32,7 @@ const ACCESS_LOG_WARM_DAYS = {
 	"diagnostics.read": 30,
 	"scaler.capacity.read": 30,
 	"scaler.agents.read": 30,
+	"fleet.read": 30,
 	"event_log.detail.read": 180,
 	"event_log.payload.read": 180,
 	"run.payload.read": 180,
@@ -53,6 +54,7 @@ const ACCESS_LOG_WARM_DAYS = {
 	"source_override.delete": 180,
 	"env_binding.set": 180,
 	"held_run.approve": 180,
+	"held_run.auto_approve": 180,
 	"held_run.reject": 180,
 	"held_run.request": 180,
 	"held_run.expire": 180,
@@ -61,6 +63,8 @@ const ACCESS_LOG_WARM_DAYS = {
 	"backend.sync": 180,
 	"backend.sync.one": 180,
 	"backend.test": 180,
+	"fleet.host.declare": 180,
+	"fleet.host.remove": 180,
 	"global_workflows.update": 180,
 	"org_settings.dashboard_write_policy.update": 180,
 	"cluster_name.update": 180,
@@ -270,6 +274,7 @@ const ACCESS_LOG_COLD_DAYS = {
 	"diagnostics.read": 30,
 	"scaler.capacity.read": 30,
 	"scaler.agents.read": 30,
+	"fleet.read": 30,
 	"event_log.detail.read": 730,
 	"event_log.payload.read": 730,
 	"run.payload.read": 730,
@@ -291,6 +296,7 @@ const ACCESS_LOG_COLD_DAYS = {
 	"source_override.delete": 730,
 	"env_binding.set": 730,
 	"held_run.approve": 730,
+	"held_run.auto_approve": 730,
 	"held_run.reject": 730,
 	"held_run.request": 730,
 	"held_run.expire": 730,
@@ -299,6 +305,8 @@ const ACCESS_LOG_COLD_DAYS = {
 	"backend.sync": 730,
 	"backend.sync.one": 730,
 	"backend.test": 730,
+	"fleet.host.declare": 730,
+	"fleet.host.remove": 730,
 	"global_workflows.update": 730,
 	"org_settings.dashboard_write_policy.update": 730,
 	"cluster_name.update": 730,

package/dist/check-mode.d.ts

@@ -0,0 +1,33 @@
+import { z } from 'zod';
+/**
+ * How a run executes idempotent steps.
+ *
+ * - `apply` (default): converge — per step, check(); on drift apply(); else in sync.
+ * - `check`: report what would change, changing nothing (always succeeds; report-only).
+ * - `check-fail-on-drift`: like check, but the run fails if any step reports drift.
+ */
+export declare const CheckMode: z.ZodEnum<{
+    apply: "apply";
+    check: "check";
+    "check-fail-on-drift": "check-fail-on-drift";
+}>;
+export type CheckMode = z.infer<typeof CheckMode>;
+/**
+ * Per-step idempotent outcome. The first four mirror the StepOutcome union in
+ * @kici-dev/core/idempotency verbatim (skipped | applied | declined | dry-run);
+ * `no_check` covers a plain step (no check facet) skipped under check mode
+ * because it cannot be safely previewed.
+ *
+ * Orthogonal to ExecutionStepStatus (success | failed | skipped), which stays the
+ * top-level status. Dashboard chips map: applied -> "applied", skipped -> "in sync",
+ * dry-run -> "would change", no_check -> "no check".
+ */
+export declare const CheckStepOutcome: z.ZodEnum<{
+    skipped: "skipped";
+    applied: "applied";
+    declined: "declined";
+    "dry-run": "dry-run";
+    no_check: "no_check";
+}>;
+export type CheckStepOutcome = z.infer<typeof CheckStepOutcome>;
+//# sourceMappingURL=check-mode.d.ts.map

