@kici-dev/engine 0.1.21 → 0.1.23

package/dist/fanout/materialize.js

@@ -15,20 +15,63 @@ let VariantKind = /* @__PURE__ */ function(VariantKind) {
 	return VariantKind;
 }({});
 /**
-* Thrown when a job's matrix cannot be materialized into dispatchable children:
-* zero combinations after exclude, or more combinations than {@link MAX_FANOUT_JOBS}.
-* Callers map this onto the `matrix_expansion` init-failure category.
+* Why a fan-out produced no dispatchable children. Drives whether the zeroed
+* job's synthetic terminal row is recorded as a failure or a skip:
+*
+* - `error` — a genuine failure: invalid matrix (zero combinations / over the
+*   cap), an unavailable roster, or `onUnreachable: 'fail'` with an absent host.
+*   The synthetic job is `failed`.
+* - `narrowed-empty` — the fan-out intentionally resolved to zero usable hosts
+*   (e.g. `onUnreachable: 'skip'` skipped every unreachable host). The synthetic
+*   job is `skipped`.
+*/
+let FanoutCause = /* @__PURE__ */ function(FanoutCause) {
+	FanoutCause["error"] = "error";
+	FanoutCause["narrowedEmpty"] = "narrowed-empty";
+	return FanoutCause;
+}({});
+/**
+* Thrown when a job's fan-out cannot be materialized into dispatchable children:
+* an invalid matrix, an unavailable / zeroed host roster. The `cause` discriminates
+* a genuine failure from an intentional narrow-to-empty so the caller can record
+* the zeroed job's synthetic row as `failed` or `skipped` accordingly.
 */
 var FanoutError = class FanoutError extends Error {
 	jobName;
+	cause;
 	name = "FanoutError";
-	constructor(jobName, message) {
+	constructor(jobName, message, cause = "error") {
 		super(message);
 		this.jobName = jobName;
+		this.cause = cause;
 		Object.setPrototypeOf(this, FanoutError.prototype);
 	}
 };
 /**
+* Stamp a deterministic `fanoutIndex`/`fanoutTotal` onto each child of a
+* multi-child fan-out. `fanoutIndex` is the child's rank in the order defined by
+* `keyOf` (host: `agentId`; matrix: variant label), independent of emission
+* order — the orchestrator's wave dispatch keys on `fanoutIndex`, so emission
+* order need not be touched (this preserves the local-executor matrix naming
+* order). A single child gets no position (non-fan-out job; `ctx.fanout` stays
+* undefined). Mutates and returns the same array.
+*/
+function assignFanoutPositions(children, keyOf) {
+	if (children.length <= 1) return children;
+	const total = children.length;
+	const rank = /* @__PURE__ */ new Map();
+	[...children].sort((a, b) => keyOf(a).localeCompare(keyOf(b))).forEach((child, index) => rank.set(child, index));
+	for (const child of children) {
+		child.fanoutIndex = rank.get(child);
+		child.fanoutTotal = total;
+	}
+	return children;
+}
+/** Variant label of a child = the text inside the trailing `(...)` of its expanded name. */
+function variantLabelOf(child) {
+	return child.expandedName.slice(child.baseName.length + 2, -1);
+}
+/**
 * The job-config envelope fields that identify a materialized child: the
 * expanded `name`, the `baseJobName` (what the agent exposes as `ctx.job.name`),
 * and `matrixValues` (exposed as `ctx.matrix`). Every dispatch site spreads
@@ -40,10 +83,22 @@ function matrixEnvelopeFields(mat) {
 	return {
 		name: mat.expandedName,
 		baseJobName: mat.baseName,
-		...mat.variantValues && { matrixValues: mat.variantValues }
+		...mat.variantValues && { matrixValues: mat.variantValues },
+		...fanoutEnvelopeFields(mat)
 	};
 }
 /**
+* The fan-out position envelope fields (`fanoutIndex`/`fanoutTotal`) of a
+* materialized child, shared by the matrix + host envelope builders. Both are
+* present together or absent together (a non-fan-out child has neither).
+*/
+function fanoutEnvelopeFields(mat) {
+	return mat.fanoutTotal !== void 0 ? {
+		fanoutIndex: mat.fanoutIndex,
+		fanoutTotal: mat.fanoutTotal
+	} : {};
+}
+/**
 * Build materialized children from a resolved dynamic-matrix combination list
 * (produced by the agent eval flow). Mirrors the static-matrix branch of
 * {@link materializeFanout} but takes the already-resolved combinations and
@@ -53,21 +108,17 @@ function materializeResolvedMatrix(lockJob, combos) {
 	if (combos.length === 0) throw new FanoutError(lockJob.name, `dynamic matrix for job '${lockJob.name}' resolved to zero combinations`);
