@kici-dev/engine 0.1.22 → 0.1.23

package/dist/index.js

@@ -13,10 +13,10 @@ import { browserJobContextSchema, browserRunEventSchema, dashboardOrchLogsReques
 import { EventLogSource, EventLogStatus, PayloadOmittedReason } from "./protocol/messages/event-log.js";
 import { ScalerBackendType } from "./scaler/scaler-backend-type.js";
 import { ApprovalDecision, HoldScope, TriggerSource, approvalRequirementSchema, approverClauseSchema } from "./approval/types.js";
-import { NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, resolveWhenToRunOn } from "./trigger/types.js";
+import { NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, resolveWhenToRunOn } from "./trigger/types.js";
 import { HostTargetSelector, HostTargetValue, LabelMatcher, compileRegexMatcher, hostSatisfiesTarget, matcherMatches, matcherSatisfiedBy, partitionMatchers } from "./labels-match.js";
 import { HostInventoryEntry, HostPropertyValue, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, coerceHostPropertyValue, parseHostPropertyAssignments } from "./inventory.js";
-import { EnvDeleteErrorCode, EventLogPayloadStreamError, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListItemSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
+import { EnvDeleteErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListItemSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, envBindingEntrySchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
 import { WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, cacheStatsSchema, executionEventSchema, logChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema } from "./protocol/messages/platform-orchestrator.js";
 import { ScalerEventType } from "./protocol/messages/scaler-event.js";
 import { AccessLogPolicyKind, POLICY_BY_ACTION, fnv1a32, shouldRecordAccess, shouldRecordSecretResolve } from "./audit/access-log-policy.js";
@@ -31,6 +31,11 @@ import { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSch
 import { TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES } from "./trigger/trigger-event-type.js";
 import { createTraceEntry, createWorkflowDecision } from "./trigger/decision-trace.js";
 import { matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchWorkflowTriggers } from "./trigger/matcher.js";
+import { DispatchInputType, InputDescriptor, InputsDescriptorMapSchema } from "./inputs/descriptor.js";
+import { UnsupportedDispatchInputError, extractInputDescriptor, extractInputsDescriptorMap } from "./inputs/extract.js";
+import { buildZodFromDescriptor, buildZodObjectFromMap } from "./inputs/build.js";
+import { DispatchInputError, coerceDispatchInputs, parseInputPairs } from "./inputs/coerce.js";
+import "./inputs/index.js";
 import { isTerminal, transition } from "./state-machine/machine.js";
 import "./state-machine/index.js";
 import { LockFileParseError } from "./provider/lock-file-parse-error.js";
@@ -43,12 +48,12 @@ import { AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, KICI_AGENT_ENV_PREFIX, S
 import "./secrets/index.js";
 import { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix } from "./environment/scope-resolver.js";
 import "./environment/index.js";
-import { HOST_LABEL_PREFIX, KNOWN_ROLES, SELF_REPORTED_LABEL_PREFIXES, agentTypeLabel, deriveOsArchLabels, hostLabel, isSelfReportedLabel, mergeAutoLabels, normalizeRunsOn, parseHostLabel, resolveRoleLabels, scalerAgentLabels, scalerLabel, validateNoReservedLabels } from "./labels.js";
+import { CAPABILITY_LABEL_PREFIX, HOST_LABEL_PREFIX, INIT_LABEL, KNOWN_ROLES, PRIVILEGED_ROOT_LABEL, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, agentTypeLabel, capabilityLabel, deriveOsArchLabels, hostLabel, isSelfReportedLabel, mergeAutoLabels, normalizeRunsOn, parseHostLabel, resolveRoleLabels, scalerAgentLabels, scalerLabel, validateNoReservedLabels } from "./labels.js";
 import { parseMemoryString, resourceRequestNestedSchema, resourceSpecSchema, validateResourceRequest } from "./scaler/resource-types.js";
 import { RegisterableTriggerType } from "./registration/registerable-trigger-type.js";
 import { createWorkflowBundleConfig } from "./bundler/rolldown-config.js";
 import "./bundler/index.js";
 import { applyIncludeExclude, expandMatrix, expandMultiDimension, expandSingleDimension } from "./matrix/expand.js";
 import { formatExpandedJobName, formatMatrixSuffix } from "./matrix/format.js";
-import { FanoutCause, FanoutError, MAX_FANOUT_JOBS, VariantKind, hostEnvelopeFields, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields } from "./fanout/materialize.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, ApprovalDecision, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, InitFailureCategory, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, MAX_FANOUT_JOBS, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_CAPABILITIES, OnUnreachableMode, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, StepApprovalOutcome, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TestRelayType, TimeoutReason, TriggerSource, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approverClauseSchema, attestationListItemSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, coerceHostPropertyValue, compileRegexMatcher, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, githubWebhookPath, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };
+import { FanoutCause, FanoutError, MAX_FANOUT_JOBS, VariantKind, fanoutEnvelopeFields, hostEnvelopeFields, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields } from "./fanout/materialize.js";
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, ApprovalDecision, CAPABILITY_LABEL_PREFIX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EnvDeleteErrorCode, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, INIT_LABEL, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JobRejectReason, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, MAX_FANOUT_JOBS, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_CAPABILITIES, OnUnreachableMode, OrchRole, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, RunsOnPick, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, StepApprovalOutcome, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TestRelayType, TimeoutReason, TriggerSource, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, applyIncludeExclude, approvalRequirementSchema, approverClauseSchema, attestationListItemSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, capabilityLabel, coerceDispatchInputs, coerceHostPropertyValue, compileRegexMatcher, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, encodeActivityCursor, envBindingEntrySchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envTestAccessSetRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, githubWebhookPath, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, upstreamSnapshotSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };

package/dist/inputs/build.d.ts

@@ -0,0 +1,9 @@
+import { z } from 'zod';
+import type { InputDescriptorT, InputsDescriptorMap } from './descriptor.js';
+/** Rebuild a real coercing Zod schema from a descriptor. */
+export declare function buildZodFromDescriptor(d: InputDescriptorT): z.ZodType;
+/** Rebuild a strict (unknown-key-rejecting) `z.object` from a descriptor map. */
+export declare function buildZodObjectFromMap(map: InputsDescriptorMap): z.ZodObject<{
+    [x: string]: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+}, z.core.$strict>;
+//# sourceMappingURL=build.d.ts.map

package/dist/inputs/build.js

@@ -0,0 +1,44 @@
+import "../chunk-BTugEXQM.js";
+import { z } from "zod";
+//#region src/inputs/build.ts
+/** Build the base (unwrapped) coercing schema for a descriptor. */
+function base(d) {
+	switch (d.type) {
+		case "string": {
+			let s = z.string();
+			if (d.min !== void 0) s = s.min(d.min);
+			if (d.max !== void 0) s = s.max(d.max);
+			if (d.pattern !== void 0) s = s.regex(new RegExp(d.pattern));
+			return s;
+		}
+		case "number":
+		case "integer": {
+			let n = z.coerce.number();
+			if (d.type === "integer") n = n.int();
+			if (d.min !== void 0) n = n.min(d.min);
+			if (d.max !== void 0) n = n.max(d.max);
+			return n;
+		}
+		case "boolean": return z.stringbool();
+		case "enum": return z.enum(d.values ?? []);
+		case "literal": return z.literal(d.literal);
+	}
+}
+/** Rebuild a real coercing Zod schema from a descriptor. */
+function buildZodFromDescriptor(d) {
+	let schema = base(d);
+	if (d.nullable) schema = schema.nullable();
+	if (d.default !== void 0) schema = schema.default(d.default);
+	else if (d.optional) schema = schema.optional();
+	return schema;
+}
+/** Rebuild a strict (unknown-key-rejecting) `z.object` from a descriptor map. */
+function buildZodObjectFromMap(map) {
+	const shape = {};
+	for (const [k, d] of Object.entries(map)) shape[k] = buildZodFromDescriptor(d);
+	return z.object(shape).strict();
+}
+//#endregion
+export { buildZodFromDescriptor, buildZodObjectFromMap };
+
+//# sourceMappingURL=build.js.map