package/dist/check-mode.js

@@ -0,0 +1,36 @@
+import "./chunk-BTugEXQM.js";
+import { z } from "zod";
+//#region src/check-mode.ts
+/**
+* How a run executes idempotent steps.
+*
+* - `apply` (default): converge — per step, check(); on drift apply(); else in sync.
+* - `check`: report what would change, changing nothing (always succeeds; report-only).
+* - `check-fail-on-drift`: like check, but the run fails if any step reports drift.
+*/
+const CheckMode = z.enum([
+	"apply",
+	"check",
+	"check-fail-on-drift"
+]);
+/**
+* Per-step idempotent outcome. The first four mirror the StepOutcome union in
+* @kici-dev/core/idempotency verbatim (skipped | applied | declined | dry-run);
+* `no_check` covers a plain step (no check facet) skipped under check mode
+* because it cannot be safely previewed.
+*
+* Orthogonal to ExecutionStepStatus (success | failed | skipped), which stays the
+* top-level status. Dashboard chips map: applied -> "applied", skipped -> "in sync",
+* dry-run -> "would change", no_check -> "no check".
+*/
+const CheckStepOutcome = z.enum([
+	"skipped",
+	"applied",
+	"declined",
+	"dry-run",
+	"no_check"
+]);
+//#endregion
+export { CheckMode, CheckStepOutcome };
+
+//# sourceMappingURL=check-mode.js.map

package/dist/fanout/materialize.d.ts

@@ -12,14 +12,31 @@ export declare enum VariantKind {
     host = "host"
 }
 /**
- * Thrown when a job's matrix cannot be materialized into dispatchable children:
- * zero combinations after exclude, or more combinations than {@link MAX_FANOUT_JOBS}.
- * Callers map this onto the `matrix_expansion` init-failure category.
+ * Why a fan-out produced no dispatchable children. Drives whether the zeroed
+ * job's synthetic terminal row is recorded as a failure or a skip:
+ *
+ * - `error` — a genuine failure: invalid matrix (zero combinations / over the
+ *   cap), an unavailable roster, or `onUnreachable: 'fail'` with an absent host.
+ *   The synthetic job is `failed`.
+ * - `narrowed-empty` — the fan-out intentionally resolved to zero usable hosts
+ *   (e.g. `onUnreachable: 'skip'` skipped every unreachable host). The synthetic
+ *   job is `skipped`.
+ */
+export declare enum FanoutCause {
+    error = "error",
+    narrowedEmpty = "narrowed-empty"
+}
+/**
+ * Thrown when a job's fan-out cannot be materialized into dispatchable children:
+ * an invalid matrix, an unavailable / zeroed host roster. The `cause` discriminates
+ * a genuine failure from an intentional narrow-to-empty so the caller can record
+ * the zeroed job's synthetic row as `failed` or `skipped` accordingly.
  */
 export declare class FanoutError extends Error {
     readonly jobName: string;
+    readonly cause: FanoutCause;
     readonly name = "FanoutError";
-    constructor(jobName: string, message: string);
+    constructor(jobName: string, message: string, cause?: FanoutCause);
 }
 /**
  * A roster host resolved as a target of a `runsOnAll` fan-out. Carries the