 	if (combos.length > 256) throw new FanoutError(lockJob.name, `dynamic matrix for job '${lockJob.name}' resolved to ${combos.length} combinations (max 256)`);
 	const jobs = [];
-	const names = [];
-	for (const variantValues of combos) {
-		const expandedName = formatExpandedJobName(lockJob.name, variantValues);
-		names.push(expandedName);
-		jobs.push({
-			lockJob,
-			baseName: lockJob.name,
-			expandedName,
-			variantKind: "matrix",
-			variantValues
-		});
-	}
+	for (const variantValues of combos) jobs.push({
+		lockJob,
+		baseName: lockJob.name,
+		expandedName: formatExpandedJobName(lockJob.name, variantValues),
+		variantKind: "matrix",
+		variantValues
+	});
+	assignFanoutPositions(jobs, variantLabelOf);
 	return {
 		jobs,
-		expansionMap: new Map([[lockJob.name, names]])
+		expansionMap: new Map([[lockJob.name, jobs.map((j) => j.expandedName)]])
 	};
 }
 /**
@@ -83,7 +134,8 @@ function hostEnvelopeFields(mat) {
 		...mat.pinnedAgentId && { pinnedAgentId: mat.pinnedAgentId },
 		...mat.host && { host: mat.host },
 		...mat.agent && { agent: mat.agent },
-		...mat.connectedInstanceId !== void 0 && { connectedInstanceId: mat.connectedInstanceId }
+		...mat.connectedInstanceId !== void 0 && { connectedInstanceId: mat.connectedInstanceId },
+		...fanoutEnvelopeFields(mat)
 	};
 }
 /**
@@ -97,24 +149,21 @@ function materializeResolvedHosts(lockJob, agents, maxHosts) {
 	if (agents.length === 0) throw new FanoutError(lockJob.name, `runsOnAll for job '${lockJob.name}' matched zero matching hosts`);
 	if (agents.length > maxHosts) throw new FanoutError(lockJob.name, `runsOnAll for job '${lockJob.name}' matched ${agents.length} hosts (max ${maxHosts})`);
 	const jobs = [];
-	const names = [];
-	for (const agent of agents) {
-		const expandedName = `${lockJob.name} (${agent.host})`;
-		names.push(expandedName);
-		jobs.push({
-			lockJob,
-			baseName: lockJob.name,
-			expandedName,
-			variantKind: "host",
-			pinnedAgentId: agent.agentId,
-			host: agent.host,
-			agent,
-			connectedInstanceId: agent.connectedInstanceId ?? null
-		});
-	}
+	for (const agent of agents) jobs.push({
+		lockJob,
+		baseName: lockJob.name,
+		expandedName: `${lockJob.name} (${agent.host})`,
+		variantKind: "host",
+		pinnedAgentId: agent.agentId,
+		host: agent.host,
+		agent,
+		connectedInstanceId: agent.connectedInstanceId ?? null,
+		...agent.needsBringup && { needsBringup: true }
+	});
+	assignFanoutPositions(jobs, (child) => child.pinnedAgentId ?? "");
 	return {
 		jobs,
-		expansionMap: new Map([[lockJob.name, names]])
+		expansionMap: new Map([[lockJob.name, jobs.map((j) => j.expandedName)]])
 	};
 }
 /**
@@ -151,19 +200,16 @@ function materializeFanout(staticJobs) {
 		const combos = applyIncludeExclude(expandMatrix(values), lockJob.include, lockJob.exclude);
 		if (combos.length === 0) throw new FanoutError(lockJob.name, `matrix for job '${lockJob.name}' expands to zero combinations`);
 		if (combos.length > 256) throw new FanoutError(lockJob.name, `matrix for job '${lockJob.name}' expands to ${combos.length} combinations (max 256)`);
-		const names = [];
-		for (const variantValues of combos) {
-			const expandedName = formatExpandedJobName(lockJob.name, variantValues);
-			names.push(expandedName);
-			jobs.push({
-				lockJob,
-				baseName: lockJob.name,
-				expandedName,
-				variantKind: "matrix",
-				variantValues
-			});
-		}
-		expansionMap.set(lockJob.name, names);
+		const children = combos.map((variantValues) => ({
+			lockJob,
+			baseName: lockJob.name,
+			expandedName: formatExpandedJobName(lockJob.name, variantValues),
+			variantKind: "matrix",
+			variantValues
+		}));
+		assignFanoutPositions(children, variantLabelOf);
+		jobs.push(...children);
+		expansionMap.set(lockJob.name, children.map((j) => j.expandedName));
 	}
 	return {
 		jobs,
@@ -171,6 +217,6 @@ function materializeFanout(staticJobs) {
 	};
 }
 //#endregion
-export { FanoutError, MAX_FANOUT_JOBS, VariantKind, hostEnvelopeFields, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields };
+export { FanoutCause, FanoutError, MAX_FANOUT_JOBS, VariantKind, fanoutEnvelopeFields, hostEnvelopeFields, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields };
 