package/dist/inputs/coerce.d.ts

@@ -0,0 +1,25 @@
+import type { InputsDescriptorMap } from './descriptor.js';
+/** A single normalized validation issue for one dispatch input key. */
+export interface DispatchInputIssue {
+    key: string;
+    code: string;
+    message: string;
+}
+/** Structured rejection for invalid dispatch inputs (CLI + dashboard rendering). */
+export declare class DispatchInputError extends Error {
+    readonly issues: DispatchInputIssue[];
+    constructor(issues: DispatchInputIssue[]);
+}
+/** Split `key=value` pairs; throws `DispatchInputError` on a missing `=`. */
+export declare function parseInputPairs(pairs: string[]): Record<string, string>;
+/**
+ * Coerce + validate raw operator pairs against the descriptor map, applying
+ * defaults. Strict: unknown keys are errors. Returns typed values or a
+ * structured `DispatchInputError`.
+ */
+export declare function coerceDispatchInputs(raw: Record<string, string>, map: InputsDescriptorMap): {
+    values: Record<string, unknown>;
+} | {
+    error: DispatchInputError;
+};
+//# sourceMappingURL=coerce.d.ts.map

package/dist/inputs/coerce.js

@@ -0,0 +1,51 @@
+import "../chunk-BTugEXQM.js";
+import { buildZodObjectFromMap } from "./build.js";
+//#region src/inputs/coerce.ts
+/** Structured rejection for invalid dispatch inputs (CLI + dashboard rendering). */
+var DispatchInputError = class extends Error {
+	issues;
+	constructor(issues) {
+		super(`Invalid dispatch inputs: ${issues.map((i) => `${i.key}: ${i.message}`).join("; ")}`);
+		this.issues = issues;
+		this.name = "DispatchInputError";
+	}
+};
+/** Split `key=value` pairs; throws `DispatchInputError` on a missing `=`. */
+function parseInputPairs(pairs) {
+	const out = {};
+	for (const p of pairs) {
+		const eq = p.indexOf("=");
+		if (eq <= 0) throw new DispatchInputError([{
+			key: p,
+			code: "malformed",
+			message: `expected key=value, got "${p}"`
+		}]);
+		out[p.slice(0, eq)] = p.slice(eq + 1);
+	}
+	return out;
+}
+/**
+* Coerce + validate raw operator pairs against the descriptor map, applying
+* defaults. Strict: unknown keys are errors. Returns typed values or a
+* structured `DispatchInputError`.
+*/
+function coerceDispatchInputs(raw, map) {
+	const parsed = buildZodObjectFromMap(map).safeParse(raw);
+	if (parsed.success) return { values: parsed.data };
+	return { error: new DispatchInputError(parsed.error.issues.flatMap((i) => {
+		if (i.code === "unrecognized_keys" && Array.isArray(i.keys)) return i.keys.map((k) => ({
+			key: k,
+			code: i.code,
+			message: `unknown input "${k}"`
+		}));
+		return [{
+			key: String(i.path[0] ?? "(root)"),
+			code: i.code,
+			message: i.message
+		}];
+	})) };
+}
+//#endregion
+export { DispatchInputError, coerceDispatchInputs, parseInputPairs };
+
+//# sourceMappingURL=coerce.js.map

package/dist/inputs/descriptor.d.ts

@@ -0,0 +1,53 @@
+import { z } from 'zod';
+/** The closed set of input value types persisted in the lockfile. */
+export declare const DispatchInputType: z.ZodEnum<{
+    string: "string";
+    number: "number";
+    boolean: "boolean";
+    enum: "enum";
+    literal: "literal";
+    integer: "integer";
+}>;
+export type DispatchInputTypeT = z.infer<typeof DispatchInputType>;
+/** JSON-safe, lossless descriptor of one declared dispatch input. */
+export declare const InputDescriptor: z.ZodObject<{
+    type: z.ZodEnum<{
+        string: "string";
+        number: "number";
+        boolean: "boolean";
+        enum: "enum";
+        literal: "literal";
+        integer: "integer";
+    }>;
+    optional: z.ZodDefault<z.ZodBoolean>;
+    nullable: z.ZodDefault<z.ZodBoolean>;
+    default: z.ZodOptional<z.ZodUnknown>;
+    values: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    literal: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    min: z.ZodOptional<z.ZodNumber>;
+    max: z.ZodOptional<z.ZodNumber>;
+    pattern: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type InputDescriptorT = z.infer<typeof InputDescriptor>;
+export declare const InputsDescriptorMapSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
+    type: z.ZodEnum<{
+        string: "string";
+        number: "number";
+        boolean: "boolean";
+        enum: "enum";
+        literal: "literal";
+        integer: "integer";
+    }>;
+    optional: z.ZodDefault<z.ZodBoolean>;
+    nullable: z.ZodDefault<z.ZodBoolean>;
+    default: z.ZodOptional<z.ZodUnknown>;
+    values: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    literal: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    min: z.ZodOptional<z.ZodNumber>;
+    max: z.ZodOptional<z.ZodNumber>;
+    pattern: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>;
+export type InputsDescriptorMap = z.infer<typeof InputsDescriptorMapSchema>;
+//# sourceMappingURL=descriptor.d.ts.map