package/dist/fanout/materialize.js

@@ -15,16 +15,35 @@ let VariantKind = /* @__PURE__ */ function(VariantKind) {
 	return VariantKind;
 }({});
 /**
-* Thrown when a job's matrix cannot be materialized into dispatchable children:
-* zero combinations after exclude, or more combinations than {@link MAX_FANOUT_JOBS}.
-* Callers map this onto the `matrix_expansion` init-failure category.
+* Why a fan-out produced no dispatchable children. Drives whether the zeroed
+* job's synthetic terminal row is recorded as a failure or a skip:
+*
+* - `error` — a genuine failure: invalid matrix (zero combinations / over the
+*   cap), an unavailable roster, or `onUnreachable: 'fail'` with an absent host.
+*   The synthetic job is `failed`.
+* - `narrowed-empty` — the fan-out intentionally resolved to zero usable hosts
+*   (e.g. `onUnreachable: 'skip'` skipped every unreachable host). The synthetic
+*   job is `skipped`.
+*/
+let FanoutCause = /* @__PURE__ */ function(FanoutCause) {
+	FanoutCause["error"] = "error";
+	FanoutCause["narrowedEmpty"] = "narrowed-empty";
+	return FanoutCause;
+}({});
+/**
+* Thrown when a job's fan-out cannot be materialized into dispatchable children:
+* an invalid matrix, an unavailable / zeroed host roster. The `cause` discriminates
+* a genuine failure from an intentional narrow-to-empty so the caller can record
+* the zeroed job's synthetic row as `failed` or `skipped` accordingly.
 */
 var FanoutError = class FanoutError extends Error {
 	jobName;
+	cause;
 	name = "FanoutError";
-	constructor(jobName, message) {
+	constructor(jobName, message, cause = "error") {
 		super(message);
 		this.jobName = jobName;
+		this.cause = cause;
 		Object.setPrototypeOf(this, FanoutError.prototype);
 	}
 };
@@ -171,6 +190,6 @@ function materializeFanout(staticJobs) {
 	};
 }
 //#endregion
-export { FanoutError, MAX_FANOUT_JOBS, VariantKind, hostEnvelopeFields, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields };
+export { FanoutCause, FanoutError, MAX_FANOUT_JOBS, VariantKind, hostEnvelopeFields, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields };
 
