@kici-dev/engine 0.1.21 → 0.1.22

package/dist/approval/types.d.ts

@@ -2,7 +2,7 @@
  * Shared approval requirement + clause types.
  *
  * One normalized `ApprovalRequirement` is produced by both approval triggers —
- * a mandatory environment policy and an explicit SDK `requireApproval` — and is
+ * a mandatory environment policy and an explicit SDK `approval` config — and is
  * consumed identically by the orchestrator gate, the resolver, the held-run
  * store, and the agent step round-trip. Pure Zod (no node built-ins), so this
  * module is safe in the browser-facing engine barrel.

package/dist/approval/types.js

@@ -5,7 +5,7 @@ import { z } from "zod";
 * Shared approval requirement + clause types.
 *
 * One normalized `ApprovalRequirement` is produced by both approval triggers —
-* a mandatory environment policy and an explicit SDK `requireApproval` — and is
+* a mandatory environment policy and an explicit SDK `approval` config — and is
 * consumed identically by the orchestrator gate, the resolver, the held-run
 * store, and the agent step round-trip. Pure Zod (no node built-ins), so this
 * module is safe in the browser-facing engine barrel.

package/dist/audit/access-log-policy.js

@@ -111,6 +111,10 @@ const POLICY_BY_ACTION = {
 		kind: "rate_limit",
 		perMinutePerActor: 1
 	},
+	"fleet.read": {
+		kind: "rate_limit",
+		perMinutePerActor: 1
+	},
 	"run.payload.read": { kind: "always" },
 	"run.cancel": { kind: "always" },
 	"run.rerun": { kind: "always" },
@@ -137,6 +141,7 @@ const POLICY_BY_ACTION = {
 	"secret_scope.rename": { kind: "always" },
 	"secret_scope.delete": { kind: "always" },
 	"held_run.approve": { kind: "always" },
+	"held_run.auto_approve": { kind: "always" },
 	"held_run.reject": { kind: "always" },
 	"held_run.request": { kind: "always" },
 	"held_run.expire": { kind: "always" },
@@ -145,6 +150,8 @@ const POLICY_BY_ACTION = {
 	"backend.sync": { kind: "always" },
 	"backend.sync.one": { kind: "always" },
 	"backend.test": { kind: "always" },
+	"fleet.host.declare": { kind: "always" },
+	"fleet.host.remove": { kind: "always" },
 	"global_workflows.update": { kind: "always" },
 	"org_settings.dashboard_write_policy.update": { kind: "always" },
 	"cluster_name.update": { kind: "always" },

package/dist/audit/retention-policy.js

@@ -32,6 +32,7 @@ const ACCESS_LOG_WARM_DAYS = {
 	"diagnostics.read": 30,
 	"scaler.capacity.read": 30,
 	"scaler.agents.read": 30,
+	"fleet.read": 30,
 	"event_log.detail.read": 180,
 	"event_log.payload.read": 180,
 	"run.payload.read": 180,
@@ -53,6 +54,7 @@ const ACCESS_LOG_WARM_DAYS = {
 	"source_override.delete": 180,
 	"env_binding.set": 180,
 	"held_run.approve": 180,
+	"held_run.auto_approve": 180,
 	"held_run.reject": 180,
 	"held_run.request": 180,
 	"held_run.expire": 180,
@@ -61,6 +63,8 @@ const ACCESS_LOG_WARM_DAYS = {
 	"backend.sync": 180,
 	"backend.sync.one": 180,
 	"backend.test": 180,
+	"fleet.host.declare": 180,
+	"fleet.host.remove": 180,
 	"global_workflows.update": 180,
 	"org_settings.dashboard_write_policy.update": 180,
 	"cluster_name.update": 180,
@@ -270,6 +274,7 @@ const ACCESS_LOG_COLD_DAYS = {
 	"diagnostics.read": 30,
 	"scaler.capacity.read": 30,
 	"scaler.agents.read": 30,
+	"fleet.read": 30,
 	"event_log.detail.read": 730,
 	"event_log.payload.read": 730,
 	"run.payload.read": 730,
@@ -291,6 +296,7 @@ const ACCESS_LOG_COLD_DAYS = {
 	"source_override.delete": 730,
 	"env_binding.set": 730,
 	"held_run.approve": 730,
+	"held_run.auto_approve": 730,
 	"held_run.reject": 730,
 	"held_run.request": 730,
 	"held_run.expire": 730,
@@ -299,6 +305,8 @@ const ACCESS_LOG_COLD_DAYS = {
 	"backend.sync": 730,
 	"backend.sync.one": 730,
 	"backend.test": 730,
+	"fleet.host.declare": 730,
+	"fleet.host.remove": 730,
 	"global_workflows.update": 730,
 	"org_settings.dashboard_write_policy.update": 730,
 	"cluster_name.update": 730,