package/dist/inputs/descriptor.js

@@ -0,0 +1,42 @@
+import "../chunk-BTugEXQM.js";
+import { z } from "zod";
+//#region src/inputs/descriptor.ts
+/** The closed set of input value types persisted in the lockfile. */
+const DispatchInputType = z.enum([
+	"string",
+	"number",
+	"integer",
+	"boolean",
+	"enum",
+	"literal"
+]);
+/** JSON-safe, lossless descriptor of one declared dispatch input. */
+const InputDescriptor = z.object({
+	type: DispatchInputType,
+	optional: z.boolean().default(false),
+	nullable: z.boolean().default(false),
+	/** Present iff the author set `.default()`. */
+	default: z.unknown().optional(),
+	/** Enum members (type === 'enum'). */
+	values: z.array(z.union([
+		z.string(),
+		z.number(),
+		z.boolean()
+	])).optional(),
+	/** Literal value (type === 'literal'). */
+	literal: z.union([
+		z.string(),
+		z.number(),
+		z.boolean()
+	]).optional(),
+	min: z.number().optional(),
+	max: z.number().optional(),
+	/** Regex source (type === 'string'). */
+	pattern: z.string().optional(),
+	description: z.string().optional()
+});
+const InputsDescriptorMapSchema = z.record(z.string(), InputDescriptor);
+//#endregion
+export { DispatchInputType, InputDescriptor, InputsDescriptorMapSchema };
+
+//# sourceMappingURL=descriptor.js.map

package/dist/inputs/extract.d.ts

@@ -0,0 +1,15 @@
+import type { InputDescriptorT, InputsDescriptorMap } from './descriptor.js';
+/** Thrown when a declared dispatch input falls outside the closed Zod subset. */
+export declare class UnsupportedDispatchInputError extends Error {
+    readonly construct: string;
+    readonly key?: string | undefined;
+    constructor(construct: string, key?: string | undefined);
+}
+/**
+ * Walk a Zod schema's `_zod.def`, reject any construct outside the closed
+ * subset, and extract a JSON-safe `InputDescriptor`.
+ */
+export declare function extractInputDescriptor(schema: unknown, key?: string): InputDescriptorT;
+/** Extract a descriptor for every key in a `{ name: ZodSchema }` map. */
+export declare function extractInputsDescriptorMap(map: Record<string, unknown>): InputsDescriptorMap;
+//# sourceMappingURL=extract.d.ts.map