 //# sourceMappingURL=materialize.js.map

package/dist/index.d.ts

@@ -15,6 +15,7 @@ export * from './protocol/messages/auth.js';
 export * from './protocol/messages/capabilities.js';
 export { webhookRelaySchema, webhookRelayStartSchema, webhookRelayChunkSchema, webhookAckSchema, WebhookRelayResult, WEBHOOK_RELAY_MAX_BODY_BYTES, WEBHOOK_RELAY_CHUNK_SIZE, executionEventSchema, logChunkSchema, peerDiscoverSchema, peerUpdateSchema, cacheStatsSchema, orchMetricsSchema, platformToOrchestratorMessageSchema, orchestratorToPlatformMessageSchema, type WebhookRelay, type WebhookRelayStart, type WebhookRelayChunk, type WebhookAck, type LogChunk, type PeerDiscover, type PeerUpdate, type CacheStats, type OrchMetrics, trustPolicyUpdateSchema, type TrustPolicyUpdate, staleCheckrunCleanupSchema, type StaleCheckrunCleanup, type PlatformToOrchestratorMessage, type OrchestratorToPlatformMessage, } from './protocol/messages/platform-orchestrator.js';
 export * from './protocol/messages/execution-status.js';
+export * from './protocol/messages/deployment-identity.js';
 export * from './protocol/messages/scaler-event.js';
 export * from './protocol/messages/event-log.js';
 export * from './protocol/messages/access-log.js';
@@ -37,6 +38,7 @@ export * from './trigger/decision-trace.js';
 export * from './trigger/matcher.js';
 export * from './state-machine/index.js';
 export * from './provider/index.js';
+export { githubWebhookPath } from './webhook/webhook-url-format.js';
 export type { WsLike } from './ws/ws-like.js';
 export * from './ws/close-codes.js';
 export { WsRateLimiter } from './ws/rate-limiter.js';
@@ -47,7 +49,8 @@ export * from './environment/index.js';
 export { deriveOsArchLabels, hostLabel, parseHostLabel, HOST_LABEL_PREFIX, agentTypeLabel, scalerLabel, mergeAutoLabels, normalizeRunsOn, KNOWN_ROLES, resolveRoleLabels, validateNoReservedLabels, scalerAgentLabels, isSelfReportedLabel, SELF_REPORTED_LABEL_PREFIXES, } from './labels.js';
 export type { NormalizedRunsOn } from './labels.js';
 export type { AgentRole } from './labels.js';
-export { LabelMatcher, matcherMatches, matcherSatisfiedBy, partitionMatchers, compileRegexMatcher, } from './labels-match.js';
+export { LabelMatcher, matcherMatches, matcherSatisfiedBy, partitionMatchers, compileRegexMatcher, HostTargetValue, HostTargetSelector, hostSatisfiesTarget, } from './labels-match.js';
+export * from './inventory.js';
 export * from './scaler/scaler-backend-type.js';
 export * from './scaler/resource-types.js';
 export * from './registration/registerable-trigger-type.js';
@@ -55,4 +58,5 @@ export * from './bundler/index.js';
 export { expandSingleDimension, expandMultiDimension, expandMatrix, applyIncludeExclude, type StaticMatrixArray, type StaticMatrixObject, type MatrixInclude, type MatrixExclude, type MatrixValues, } from './matrix/expand.js';
 export { formatMatrixSuffix, formatExpandedJobName } from './matrix/format.js';
 export * from './fanout/materialize.js';
+export * from './check-mode.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,18 +1,22 @@
 import "./chunk-BTugEXQM.js";
+import { CheckMode, CheckStepOutcome } from "./check-mode.js";
 import { MIN_PROTOCOL_VERSION, PROTOCOL_VERSION } from "./protocol/version.js";
 import { WS_MAX_PAYLOAD_BYTES, ackSchema, errorSchema, heartbeatSchema, nackSchema } from "./protocol/messages/common.js";
 import { ActorType, actorPrincipalSchema, apiKeyActorSchema, flattenActor, parseActor, platformOperatorActorSchema, serviceAccountActorSchema, stringifyActor, systemActorSchema, userActorSchema } from "./protocol/messages/actor.js";
 import { ORCH_CAPABILITIES, OrchRole, hasOrchCapability, orchCapabilitiesSchema } from "./protocol/messages/capabilities.js";
 import { authFailureSchema, authRequestSchema, authSuccessSchema } from "./protocol/messages/auth.js";
 import { CacheOutcome, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema } from "./protocol/messages/execution-status.js";
+import { DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema } from "./protocol/messages/deployment-identity.js";
 import { SourceProvider, SourceSubtype, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema } from "./protocol/messages/source-registration.js";
 import { AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, accessLogFilterSchema, accessLogItemSchema, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema } from "./protocol/messages/access-log.js";
 import { browserJobContextSchema, browserRunEventSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, jobContextMessageSchema, runEventMessageSchema } from "./protocol/messages/run-events.js";
 import { EventLogSource, EventLogStatus, PayloadOmittedReason } from "./protocol/messages/event-log.js";
 import { ScalerBackendType } from "./scaler/scaler-backend-type.js";
 import { ApprovalDecision, HoldScope, TriggerSource, approvalRequirementSchema, approverClauseSchema } from "./approval/types.js";
-import { IfFailedPolicy, NeedsEntrySchema, NeedsGroupEntrySchema, OnUnreachableMode, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob } from "./trigger/types.js";
-import { EnvDeleteErrorCode, EventLogPayloadStreamError, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListItemSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