package/dist/fanout/materialize.d.ts

@@ -12,14 +12,31 @@ export declare enum VariantKind {
     host = "host"
 }
 /**
- * Thrown when a job's matrix cannot be materialized into dispatchable children:
- * zero combinations after exclude, or more combinations than {@link MAX_FANOUT_JOBS}.
- * Callers map this onto the `matrix_expansion` init-failure category.
+ * Why a fan-out produced no dispatchable children. Drives whether the zeroed
+ * job's synthetic terminal row is recorded as a failure or a skip:
+ *
+ * - `error` — a genuine failure: invalid matrix (zero combinations / over the
+ *   cap), an unavailable roster, or `onUnreachable: 'fail'` with an absent host.
+ *   The synthetic job is `failed`.
+ * - `narrowed-empty` — the fan-out intentionally resolved to zero usable hosts
+ *   (e.g. `onUnreachable: 'skip'` skipped every unreachable host). The synthetic
+ *   job is `skipped`.
+ */
+export declare enum FanoutCause {
+    error = "error",
+    narrowedEmpty = "narrowed-empty"
+}
+/**
+ * Thrown when a job's fan-out cannot be materialized into dispatchable children:
+ * an invalid matrix, an unavailable / zeroed host roster. The `cause` discriminates
+ * a genuine failure from an intentional narrow-to-empty so the caller can record
+ * the zeroed job's synthetic row as `failed` or `skipped` accordingly.
  */
 export declare class FanoutError extends Error {
     readonly jobName: string;
+    readonly cause: FanoutCause;
     readonly name = "FanoutError";
-    constructor(jobName: string, message: string);
+    constructor(jobName: string, message: string, cause?: FanoutCause);
 }
 /**
  * A roster host resolved as a target of a `runsOnAll` fan-out. Carries the

package/dist/fanout/materialize.js

@@ -15,16 +15,35 @@ let VariantKind = /* @__PURE__ */ function(VariantKind) {
 	return VariantKind;
 }({});
 /**
-* Thrown when a job's matrix cannot be materialized into dispatchable children:
-* zero combinations after exclude, or more combinations than {@link MAX_FANOUT_JOBS}.
-* Callers map this onto the `matrix_expansion` init-failure category.
+* Why a fan-out produced no dispatchable children. Drives whether the zeroed
+* job's synthetic terminal row is recorded as a failure or a skip:
+*
+* - `error` — a genuine failure: invalid matrix (zero combinations / over the
+*   cap), an unavailable roster, or `onUnreachable: 'fail'` with an absent host.
+*   The synthetic job is `failed`.
+* - `narrowed-empty` — the fan-out intentionally resolved to zero usable hosts
+*   (e.g. `onUnreachable: 'skip'` skipped every unreachable host). The synthetic
+*   job is `skipped`.
+*/
+let FanoutCause = /* @__PURE__ */ function(FanoutCause) {
+	FanoutCause["error"] = "error";
+	FanoutCause["narrowedEmpty"] = "narrowed-empty";
+	return FanoutCause;
+}({});
+/**
+* Thrown when a job's fan-out cannot be materialized into dispatchable children:
+* an invalid matrix, an unavailable / zeroed host roster. The `cause` discriminates
+* a genuine failure from an intentional narrow-to-empty so the caller can record
+* the zeroed job's synthetic row as `failed` or `skipped` accordingly.
 */
 var FanoutError = class FanoutError extends Error {
 	jobName;
+	cause;
 	name = "FanoutError";
-	constructor(jobName, message) {
+	constructor(jobName, message, cause = "error") {
 		super(message);
 		this.jobName = jobName;
+		this.cause = cause;
 		Object.setPrototypeOf(this, FanoutError.prototype);
 	}
 };
@@ -171,6 +190,6 @@ function materializeFanout(staticJobs) {
 	};
 }
 //#endregion
-export { FanoutError, MAX_FANOUT_JOBS, VariantKind, hostEnvelopeFields, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields };
+export { FanoutCause, FanoutError, MAX_FANOUT_JOBS, VariantKind, hostEnvelopeFields, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields };
 