package/dist/inputs/extract.js

@@ -0,0 +1,117 @@
+import "../chunk-BTugEXQM.js";
+//#region src/inputs/extract.ts
+/** Thrown when a declared dispatch input falls outside the closed Zod subset. */
+var UnsupportedDispatchInputError = class extends Error {
+	construct;
+	key;
+	constructor(construct, key) {
+		super(`Unsupported dispatch input${key ? ` "${key}"` : ""}: ${construct}. Allowed: z.string/number/boolean/enum/literal with .optional/.nullable/.default/.min/.max/.regex/.int.`);
+		this.construct = construct;
+		this.key = key;
+		this.name = "UnsupportedDispatchInputError";
+	}
+};
+const defOf = (s) => s?._zod?.def;
+const checkDefOf = (c) => c?._zod?.def;
+/** Pull string/number checks (min/max/int/regex) into descriptor fields. */
+function applyChecks(d, checks, key) {
+	for (const c of checks ?? []) {
+		const cd = checkDefOf(c);
+		switch (cd?.check) {
+			case "greater_than":
+				d.min = Number(cd.value);
+				break;
+			case "less_than":
+				d.max = Number(cd.value);
+				break;
+			case "min_length":
+				d.min = Number(cd.minimum);
+				break;
+			case "max_length":
+				d.max = Number(cd.maximum);
+				break;
+			case "string_format":
+				if (cd.format === "regex" && cd.pattern) d.pattern = String(typeof cd.pattern === "object" ? cd.pattern.source ?? cd.pattern : cd.pattern);
+				else throw new UnsupportedDispatchInputError(`string format:${cd.format ?? "unknown"}`, key);
+				break;
+			case "number_format":
+				if (cd.format === "safeint" || cd.format === "int") d.type = "integer";
+				else throw new UnsupportedDispatchInputError(`number format:${cd.format ?? "unknown"}`, key);
+				break;
+			default: throw new UnsupportedDispatchInputError(`check:${cd?.check ?? "unknown"}`, key);
+		}
+	}
+}
+/**
+* Walk a Zod schema's `_zod.def`, reject any construct outside the closed
+* subset, and extract a JSON-safe `InputDescriptor`.
+*/
+function extractInputDescriptor(schema, key) {
+	let cur = schema;
+	let optional = false;
+	let nullable = false;
+	let hasDefault = false;
+	let defaultValue;
+	for (;;) {
+		const d = defOf(cur);
+		if (!d) throw new UnsupportedDispatchInputError("non-zod value", key);
+		if (d.type === "optional") {
+			optional = true;
+			cur = d.innerType;
+			continue;
+		}
+		if (d.type === "nullable") {
+			nullable = true;
+			cur = d.innerType;
+			continue;
+		}
+		if (d.type === "default") {
+			hasDefault = true;
+			defaultValue = typeof d.defaultValue === "function" ? d.defaultValue() : d.defaultValue;
+			cur = d.innerType;
+			continue;
+		}
+		break;
+	}
+	const d = defOf(cur);
+	if (!d) throw new UnsupportedDispatchInputError("non-zod value", key);
+	const out = {
+		type: "string",
+		optional,
+		nullable
+	};
+	if (hasDefault) out.default = defaultValue;
+	switch (d.type) {
+		case "string":
+			out.type = "string";
+			applyChecks(out, d.checks, key);
+			break;
+		case "number":
+			out.type = "number";
+			applyChecks(out, d.checks, key);
+			break;
+		case "boolean":
+			out.type = "boolean";
+			break;
+		case "enum":
+			out.type = "enum";
+			out.values = Object.values(d.entries ?? {});
+			break;
+		case "literal":
+			out.type = "literal";
+			out.literal = d.values?.[0] ?? d.value;
+			break;
+		default: throw new UnsupportedDispatchInputError(`z.${d.type}`, key);
+	}
+	return out;
+}
+/** Extract a descriptor for every key in a `{ name: ZodSchema }` map. */
+function extractInputsDescriptorMap(map) {
+	const out = {};
+	for (const [k, v] of Object.entries(map)) out[k] = extractInputDescriptor(v, k);
+	return out;
+}
+//#endregion
+export { UnsupportedDispatchInputError, extractInputDescriptor, extractInputsDescriptorMap };
+
+//# sourceMappingURL=extract.js.map

package/dist/inputs/index.d.ts

@@ -0,0 +1,5 @@
+export * from './descriptor.js';
+export * from './extract.js';
+export * from './build.js';
+export * from './coerce.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/inputs/index.js

@@ -0,0 +1,6 @@
+import "../chunk-BTugEXQM.js";
+import { DispatchInputType, InputDescriptor, InputsDescriptorMapSchema } from "./descriptor.js";
+import { UnsupportedDispatchInputError, extractInputDescriptor, extractInputsDescriptorMap } from "./extract.js";
+import { buildZodFromDescriptor, buildZodObjectFromMap } from "./build.js";
+import { DispatchInputError, coerceDispatchInputs, parseInputPairs } from "./coerce.js";
+export { DispatchInputError, DispatchInputType, InputDescriptor, InputsDescriptorMapSchema, UnsupportedDispatchInputError, buildZodFromDescriptor, buildZodObjectFromMap, coerceDispatchInputs, extractInputDescriptor, extractInputsDescriptorMap, parseInputPairs };