+import { NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, resolveWhenToRunOn } from "./trigger/types.js";
+import { HostTargetSelector, HostTargetValue, LabelMatcher, compileRegexMatcher, hostSatisfiesTarget, matcherMatches, matcherSatisfiedBy, partitionMatchers } from "./labels-match.js";
+import { HostInventoryEntry, HostPropertyValue, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, coerceHostPropertyValue, parseHostPropertyAssignments } from "./inventory.js";
+import { EnvDeleteErrorCode, EventLogPayloadStreamError, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListItemSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
 import { WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, cacheStatsSchema, executionEventSchema, logChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema } from "./protocol/messages/platform-orchestrator.js";
 import { ScalerEventType } from "./protocol/messages/scaler-event.js";
 import { AccessLogPolicyKind, POLICY_BY_ACTION, fnv1a32, shouldRecordAccess, shouldRecordSecretResolve } from "./audit/access-log-policy.js";
@@ -22,9 +26,8 @@ import { logPullOrchToPlatformSchema, logPullPlatformToOrchSchema } from "./prot
 import { EVENT_LOG_PAYLOAD_CHUNK_BYTES } from "./protocol/event-log-payload.js";
 import { browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, platformToBrowserMessageSchema } from "./protocol/messages/browser.js";
 import { joinRequestSchema, joinResponseSchema } from "./protocol/messages/join.js";
-import { LabelMatcher, compileRegexMatcher, matcherMatches, matcherSatisfiedBy, partitionMatchers } from "./labels-match.js";
-import { fleetSelectionSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema } from "./protocol/messages/peer.js";
-import { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema } from "./protocol/messages/orchestrator-agent.js";
+import { fleetSelectionSchema, jobProgressAckSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema } from "./protocol/messages/peer.js";
+import { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema } from "./protocol/messages/orchestrator-agent.js";
 import { TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES } from "./trigger/trigger-event-type.js";
 import { createTraceEntry, createWorkflowDecision } from "./trigger/decision-trace.js";
 import { matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchWorkflowTriggers } from "./trigger/matcher.js";
@@ -33,6 +36,7 @@ import "./state-machine/index.js";
 import { LockFileParseError } from "./provider/lock-file-parse-error.js";
 import { CheckRunConclusion } from "./provider/check-run-conclusion.js";
 import "./provider/index.js";
+import { githubWebhookPath } from "./webhook/webhook-url-format.js";
 import { WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED } from "./ws/close-codes.js";
 import { WsRateLimiter } from "./ws/rate-limiter.js";
 import { AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, KICI_AGENT_ENV_PREFIX, SANDBOX_DEFAULT_VARS } from "./env/environment-allowlist.js";
@@ -46,5 +50,5 @@ import { createWorkflowBundleConfig } from "./bundler/rolldown-config.js";
 import "./bundler/index.js";
 import { applyIncludeExclude, expandMatrix, expandMultiDimension, expandSingleDimension } from "./matrix/expand.js";
 import { formatExpandedJobName, formatMatrixSuffix } from "./matrix/format.js";
-import { FanoutError, MAX_FANOUT_JOBS, VariantKind, hostEnvelopeFields, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields } from "./fanout/materialize.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, ApprovalDecision, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckRunConclusion, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutError, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, IfFailedPolicy, InitFailureCategory, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, MAX_FANOUT_JOBS, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, ORCH_CAPABILITIES, OnUnreachableMode, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, StepApprovalOutcome, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TestRelayType, TimeoutReason, TriggerSource, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approverClauseSchema, attestationListItemSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, compileRegexMatcher, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };
+import { FanoutCause, FanoutError, MAX_FANOUT_JOBS, VariantKind, hostEnvelopeFields, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields } from "./fanout/materialize.js";
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, ApprovalDecision, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, InitFailureCategory, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, MAX_FANOUT_JOBS, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_CAPABILITIES, OnUnreachableMode, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, StepApprovalOutcome, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TestRelayType, TimeoutReason, TriggerSource, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approverClauseSchema, attestationListItemSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, coerceHostPropertyValue, compileRegexMatcher, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, githubWebhookPath, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };

package/dist/inventory.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Canonical, workflow-queryable host inventory schema.
+ *
+ * One `HostInventoryEntry` is the single shape every inventory consumer reads:
+ * the orchestrator's roster store maps each `host_roster` row to it, the
+ * `inventory.query`/`inventory.get` agent-API RPC returns it, and the SDK's
+ * `ctx.kici.inventory` types it. Labels stay the flat-string grouping
+ * dimension (the shipped runsOnAll glob/regex matchers operate on flat
+ * strings); `properties` is the separate typed host-vars dimension.
+ */
+import { z } from 'zod';
+import { LabelMatcher } from './labels-match.js';
+/** A single host-property value — the typed host-vars dimension. */
+export declare const HostPropertyValue: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+export type HostPropertyValue = z.infer<typeof HostPropertyValue>;
+/**
+ * Lifecycle class of a roster host. Mirrors the orchestrator's `LifecycleClass`
+ * (the auth token's `agent_type` snapshot): `static` hosts persist and alarm on
+ * absence; `ephemeral` hosts are GC'd past their ttl.
+ */
+export declare const InventoryLifecycleClass: z.ZodEnum<{
+    static: "static";
+    ephemeral: "ephemeral";
+}>;
+export type InventoryLifecycleClass = z.infer<typeof InventoryLifecycleClass>;
+/**
+ * Read-time derived status of a roster host. Mirrors the orchestrator's
+ * `HostStatus` values: `ready` (live + fresh heartbeat), `unreachable`
+ * (declared static host not currently live), `stale` (ephemeral past ttl,
+ * awaiting reap).
+ */
+export declare const InventoryHostStatus: z.ZodEnum<{
+    ready: "ready";
+    unreachable: "unreachable";
+    stale: "stale";
+}>;
+export type InventoryHostStatus = z.infer<typeof InventoryHostStatus>;
+/** Canonical queryable inventory record for one roster host. */
+export declare const HostInventoryEntry: z.ZodObject<{
+    agentId: z.ZodString;
+    labels: z.ZodArray<z.ZodString>;
+    properties: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    hostname: z.ZodNullable<z.ZodString>;
+    platform: z.ZodNullable<z.ZodString>;
+    arch: z.ZodNullable<z.ZodString>;
+    lifecycleClass: z.ZodEnum<{
+        static: "static";
+        ephemeral: "ephemeral";
+    }>;
+    status: z.ZodEnum<{
+        ready: "ready";
+        unreachable: "unreachable";
+        stale: "stale";
+    }>;
+    lastSeen: z.ZodString;
+}, z.core.$strip>;
+export type HostInventoryEntry = z.infer<typeof HostInventoryEntry>;
+/**
+ * Label selector for `inventory.query`. Reuses the shipped `LabelMatcher`
+ * (glob/regex) semantics: `include` is an OR-of-AND group list, `exclude`
+ * removes any host whose labels satisfy a matcher. Omit ⇒ all hosts.
+ * Property filtering is done client-side in the workflow (full JS).
+ */
+export interface InventorySelector {
+    include?: (readonly LabelMatcher[])[];
+    exclude?: LabelMatcher[];
+}
+/** Zod validator for the `inventory.query` selector params on the wire. */
+export declare const InventorySelectorSchema: z.ZodObject<{
+    include: z.ZodOptional<z.ZodArray<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"exact">;
+        value: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"regex">;
+        source: z.ZodString;
+        flags: z.ZodString;
+    }, z.core.$strip>], "kind">>>>;
+    exclude: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"exact">;
+        value: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"regex">;
+        source: z.ZodString;
+        flags: z.ZodString;
+    }, z.core.$strip>], "kind">>>;
+}, z.core.$strip>;
+/**
+ * Coerce a raw string into a typed {@link HostPropertyValue}: `true`/`false` ⇒
+ * boolean, a finite integer/decimal literal ⇒ number, everything else ⇒ the
+ * verbatim string. The single source of truth for the `key=value` typing used
+ * by both `kici-admin host declare --prop` and the agent's `KICI_PROPERTIES`.
+ */
+export declare function coerceHostPropertyValue(raw: string): HostPropertyValue;
+/**
+ * Parse a list of `key=value` property assignments into a typed property bag.
+ * Values are typed via {@link coerceHostPropertyValue}. Throws on a malformed
+ * entry (missing `=`) or an empty key. Used by the host-declare CLI `--prop`
+ * option and the agent's `KICI_PROPERTIES` config parse.
+ */
+export declare function parseHostPropertyAssignments(values: string[]): Record<string, HostPropertyValue>;
+//# sourceMappingURL=inventory.d.ts.map