 //# sourceMappingURL=materialize.js.map

package/dist/index.d.ts

@@ -15,6 +15,7 @@ export * from './protocol/messages/auth.js';
 export * from './protocol/messages/capabilities.js';
 export { webhookRelaySchema, webhookRelayStartSchema, webhookRelayChunkSchema, webhookAckSchema, WebhookRelayResult, WEBHOOK_RELAY_MAX_BODY_BYTES, WEBHOOK_RELAY_CHUNK_SIZE, executionEventSchema, logChunkSchema, peerDiscoverSchema, peerUpdateSchema, cacheStatsSchema, orchMetricsSchema, platformToOrchestratorMessageSchema, orchestratorToPlatformMessageSchema, type WebhookRelay, type WebhookRelayStart, type WebhookRelayChunk, type WebhookAck, type LogChunk, type PeerDiscover, type PeerUpdate, type CacheStats, type OrchMetrics, trustPolicyUpdateSchema, type TrustPolicyUpdate, staleCheckrunCleanupSchema, type StaleCheckrunCleanup, type PlatformToOrchestratorMessage, type OrchestratorToPlatformMessage, } from './protocol/messages/platform-orchestrator.js';
 export * from './protocol/messages/execution-status.js';
+export * from './protocol/messages/deployment-identity.js';
 export * from './protocol/messages/scaler-event.js';
 export * from './protocol/messages/event-log.js';
 export * from './protocol/messages/access-log.js';
@@ -35,6 +36,7 @@ export * from './trigger/types.js';
 export * from './trigger/trigger-event-type.js';
 export * from './trigger/decision-trace.js';
 export * from './trigger/matcher.js';
+export * from './inputs/index.js';
 export * from './state-machine/index.js';
 export * from './provider/index.js';
 export { githubWebhookPath } from './webhook/webhook-url-format.js';
@@ -45,10 +47,10 @@ export type { RateLimiterConfig, RateLimitResult } from './ws/rate-limiter.js';
 export * from './env/environment-allowlist.js';
 export * from './secrets/index.js';
 export * from './environment/index.js';
-export { deriveOsArchLabels, hostLabel, parseHostLabel, HOST_LABEL_PREFIX, agentTypeLabel, scalerLabel, mergeAutoLabels, normalizeRunsOn, KNOWN_ROLES, resolveRoleLabels, validateNoReservedLabels, scalerAgentLabels, isSelfReportedLabel, SELF_REPORTED_LABEL_PREFIXES, } from './labels.js';
+export { deriveOsArchLabels, hostLabel, parseHostLabel, HOST_LABEL_PREFIX, agentTypeLabel, scalerLabel, mergeAutoLabels, normalizeRunsOn, KNOWN_ROLES, resolveRoleLabels, validateNoReservedLabels, scalerAgentLabels, isSelfReportedLabel, SELF_REPORTED_LABEL_PREFIXES, CAPABILITY_LABEL_PREFIX, capabilityLabel, SSH_TRANSPORT_CAPABILITY, INIT_LABEL, PRIVILEGED_ROOT_LABEL, } from './labels.js';
 export type { NormalizedRunsOn } from './labels.js';
 export type { AgentRole } from './labels.js';
-export { LabelMatcher, matcherMatches, matcherSatisfiedBy, partitionMatchers, compileRegexMatcher, } from './labels-match.js';
+export { LabelMatcher, matcherMatches, matcherSatisfiedBy, partitionMatchers, compileRegexMatcher, HostTargetValue, HostTargetSelector, hostSatisfiesTarget, } from './labels-match.js';
 export * from './inventory.js';
 export * from './scaler/scaler-backend-type.js';
 export * from './scaler/resource-types.js';