package/dist/labels/compile.d.ts

@@ -15,9 +15,12 @@ export declare function assertSafeRegex(source: string, flags: string, ctx: stri
  */
 export declare function toLabelMatcher(el: string | RegExp, ctx: string): LabelMatcher;
 export type SelectorEl = string | RegExp;
+/** Single-agent selection policy when multiple agents match a `runsOn` selector. */
+export type RunsOnPickInput = 'deterministic' | 'any';
 export type RunsOnAuthorInput = SelectorEl | readonly SelectorEl[] | {
     labels: SelectorEl | readonly SelectorEl[];
     exclude?: SelectorEl | readonly SelectorEl[];
+    pick?: RunsOnPickInput;
 };
 export type RunsOnAllAuthorInput = string | RegExp | readonly SelectorEl[] | {
     include: readonly {
@@ -30,6 +33,12 @@ export declare function normalizeRunsOnToMatchers(runsOn: RunsOnAuthorInput, ctx
     include: LabelMatcher[];
     exclude: LabelMatcher[];
 };
+/**
+ * Resolve a `runsOn` author value's single-agent selection policy, defaulting to
+ * `'deterministic'` for every form (string / array shorthand inherit the default
+ * after normalization; the selector object's explicit `pick` wins).
+ */
+export declare function runsOnPickFromInput(runsOn: RunsOnAuthorInput): RunsOnPickInput;
 /** Normalize a `runsOnAll` author value into include groups + exclude matchers. */
 export declare function normalizeRunsOnAllToMatchers(input: RunsOnAllAuthorInput, ctx: string): {
     include: LabelMatcher[][];

package/dist/labels/compile.js

@@ -59,6 +59,15 @@ function normalizeRunsOnToMatchers(runsOn, ctx) {
 		exclude: sel.exclude ? asArray(sel.exclude).map((e) => toLabelMatcher(e, ctx)) : []
 	};
 }
+/**
+* Resolve a `runsOn` author value's single-agent selection policy, defaulting to
+* `'deterministic'` for every form (string / array shorthand inherit the default
+* after normalization; the selector object's explicit `pick` wins).
+*/
+function runsOnPickFromInput(runsOn) {
+	if (typeof runsOn === "string" || runsOn instanceof RegExp || Array.isArray(runsOn)) return "deterministic";
+	return runsOn.pick ?? "deterministic";
+}
 /** Normalize a `runsOnAll` author value into include groups + exclude matchers. */
 function normalizeRunsOnAllToMatchers(input, ctx) {
 	if (typeof input === "string" || input instanceof RegExp) return {
@@ -86,6 +95,6 @@ function assertMatchersSafe(matchers, ctx) {
 	for (const m of matchers) if (m.kind === "regex") assertSafeRegex(m.source, m.flags, ctx);
 }
 //#endregion
-export { assertMatchersSafe, assertSafeRegex, normalizeRunsOnAllToMatchers, normalizeRunsOnToMatchers, toLabelMatcher };
+export { assertMatchersSafe, assertSafeRegex, normalizeRunsOnAllToMatchers, normalizeRunsOnToMatchers, runsOnPickFromInput, toLabelMatcher };
 
 //# sourceMappingURL=compile.js.map

package/dist/labels.d.ts

@@ -79,6 +79,35 @@ export declare const KNOWN_ROLES: readonly ["builder", "init-runner"];
 export type AgentRole = (typeof KNOWN_ROLES)[number];
 /** Reserved label prefix — labels starting with this are system-managed. */
 export declare const RESERVED_LABEL_PREFIX = "kici:";
+/**
+ * Capability label prefix — `kici:capability:<name>` grants an agent a
+ * privileged capability beyond plain execution. Distinct from `kici:role:`
+ * (which gates which internal job kinds an agent runs).
+ */
+export declare const CAPABILITY_LABEL_PREFIX = "kici:capability:";
+/** Build a `kici:capability:<name>` label. */
+export declare function capabilityLabel(name: string): string;
+/**
+ * The `ssh-transport` capability: an agent holding this may run the bootstrap
+ * bring-up (`ctx.kici.bootstrap.ensureInitRunner` / `preBootSend`) — i.e. SSH
+ * to a declared-but-un-agented host. The orchestrator refuses to run a
+ * bring-up on an agent that lacks it. Prod-critical: such an agent custodies
+ * the bootstrap SSH key.
+ */
+export declare const SSH_TRANSPORT_CAPABILITY = "kici:capability:ssh-transport";
+/**
+ * The `kici:init` lifecycle label carried by a temporary init-runner agent
+ * brought up on a fresh box for bootstrap. Marks it as ephemeral + privileged;
+ * it dies on reboot and is reaped. Distinct from `kici:role:init-runner`
+ * (which is the per-job `__init__` workspace-init capability — a different
+ * concept entirely).
+ */
+export declare const INIT_LABEL = "kici:init";
+/**
+ * The `kici:privileged:root` label a bootstrap init-runner carries — it runs
+ * as root in the target's rescue env to partition / format / install.
+ */
+export declare const PRIVILEGED_ROOT_LABEL = "kici:privileged:root";
 /** Role label prefix — used to generate role-specific labels. */
 export declare const ROLE_LABEL_PREFIX = "kici:role:";
 /**