package/dist/inventory.js

@@ -0,0 +1,89 @@
+import "./chunk-BTugEXQM.js";
+import { LabelMatcher } from "./labels-match.js";
+import { z } from "zod";
+//#region src/inventory.ts
+/**
+* Canonical, workflow-queryable host inventory schema.
+*
+* One `HostInventoryEntry` is the single shape every inventory consumer reads:
+* the orchestrator's roster store maps each `host_roster` row to it, the
+* `inventory.query`/`inventory.get` agent-API RPC returns it, and the SDK's
+* `ctx.kici.inventory` types it. Labels stay the flat-string grouping
+* dimension (the shipped runsOnAll glob/regex matchers operate on flat
+* strings); `properties` is the separate typed host-vars dimension.
+*/
+/** A single host-property value — the typed host-vars dimension. */
+const HostPropertyValue = z.union([
+	z.string(),
+	z.number(),
+	z.boolean()
+]);
+/**
+* Lifecycle class of a roster host. Mirrors the orchestrator's `LifecycleClass`
+* (the auth token's `agent_type` snapshot): `static` hosts persist and alarm on
+* absence; `ephemeral` hosts are GC'd past their ttl.
+*/
+const InventoryLifecycleClass = z.enum(["static", "ephemeral"]);
+/**
+* Read-time derived status of a roster host. Mirrors the orchestrator's
+* `HostStatus` values: `ready` (live + fresh heartbeat), `unreachable`
+* (declared static host not currently live), `stale` (ephemeral past ttl,
+* awaiting reap).
+*/
+const InventoryHostStatus = z.enum([
+	"ready",
+	"unreachable",
+	"stale"
+]);
+/** Canonical queryable inventory record for one roster host. */
+const HostInventoryEntry = z.object({
+	agentId: z.string(),
+	/** Flat-string grouping/tags dimension (runsOnAll selectors operate on these). */
+	labels: z.array(z.string()),
+	/** Typed host-vars dimension (the ansible host-vars analogue). */
+	properties: z.record(z.string(), HostPropertyValue),
+	hostname: z.string().nullable(),
+	platform: z.string().nullable(),
+	arch: z.string().nullable(),
+	lifecycleClass: InventoryLifecycleClass,
+	status: InventoryHostStatus,
+	/** ISO 8601 timestamp of the last heartbeat. */
+	lastSeen: z.string()
+});
+/** Zod validator for the `inventory.query` selector params on the wire. */
+const InventorySelectorSchema = z.object({
+	include: z.array(z.array(LabelMatcher)).optional(),
+	exclude: z.array(LabelMatcher).optional()
+});
+/**
+* Coerce a raw string into a typed {@link HostPropertyValue}: `true`/`false` ⇒
+* boolean, a finite integer/decimal literal ⇒ number, everything else ⇒ the
+* verbatim string. The single source of truth for the `key=value` typing used
+* by both `kici-admin host declare --prop` and the agent's `KICI_PROPERTIES`.
+*/
+function coerceHostPropertyValue(raw) {
+	if (raw === "true") return true;
+	if (raw === "false") return false;
+	if (raw !== "" && /^-?\d+(\.\d+)?$/.test(raw) && Number.isFinite(Number(raw))) return Number(raw);
+	return raw;
+}
+/**
+* Parse a list of `key=value` property assignments into a typed property bag.
+* Values are typed via {@link coerceHostPropertyValue}. Throws on a malformed
+* entry (missing `=`) or an empty key. Used by the host-declare CLI `--prop`
+* option and the agent's `KICI_PROPERTIES` config parse.
+*/
+function parseHostPropertyAssignments(values) {
+	const out = {};
+	for (const entry of values) {
+		const eq = entry.indexOf("=");
+		if (eq <= 0) throw new Error(`Invalid property '${entry}': expected key=value`);
+		const key = entry.slice(0, eq);
+		out[key] = coerceHostPropertyValue(entry.slice(eq + 1));
+	}
+	return out;
+}
+//#endregion
+export { HostInventoryEntry, HostPropertyValue, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, coerceHostPropertyValue, parseHostPropertyAssignments };
+
+//# sourceMappingURL=inventory.js.map