 //# sourceMappingURL=materialize.js.map

package/dist/index.d.ts

@@ -15,6 +15,7 @@ export * from './protocol/messages/auth.js';
 export * from './protocol/messages/capabilities.js';
 export { webhookRelaySchema, webhookRelayStartSchema, webhookRelayChunkSchema, webhookAckSchema, WebhookRelayResult, WEBHOOK_RELAY_MAX_BODY_BYTES, WEBHOOK_RELAY_CHUNK_SIZE, executionEventSchema, logChunkSchema, peerDiscoverSchema, peerUpdateSchema, cacheStatsSchema, orchMetricsSchema, platformToOrchestratorMessageSchema, orchestratorToPlatformMessageSchema, type WebhookRelay, type WebhookRelayStart, type WebhookRelayChunk, type WebhookAck, type LogChunk, type PeerDiscover, type PeerUpdate, type CacheStats, type OrchMetrics, trustPolicyUpdateSchema, type TrustPolicyUpdate, staleCheckrunCleanupSchema, type StaleCheckrunCleanup, type PlatformToOrchestratorMessage, type OrchestratorToPlatformMessage, } from './protocol/messages/platform-orchestrator.js';
 export * from './protocol/messages/execution-status.js';
+export * from './protocol/messages/deployment-identity.js';
 export * from './protocol/messages/scaler-event.js';
 export * from './protocol/messages/event-log.js';
 export * from './protocol/messages/access-log.js';
@@ -48,7 +49,7 @@ export * from './environment/index.js';
 export { deriveOsArchLabels, hostLabel, parseHostLabel, HOST_LABEL_PREFIX, agentTypeLabel, scalerLabel, mergeAutoLabels, normalizeRunsOn, KNOWN_ROLES, resolveRoleLabels, validateNoReservedLabels, scalerAgentLabels, isSelfReportedLabel, SELF_REPORTED_LABEL_PREFIXES, } from './labels.js';
 export type { NormalizedRunsOn } from './labels.js';
 export type { AgentRole } from './labels.js';
-export { LabelMatcher, matcherMatches, matcherSatisfiedBy, partitionMatchers, compileRegexMatcher, } from './labels-match.js';
+export { LabelMatcher, matcherMatches, matcherSatisfiedBy, partitionMatchers, compileRegexMatcher, HostTargetValue, HostTargetSelector, hostSatisfiesTarget, } from './labels-match.js';
 export * from './inventory.js';
 export * from './scaler/scaler-backend-type.js';
 export * from './scaler/resource-types.js';