package/dist/labels.js

@@ -116,6 +116,37 @@ function normalizeRunsOn(runsOn) {
 const KNOWN_ROLES = ["builder", "init-runner"];
 /** Reserved label prefix — labels starting with this are system-managed. */
 const RESERVED_LABEL_PREFIX = "kici:";
+/**
+* Capability label prefix — `kici:capability:<name>` grants an agent a
+* privileged capability beyond plain execution. Distinct from `kici:role:`
+* (which gates which internal job kinds an agent runs).
+*/
+const CAPABILITY_LABEL_PREFIX = "kici:capability:";
+/** Build a `kici:capability:<name>` label. */
+function capabilityLabel(name) {
+	return `${CAPABILITY_LABEL_PREFIX}${name}`;
+}
+/**
+* The `ssh-transport` capability: an agent holding this may run the bootstrap
+* bring-up (`ctx.kici.bootstrap.ensureInitRunner` / `preBootSend`) — i.e. SSH
+* to a declared-but-un-agented host. The orchestrator refuses to run a
+* bring-up on an agent that lacks it. Prod-critical: such an agent custodies
+* the bootstrap SSH key.
+*/
+const SSH_TRANSPORT_CAPABILITY = "kici:capability:ssh-transport";
+/**
+* The `kici:init` lifecycle label carried by a temporary init-runner agent
+* brought up on a fresh box for bootstrap. Marks it as ephemeral + privileged;
+* it dies on reboot and is reaped. Distinct from `kici:role:init-runner`
+* (which is the per-job `__init__` workspace-init capability — a different
+* concept entirely).
+*/
+const INIT_LABEL = "kici:init";
+/**
+* The `kici:privileged:root` label a bootstrap init-runner carries — it runs
+* as root in the target's rescue env to partition / format / install.
+*/
+const PRIVILEGED_ROOT_LABEL = "kici:privileged:root";
 /** Role label prefix — used to generate role-specific labels. */
 const ROLE_LABEL_PREFIX = "kici:role:";
 /**
@@ -203,6 +234,6 @@ function separateLabels(labels) {
 	};
 }
 //#endregion
-export { HOST_LABEL_PREFIX, KNOWN_ROLES, RESERVED_LABEL_PREFIX, ROLE_LABEL_PREFIX, SELF_REPORTED_LABEL_PREFIXES, agentTypeLabel, deriveOsArchLabels, hostLabel, isAutoLabel, isSelfReportedLabel, mergeAutoLabels, normalizeRunsOn, parseHostLabel, resolveRoleLabels, roleToLabel, scalerAgentLabels, scalerLabel, separateLabels, validateNoReservedLabels };
+export { CAPABILITY_LABEL_PREFIX, HOST_LABEL_PREFIX, INIT_LABEL, KNOWN_ROLES, PRIVILEGED_ROOT_LABEL, RESERVED_LABEL_PREFIX, ROLE_LABEL_PREFIX, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, agentTypeLabel, capabilityLabel, deriveOsArchLabels, hostLabel, isAutoLabel, isSelfReportedLabel, mergeAutoLabels, normalizeRunsOn, parseHostLabel, resolveRoleLabels, roleToLabel, scalerAgentLabels, scalerLabel, separateLabels, validateNoReservedLabels };
 
 //# sourceMappingURL=labels.js.map

package/dist/metrics/catalog-policy.d.ts

@@ -52,6 +52,13 @@ export declare const OVERFLOW_LABEL_VALUE = "__overflow__";
  * so they are valid push payloads alongside `kici_orch_*`.
  */
 export declare const ORCH_PUSHED_METRIC_NAMES: ReadonlySet<MetricName>;
+/**
+ * Closed enum of scaler-backend TYPE values the orchestrator's own
+ * resource-usage gauges carry on their `scalerType` rollup label.
+ * `__global__` is the orchestrator-wide rollup row; the other four match
+ * `AGENT_SCALER_VALUES`. Exported so the policy tests can assert against it.
+ */
+export declare const ORCH_SCALER_VALUES: readonly ["__global__", "stateful", "container", "firecracker", "bare-metal"];
 /**
  * Per-metric, per-label value policy. Missing entries (or missing label
  * keys within an entry) mean "no value-level constraint" — the label key