package/dist/index.js

@@ -6,14 +6,17 @@ import { ActorType, actorPrincipalSchema, apiKeyActorSchema, flattenActor, parse
 import { ORCH_CAPABILITIES, OrchRole, hasOrchCapability, orchCapabilitiesSchema } from "./protocol/messages/capabilities.js";
 import { authFailureSchema, authRequestSchema, authSuccessSchema } from "./protocol/messages/auth.js";
 import { CacheOutcome, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema } from "./protocol/messages/execution-status.js";
+import { DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema } from "./protocol/messages/deployment-identity.js";
 import { SourceProvider, SourceSubtype, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema } from "./protocol/messages/source-registration.js";
 import { AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, accessLogFilterSchema, accessLogItemSchema, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema } from "./protocol/messages/access-log.js";
 import { browserJobContextSchema, browserRunEventSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, jobContextMessageSchema, runEventMessageSchema } from "./protocol/messages/run-events.js";
 import { EventLogSource, EventLogStatus, PayloadOmittedReason } from "./protocol/messages/event-log.js";
 import { ScalerBackendType } from "./scaler/scaler-backend-type.js";
 import { ApprovalDecision, HoldScope, TriggerSource, approvalRequirementSchema, approverClauseSchema } from "./approval/types.js";
-import { IfFailedPolicy, NeedsEntrySchema, NeedsGroupEntrySchema, OnUnreachableMode, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob } from "./trigger/types.js";
-import { EnvDeleteErrorCode, EventLogPayloadStreamError, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListItemSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
+import { NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, resolveWhenToRunOn } from "./trigger/types.js";
+import { HostTargetSelector, HostTargetValue, LabelMatcher, compileRegexMatcher, hostSatisfiesTarget, matcherMatches, matcherSatisfiedBy, partitionMatchers } from "./labels-match.js";
+import { HostInventoryEntry, HostPropertyValue, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, coerceHostPropertyValue, parseHostPropertyAssignments } from "./inventory.js";
+import { EnvDeleteErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListItemSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingEntrySchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
 import { WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, cacheStatsSchema, executionEventSchema, logChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema } from "./protocol/messages/platform-orchestrator.js";
 import { ScalerEventType } from "./protocol/messages/scaler-event.js";
 import { AccessLogPolicyKind, POLICY_BY_ACTION, fnv1a32, shouldRecordAccess, shouldRecordSecretResolve } from "./audit/access-log-policy.js";
@@ -23,12 +26,16 @@ import { logPullOrchToPlatformSchema, logPullPlatformToOrchSchema } from "./prot
 import { EVENT_LOG_PAYLOAD_CHUNK_BYTES } from "./protocol/event-log-payload.js";
 import { browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, platformToBrowserMessageSchema } from "./protocol/messages/browser.js";
 import { joinRequestSchema, joinResponseSchema } from "./protocol/messages/join.js";
-import { LabelMatcher, compileRegexMatcher, matcherMatches, matcherSatisfiedBy, partitionMatchers } from "./labels-match.js";
 import { fleetSelectionSchema, jobProgressAckSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema } from "./protocol/messages/peer.js";
-import { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema } from "./protocol/messages/orchestrator-agent.js";
+import { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema } from "./protocol/messages/orchestrator-agent.js";
 import { TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES } from "./trigger/trigger-event-type.js";
 import { createTraceEntry, createWorkflowDecision } from "./trigger/decision-trace.js";
 import { matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchWorkflowTriggers } from "./trigger/matcher.js";
+import { DispatchInputType, InputDescriptor, InputsDescriptorMapSchema } from "./inputs/descriptor.js";
+import { UnsupportedDispatchInputError, extractInputDescriptor, extractInputsDescriptorMap } from "./inputs/extract.js";