package/dist/index.js

@@ -6,14 +6,17 @@ import { ActorType, actorPrincipalSchema, apiKeyActorSchema, flattenActor, parse
 import { ORCH_CAPABILITIES, OrchRole, hasOrchCapability, orchCapabilitiesSchema } from "./protocol/messages/capabilities.js";
 import { authFailureSchema, authRequestSchema, authSuccessSchema } from "./protocol/messages/auth.js";
 import { CacheOutcome, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema } from "./protocol/messages/execution-status.js";
+import { DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema } from "./protocol/messages/deployment-identity.js";
 import { SourceProvider, SourceSubtype, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema } from "./protocol/messages/source-registration.js";
 import { AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, accessLogFilterSchema, accessLogItemSchema, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema } from "./protocol/messages/access-log.js";
 import { browserJobContextSchema, browserRunEventSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, jobContextMessageSchema, runEventMessageSchema } from "./protocol/messages/run-events.js";
 import { EventLogSource, EventLogStatus, PayloadOmittedReason } from "./protocol/messages/event-log.js";
 import { ScalerBackendType } from "./scaler/scaler-backend-type.js";
 import { ApprovalDecision, HoldScope, TriggerSource, approvalRequirementSchema, approverClauseSchema } from "./approval/types.js";
-import { IfFailedPolicy, NeedsEntrySchema, NeedsGroupEntrySchema, OnUnreachableMode, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob } from "./trigger/types.js";
-import { EnvDeleteErrorCode, EventLogPayloadStreamError, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListItemSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
+import { NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, resolveWhenToRunOn } from "./trigger/types.js";
+import { HostTargetSelector, HostTargetValue, LabelMatcher, compileRegexMatcher, hostSatisfiesTarget, matcherMatches, matcherSatisfiedBy, partitionMatchers } from "./labels-match.js";
+import { HostInventoryEntry, HostPropertyValue, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, coerceHostPropertyValue, parseHostPropertyAssignments } from "./inventory.js";
+import { EnvDeleteErrorCode, EventLogPayloadStreamError, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListItemSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
 import { WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, cacheStatsSchema, executionEventSchema, logChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema } from "./protocol/messages/platform-orchestrator.js";
 import { ScalerEventType } from "./protocol/messages/scaler-event.js";
 import { AccessLogPolicyKind, POLICY_BY_ACTION, fnv1a32, shouldRecordAccess, shouldRecordSecretResolve } from "./audit/access-log-policy.js";
@@ -23,9 +26,8 @@ import { logPullOrchToPlatformSchema, logPullPlatformToOrchSchema } from "./prot
 import { EVENT_LOG_PAYLOAD_CHUNK_BYTES } from "./protocol/event-log-payload.js";
 import { browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, platformToBrowserMessageSchema } from "./protocol/messages/browser.js";
 import { joinRequestSchema, joinResponseSchema } from "./protocol/messages/join.js";
-import { LabelMatcher, compileRegexMatcher, matcherMatches, matcherSatisfiedBy, partitionMatchers } from "./labels-match.js";
 import { fleetSelectionSchema, jobProgressAckSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema } from "./protocol/messages/peer.js";
-import { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema } from "./protocol/messages/orchestrator-agent.js";
+import { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema } from "./protocol/messages/orchestrator-agent.js";
 import { TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES } from "./trigger/trigger-event-type.js";
 import { createTraceEntry, createWorkflowDecision } from "./trigger/decision-trace.js";
 import { matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchWorkflowTriggers } from "./trigger/matcher.js";
@@ -42,12 +44,11 @@ import "./secrets/index.js";
 import { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix } from "./environment/scope-resolver.js";
 import "./environment/index.js";
 import { HOST_LABEL_PREFIX, KNOWN_ROLES, SELF_REPORTED_LABEL_PREFIXES, agentTypeLabel, deriveOsArchLabels, hostLabel, isSelfReportedLabel, mergeAutoLabels, normalizeRunsOn, parseHostLabel, resolveRoleLabels, scalerAgentLabels, scalerLabel, validateNoReservedLabels } from "./labels.js";
-import { HostInventoryEntry, HostPropertyValue, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, coerceHostPropertyValue, parseHostPropertyAssignments } from "./inventory.js";
 import { parseMemoryString, resourceRequestNestedSchema, resourceSpecSchema, validateResourceRequest } from "./scaler/resource-types.js";
 import { RegisterableTriggerType } from "./registration/registerable-trigger-type.js";
 import { createWorkflowBundleConfig } from "./bundler/rolldown-config.js";
 import "./bundler/index.js";
 import { applyIncludeExclude, expandMatrix, expandMultiDimension, expandSingleDimension } from "./matrix/expand.js";
 import { formatExpandedJobName, formatMatrixSuffix } from "./matrix/format.js";
-import { FanoutError, MAX_FANOUT_JOBS, VariantKind, hostEnvelopeFields, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields } from "./fanout/materialize.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, ApprovalDecision, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutError, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HostInventoryEntry, HostPropertyValue, IfFailedPolicy, InitFailureCategory, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, MAX_FANOUT_JOBS, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, ORCH_CAPABILITIES, OnUnreachableMode, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, StepApprovalOutcome, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TestRelayType, TimeoutReason, TriggerSource, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approverClauseSchema, attestationListItemSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, coerceHostPropertyValue, compileRegexMatcher, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, githubWebhookPath, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };
+import { FanoutCause, FanoutError, MAX_FANOUT_JOBS, VariantKind, hostEnvelopeFields, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields } from "./fanout/materialize.js";
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, ApprovalDecision, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, InitFailureCategory, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, MAX_FANOUT_JOBS, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_CAPABILITIES, OnUnreachableMode, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, StepApprovalOutcome, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TestRelayType, TimeoutReason, TriggerSource, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approverClauseSchema, attestationListItemSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, coerceHostPropertyValue, compileRegexMatcher, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, githubWebhookPath, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };

package/dist/inventory.d.ts

@@ -30,8 +30,8 @@ export type InventoryLifecycleClass = z.infer<typeof InventoryLifecycleClass>;
  * awaiting reap).
  */
 export declare const InventoryHostStatus: z.ZodEnum<{
-    unreachable: "unreachable";
     ready: "ready";
+    unreachable: "unreachable";
     stale: "stale";
 }>;
 export type InventoryHostStatus = z.infer<typeof InventoryHostStatus>;
@@ -48,8 +48,8 @@ export declare const HostInventoryEntry: z.ZodObject<{
         ephemeral: "ephemeral";
     }>;
     status: z.ZodEnum<{
-        unreachable: "unreachable";
         ready: "ready";
+        unreachable: "unreachable";
         stale: "stale";
     }>;
     lastSeen: z.ZodString;

package/dist/labels-match.d.ts

@@ -24,6 +24,58 @@ export declare function compileRegexMatcher(m: {
 export declare function matcherMatches(m: LabelMatcher, label: string): boolean;
 /** Whether some label in the set satisfies the matcher. */
 export declare function matcherSatisfiedBy(m: LabelMatcher, labels: ReadonlySet<string>): boolean;
+export declare const HostTargetValue: z.ZodObject<{
+    include: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"exact">;
+        value: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"regex">;
+        source: z.ZodString;
+        flags: z.ZodString;
+    }, z.core.$strip>], "kind">>;
+    exclude: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"exact">;
+        value: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"regex">;
+        source: z.ZodString;
+        flags: z.ZodString;
+    }, z.core.$strip>], "kind">>;
+}, z.core.$strip>;
+export type HostTargetValue = z.infer<typeof HostTargetValue>;
+/**
+ * A runtime host narrowing (`kici run --target`): each repeated value is an AND
+ * set; values AND-combine. Narrow-only — applied as a post-filter over the
+ * runsOnAll-matched roster. `allowEmpty` selects the zero-host outcome: skip
+ * (true) vs fail (false).
+ */
+export declare const HostTargetSelector: z.ZodObject<{
+    values: z.ZodArray<z.ZodObject<{
+        include: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"exact">;
+            value: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"regex">;
+            source: z.ZodString;
+            flags: z.ZodString;
+        }, z.core.$strip>], "kind">>;
+        exclude: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"exact">;
+            value: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"regex">;
+            source: z.ZodString;
+            flags: z.ZodString;
+        }, z.core.$strip>], "kind">>;
+    }, z.core.$strip>>;
+    allowEmpty: z.ZodBoolean;
+}, z.core.$strip>;
+export type HostTargetSelector = z.infer<typeof HostTargetSelector>;
+/**
+ * True iff the host's labels satisfy EVERY target value: all of a value's
+ * include matchers match and none of its exclude matchers match.
+ */
+export declare function hostSatisfiesTarget(labels: ReadonlySet<string>, target: HostTargetSelector): boolean;
 /** Split a matcher list into exact label strings and the remaining regex matchers. */
 export declare function partitionMatchers(ms: readonly LabelMatcher[]): {
     exact: string[];