+import { buildZodFromDescriptor, buildZodObjectFromMap } from "./inputs/build.js";
+import { DispatchInputError, coerceDispatchInputs, parseInputPairs } from "./inputs/coerce.js";
+import "./inputs/index.js";
 import { isTerminal, transition } from "./state-machine/machine.js";
 import "./state-machine/index.js";
 import { LockFileParseError } from "./provider/lock-file-parse-error.js";
@@ -41,13 +48,12 @@ import { AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, KICI_AGENT_ENV_PREFIX, S
 import "./secrets/index.js";
 import { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix } from "./environment/scope-resolver.js";
 import "./environment/index.js";
-import { HOST_LABEL_PREFIX, KNOWN_ROLES, SELF_REPORTED_LABEL_PREFIXES, agentTypeLabel, deriveOsArchLabels, hostLabel, isSelfReportedLabel, mergeAutoLabels, normalizeRunsOn, parseHostLabel, resolveRoleLabels, scalerAgentLabels, scalerLabel, validateNoReservedLabels } from "./labels.js";
-import { HostInventoryEntry, HostPropertyValue, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, coerceHostPropertyValue, parseHostPropertyAssignments } from "./inventory.js";
+import { CAPABILITY_LABEL_PREFIX, HOST_LABEL_PREFIX, INIT_LABEL, KNOWN_ROLES, PRIVILEGED_ROOT_LABEL, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, agentTypeLabel, capabilityLabel, deriveOsArchLabels, hostLabel, isSelfReportedLabel, mergeAutoLabels, normalizeRunsOn, parseHostLabel, resolveRoleLabels, scalerAgentLabels, scalerLabel, validateNoReservedLabels } from "./labels.js";
 import { parseMemoryString, resourceRequestNestedSchema, resourceSpecSchema, validateResourceRequest } from "./scaler/resource-types.js";
 import { RegisterableTriggerType } from "./registration/registerable-trigger-type.js";
 import { createWorkflowBundleConfig } from "./bundler/rolldown-config.js";
 import "./bundler/index.js";
 import { applyIncludeExclude, expandMatrix, expandMultiDimension, expandSingleDimension } from "./matrix/expand.js";
 import { formatExpandedJobName, formatMatrixSuffix } from "./matrix/format.js";
-import { FanoutError, MAX_FANOUT_JOBS, VariantKind, hostEnvelopeFields, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields } from "./fanout/materialize.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, ApprovalDecision, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutError, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HostInventoryEntry, HostPropertyValue, IfFailedPolicy, InitFailureCategory, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, MAX_FANOUT_JOBS, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, ORCH_CAPABILITIES, OnUnreachableMode, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, StepApprovalOutcome, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TestRelayType, TimeoutReason, TriggerSource, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approverClauseSchema, attestationListItemSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, coerceHostPropertyValue, compileRegexMatcher, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, githubWebhookPath, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };
+import { FanoutCause, FanoutError, MAX_FANOUT_JOBS, VariantKind, fanoutEnvelopeFields, hostEnvelopeFields, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields } from "./fanout/materialize.js";
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, ApprovalDecision, CAPABILITY_LABEL_PREFIX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, INIT_LABEL, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, MAX_FANOUT_JOBS, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_CAPABILITIES, OnUnreachableMode, OrchRole, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, RunsOnPick, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, StepApprovalOutcome, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TestRelayType, TimeoutReason, TriggerSource, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approverClauseSchema, attestationListItemSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, capabilityLabel, coerceDispatchInputs, coerceHostPropertyValue, compileRegexMatcher, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, envBindingEntrySchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, githubWebhookPath, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };

package/dist/inputs/build.d.ts

@@ -0,0 +1,9 @@
+import { z } from 'zod';
+import type { InputDescriptorT, InputsDescriptorMap } from './descriptor.js';
+/** Rebuild a real coercing Zod schema from a descriptor. */
+export declare function buildZodFromDescriptor(d: InputDescriptorT): z.ZodType;
+/** Rebuild a strict (unknown-key-rejecting) `z.object` from a descriptor map. */
+export declare function buildZodObjectFromMap(map: InputsDescriptorMap): z.ZodObject<{
+    [x: string]: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+}, z.core.$strict>;
+//# sourceMappingURL=build.d.ts.map

package/dist/inputs/build.js

@@ -0,0 +1,44 @@
+import "../chunk-BTugEXQM.js";
+import { z } from "zod";
+//#region src/inputs/build.ts
+/** Build the base (unwrapped) coercing schema for a descriptor. */
+function base(d) {
+	switch (d.type) {
+		case "string": {
+			let s = z.string();
+			if (d.min !== void 0) s = s.min(d.min);
+			if (d.max !== void 0) s = s.max(d.max);
+			if (d.pattern !== void 0) s = s.regex(new RegExp(d.pattern));
+			return s;
+		}
+		case "number":
+		case "integer": {
+			let n = z.coerce.number();
+			if (d.type === "integer") n = n.int();
+			if (d.min !== void 0) n = n.min(d.min);
+			if (d.max !== void 0) n = n.max(d.max);
+			return n;
+		}
+		case "boolean": return z.stringbool();
+		case "enum": return z.enum(d.values ?? []);
+		case "literal": return z.literal(d.literal);
+	}
+}
+/** Rebuild a real coercing Zod schema from a descriptor. */
+function buildZodFromDescriptor(d) {
+	let schema = base(d);
+	if (d.nullable) schema = schema.nullable();
+	if (d.default !== void 0) schema = schema.default(d.default);
+	else if (d.optional) schema = schema.optional();
+	return schema;
+}
+/** Rebuild a strict (unknown-key-rejecting) `z.object` from a descriptor map. */
+function buildZodObjectFromMap(map) {
+	const shape = {};
+	for (const [k, d] of Object.entries(map)) shape[k] = buildZodFromDescriptor(d);
+	return z.object(shape).strict();
+}
+//#endregion
+export { buildZodFromDescriptor, buildZodObjectFromMap };
+
+//# sourceMappingURL=build.js.map

package/dist/inputs/coerce.d.ts

@@ -0,0 +1,25 @@
+import type { InputsDescriptorMap } from './descriptor.js';
+/** A single normalized validation issue for one dispatch input key. */
+export interface DispatchInputIssue {
+    key: string;
+    code: string;
+    message: string;
+}
+/** Structured rejection for invalid dispatch inputs (CLI + dashboard rendering). */
+export declare class DispatchInputError extends Error {
+    readonly issues: DispatchInputIssue[];
+    constructor(issues: DispatchInputIssue[]);
+}
+/** Split `key=value` pairs; throws `DispatchInputError` on a missing `=`. */
+export declare function parseInputPairs(pairs: string[]): Record<string, string>;
+/**
+ * Coerce + validate raw operator pairs against the descriptor map, applying
+ * defaults. Strict: unknown keys are errors. Returns typed values or a
+ * structured `DispatchInputError`.
+ */
+export declare function coerceDispatchInputs(raw: Record<string, string>, map: InputsDescriptorMap): {
+    values: Record<string, unknown>;
+} | {
+    error: DispatchInputError;
+};
+//# sourceMappingURL=coerce.d.ts.map

package/dist/inputs/coerce.js

@@ -0,0 +1,51 @@
+import "../chunk-BTugEXQM.js";
+import { buildZodObjectFromMap } from "./build.js";
+//#region src/inputs/coerce.ts
+/** Structured rejection for invalid dispatch inputs (CLI + dashboard rendering). */
+var DispatchInputError = class extends Error {
+	issues;
+	constructor(issues) {
+		super(`Invalid dispatch inputs: ${issues.map((i) => `${i.key}: ${i.message}`).join("; ")}`);
+		this.issues = issues;
+		this.name = "DispatchInputError";
+	}
+};
+/** Split `key=value` pairs; throws `DispatchInputError` on a missing `=`. */
+function parseInputPairs(pairs) {
+	const out = {};
+	for (const p of pairs) {
+		const eq = p.indexOf("=");
+		if (eq <= 0) throw new DispatchInputError([{
+			key: p,
+			code: "malformed",
+			message: `expected key=value, got "${p}"`
+		}]);
+		out[p.slice(0, eq)] = p.slice(eq + 1);
+	}
+	return out;
+}
+/**
+* Coerce + validate raw operator pairs against the descriptor map, applying
+* defaults. Strict: unknown keys are errors. Returns typed values or a
+* structured `DispatchInputError`.
+*/
+function coerceDispatchInputs(raw, map) {
+	const parsed = buildZodObjectFromMap(map).safeParse(raw);
+	if (parsed.success) return { values: parsed.data };
+	return { error: new DispatchInputError(parsed.error.issues.flatMap((i) => {
+		if (i.code === "unrecognized_keys" && Array.isArray(i.keys)) return i.keys.map((k) => ({
+			key: k,
+			code: i.code,
+			message: `unknown input "${k}"`
+		}));
+		return [{
+			key: String(i.path[0] ?? "(root)"),
+			code: i.code,
+			message: i.message
+		}];
+	})) };
+}
+//#endregion
+export { DispatchInputError, coerceDispatchInputs, parseInputPairs };
+
+//# sourceMappingURL=coerce.js.map