package/dist/labels-match.js

@@ -38,6 +38,27 @@ function matcherSatisfiedBy(m, labels) {
 	for (const label of labels) if (re.test(label)) return true;
 	return false;
 }
+const HostTargetValue = z.object({
+	include: z.array(LabelMatcher),
+	exclude: z.array(LabelMatcher)
+});
+/**
+* A runtime host narrowing (`kici run --target`): each repeated value is an AND
+* set; values AND-combine. Narrow-only — applied as a post-filter over the
+* runsOnAll-matched roster. `allowEmpty` selects the zero-host outcome: skip
+* (true) vs fail (false).
+*/
+const HostTargetSelector = z.object({
+	values: z.array(HostTargetValue).min(1),
+	allowEmpty: z.boolean()
+});
+/**
+* True iff the host's labels satisfy EVERY target value: all of a value's
+* include matchers match and none of its exclude matchers match.
+*/
+function hostSatisfiesTarget(labels, target) {
+	return target.values.every((v) => v.include.every((m) => matcherSatisfiedBy(m, labels)) && !v.exclude.some((m) => matcherSatisfiedBy(m, labels)));
+}
 /** Split a matcher list into exact label strings and the remaining regex matchers. */
 function partitionMatchers(ms) {
 	const exact = [];
@@ -51,6 +72,6 @@ function partitionMatchers(ms) {
 	};
 }
 //#endregion
-export { LabelMatcher, compileRegexMatcher, matcherMatches, matcherSatisfiedBy, partitionMatchers };
+export { HostTargetSelector, HostTargetValue, LabelMatcher, compileRegexMatcher, hostSatisfiesTarget, matcherMatches, matcherSatisfiedBy, partitionMatchers };
 