package/dist/inputs/descriptor.d.ts

@@ -0,0 +1,53 @@
+import { z } from 'zod';
+/** The closed set of input value types persisted in the lockfile. */
+export declare const DispatchInputType: z.ZodEnum<{
+    string: "string";
+    number: "number";
+    boolean: "boolean";
+    enum: "enum";
+    literal: "literal";
+    integer: "integer";
+}>;
+export type DispatchInputTypeT = z.infer<typeof DispatchInputType>;
+/** JSON-safe, lossless descriptor of one declared dispatch input. */
+export declare const InputDescriptor: z.ZodObject<{
+    type: z.ZodEnum<{
+        string: "string";
+        number: "number";
+        boolean: "boolean";
+        enum: "enum";
+        literal: "literal";
+        integer: "integer";
+    }>;
+    optional: z.ZodDefault<z.ZodBoolean>;
+    nullable: z.ZodDefault<z.ZodBoolean>;
+    default: z.ZodOptional<z.ZodUnknown>;
+    values: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    literal: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    min: z.ZodOptional<z.ZodNumber>;
+    max: z.ZodOptional<z.ZodNumber>;
+    pattern: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type InputDescriptorT = z.infer<typeof InputDescriptor>;
+export declare const InputsDescriptorMapSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
+    type: z.ZodEnum<{
+        string: "string";
+        number: "number";
+        boolean: "boolean";
+        enum: "enum";
+        literal: "literal";
+        integer: "integer";
+    }>;
+    optional: z.ZodDefault<z.ZodBoolean>;
+    nullable: z.ZodDefault<z.ZodBoolean>;
+    default: z.ZodOptional<z.ZodUnknown>;
+    values: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    literal: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    min: z.ZodOptional<z.ZodNumber>;
+    max: z.ZodOptional<z.ZodNumber>;
+    pattern: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>;
+export type InputsDescriptorMap = z.infer<typeof InputsDescriptorMapSchema>;
+//# sourceMappingURL=descriptor.d.ts.map

package/dist/inputs/descriptor.js

@@ -0,0 +1,42 @@
+import "../chunk-BTugEXQM.js";
+import { z } from "zod";
+//#region src/inputs/descriptor.ts
+/** The closed set of input value types persisted in the lockfile. */
+const DispatchInputType = z.enum([
+	"string",
+	"number",
+	"integer",
+	"boolean",
+	"enum",
+	"literal"
+]);
+/** JSON-safe, lossless descriptor of one declared dispatch input. */
+const InputDescriptor = z.object({
+	type: DispatchInputType,
+	optional: z.boolean().default(false),
+	nullable: z.boolean().default(false),
+	/** Present iff the author set `.default()`. */
+	default: z.unknown().optional(),
+	/** Enum members (type === 'enum'). */
+	values: z.array(z.union([
+		z.string(),
+		z.number(),
+		z.boolean()
+	])).optional(),
+	/** Literal value (type === 'literal'). */
+	literal: z.union([
+		z.string(),
+		z.number(),
+		z.boolean()
+	]).optional(),
+	min: z.number().optional(),
+	max: z.number().optional(),
+	/** Regex source (type === 'string'). */
+	pattern: z.string().optional(),
+	description: z.string().optional()
+});
+const InputsDescriptorMapSchema = z.record(z.string(), InputDescriptor);
+//#endregion
+export { DispatchInputType, InputDescriptor, InputsDescriptorMapSchema };
+
+//# sourceMappingURL=descriptor.js.map

package/dist/inputs/extract.d.ts

@@ -0,0 +1,15 @@
+import type { InputDescriptorT, InputsDescriptorMap } from './descriptor.js';
+/** Thrown when a declared dispatch input falls outside the closed Zod subset. */
+export declare class UnsupportedDispatchInputError extends Error {
+    readonly construct: string;
+    readonly key?: string | undefined;
+    constructor(construct: string, key?: string | undefined);
+}
+/**
+ * Walk a Zod schema's `_zod.def`, reject any construct outside the closed
+ * subset, and extract a JSON-safe `InputDescriptor`.
+ */
+export declare function extractInputDescriptor(schema: unknown, key?: string): InputDescriptorT;
+/** Extract a descriptor for every key in a `{ name: ZodSchema }` map. */
+export declare function extractInputsDescriptorMap(map: Record<string, unknown>): InputsDescriptorMap;
+//# sourceMappingURL=extract.d.ts.map