 //# sourceMappingURL=labels-match.js.map

package/dist/protocol/dashboard-write-operations.d.ts

@@ -44,6 +44,8 @@ export declare const DashboardWriteOperation: z.ZodEnum<{
     "backends.sync": "backends.sync";
     "backends.sync_one": "backends.sync_one";
     "backends.test": "backends.test";
+    "fleet.host.declare": "fleet.host.declare";
+    "fleet.host.remove": "fleet.host.remove";
 }>;
 export type DashboardWriteOperation = z.infer<typeof DashboardWriteOperation>;
 /** Stable list of every operation in enum-declaration order. */
@@ -57,6 +59,7 @@ export declare const DashboardWriteCategory: z.ZodEnum<{
     DLQ: "DLQ";
     Registrations: "Registrations";
     Topology: "Topology";
+    Fleet: "Fleet";
 }>;
 export type DashboardWriteCategory = z.infer<typeof DashboardWriteCategory>;
 export declare const DashboardWriteSensitivity: z.ZodEnum<{
@@ -130,6 +133,8 @@ export declare const dashboardWritePolicyMap: z.ZodRecord<z.ZodEnum<{
     "backends.sync": "backends.sync";
     "backends.sync_one": "backends.sync_one";
     "backends.test": "backends.test";
+    "fleet.host.declare": "fleet.host.declare";
+    "fleet.host.remove": "fleet.host.remove";
 }> & z.core.$partial, z.ZodBoolean>;
 export declare const dashboardWritePolicyMapSchema: z.ZodDefault<z.ZodRecord<z.ZodEnum<{
     "secrets.set": "secrets.set";
@@ -156,6 +161,8 @@ export declare const dashboardWritePolicyMapSchema: z.ZodDefault<z.ZodRecord<z.Z
     "backends.sync": "backends.sync";
     "backends.sync_one": "backends.sync_one";
     "backends.test": "backends.test";
+    "fleet.host.declare": "fleet.host.declare";
+    "fleet.host.remove": "fleet.host.remove";
 }> & z.core.$partial, z.ZodBoolean>>;
 /**
  * Resolve the effective state of an operation given a (possibly sparse)
@@ -164,7 +171,7 @@ export declare const dashboardWritePolicyMapSchema: z.ZodDefault<z.ZodRecord<z.Z
 export declare function isDashboardWriteOperationEnabled(policy: DashboardWritePolicyMap | null | undefined, op: DashboardWriteOperation): boolean;
 /**
  * Expand a (possibly sparse) policy map into the full effective state
- * for all 24 operations. Operations the policy doesn't mention come
+ * for all 26 operations. Operations the policy doesn't mention come
  * back as `true` (permissive). Used by the orch HTTP admin response,
  * the WS `orch.capabilities` broadcast, and the dashboard's policy
  * page so consumers see the full picture, not the sparse storage shape.

package/dist/protocol/dashboard-write-operations.js

@@ -45,7 +45,9 @@ const DashboardWriteOperation = z.enum([
 	"global_workflows.update",
 	"backends.sync",
 	"backends.sync_one",
-	"backends.test"
+	"backends.test",
+	"fleet.host.declare",
+	"fleet.host.remove"
 ]);
 /** Stable list of every operation in enum-declaration order. */
 const DASHBOARD_WRITE_OPERATION_VALUES = Object.freeze([
@@ -72,7 +74,9 @@ const DASHBOARD_WRITE_OPERATION_VALUES = Object.freeze([
 	"global_workflows.update",
 	"backends.sync",
 	"backends.sync_one",
-	"backends.test"
+	"backends.test",
+	"fleet.host.declare",
+	"fleet.host.remove"
 ]);
 const DashboardWriteCategory = z.enum([
 	"Secrets",
@@ -82,7 +86,8 @@ const DashboardWriteCategory = z.enum([
 	"Held runs",
 	"DLQ",
 	"Registrations",
-	"Topology"
+	"Topology",
+	"Fleet"
 ]);
 const DashboardWriteSensitivity = z.enum([
 	"plaintext",
@@ -281,6 +286,22 @@ const DASHBOARD_WRITE_OPERATIONS = Object.freeze([
 		label: "Test scaler backend",
 		sensitivity: "dispatch",
 		cliEquivalent: "kici-admin backend test"
+	},
+	{
+		name: "fleet.host.declare",
+		wireMessageType: "dashboard.fleet.host.declare",
+		category: "Fleet",
+		label: "Declare a static host",
+		sensitivity: "dispatch",
+		cliEquivalent: "kici-admin host declare"
+	},
+	{
+		name: "fleet.host.remove",
+		wireMessageType: "dashboard.fleet.host.remove",
+		category: "Fleet",
+		label: "Remove a host from the roster",
+		sensitivity: "dispatch",
+		cliEquivalent: "kici-admin host remove"
 	}
 ]);
 /** O(1) lookup of a descriptor by operation name. */
@@ -318,7 +339,7 @@ function isDashboardWriteOperationEnabled(policy, op) {
 }
 /**
 * Expand a (possibly sparse) policy map into the full effective state
-* for all 24 operations. Operations the policy doesn't mention come
+* for all 26 operations. Operations the policy doesn't mention come
 * back as `true` (permissive). Used by the orch HTTP admin response,
 * the WS `orch.capabilities` broadcast, and the dashboard's policy
 * page so consumers see the full picture, not the sparse storage shape.