@kici-dev/engine 0.1.26 → 0.2.0

package/dist/trigger/types.js

@@ -1,32 +1,62 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import { ExecutionJobStatus, TERMINAL_JOB_STATES } from "../protocol/messages/execution-status.js";
+import { isFailureStatus } from "../status/presentation.js";
 import { z } from "zod";
 //#region src/trigger/types.ts
 /**
 * Lock file types for the trigger matching engine.
 * Single source of truth -- replaces local copies in @kici-dev/compiler and @kici-dev/orchestrator.
-* Schema version 4: adds 4 internal event routing trigger types (kici_event, workflow_complete,
+*
+* Bump-history convention: every entry is annotated `additive` (older readers
+* tolerate the new lock because unknown fields are ignored) or `BREAKING` (an
+* older reader would mis-parse the lock). Every `BREAKING` bump moves
+* `BREAKING_FLOOR` (below) to that version in the SAME commit.
+*
+* Schema version 4 (additive): adds 4 internal event routing trigger types (kici_event, workflow_complete,
 * job_complete, generic_webhook).
-* Schema version 6: replaces job-level contexts with environment/env/concurrencyGroup.
-* Schema version 8: adds runsOn polymorphic type (string | string[] | selector) and excludeLabels.
-* Schema version 9: adds repos/notRepos repo pattern fields to git-event triggers for global workflow matching.
-* Schema version 10: removes notRepos/notPaths fields, negative patterns use ! prefix in repos/paths arrays.
-* Schema version 11: adds LockInlineValue type for pure function inline evaluation.
-* Schema version 14: adds declarative cache specs to LockJob and LockStep.
-* Schema version 15: adds per-job init config(s) to LockJob.
-* Schema version 16: adds normalized approval config to LockWorkflow/LockJob/LockStep.
-* Schema version 17: widens LockJob.init to typed presets ('mise' / { mise }) and 'auto' detection.
-* Schema version 18: adds LockJob.runsOnAll host fan-out predicate + onUnreachable policy.
-* Schema version 19: adds LockJob.maxParallel/failFast fan-out concurrency (rolling waves).
-* Schema version 20: runsOn/runsOnAll/excludeLabels carry LabelMatcher (exact|regex) for glob+regex selectors.
-* Schema version 23: adds LockDispatchTrigger.inputs (typed dispatch inputs descriptors).
-* Schema version 24: adds LockJob.runsOnPick (deterministic single-host selection).
-* Schema version 25: adds LockStep.retry (step retry policy data subset; retryIf is execution-only).
-* Schema version 26: adds LockJob.includeUninitialized (runsOnAll fans out to declared-but-un-agented hosts, bringing up a temporary init-runner per fresh box).
-* Schema version 27: adds LockScheduleTrigger.inputs (defaults-only schedule dispatch inputs).
+* Schema version 6 (BREAKING): replaces job-level contexts with environment/env/concurrencyGroup.
+* Schema version 8 (additive): adds runsOn polymorphic type (string | string[] | selector) and excludeLabels.
+* Schema version 9 (additive): adds repos/notRepos repo pattern fields to git-event triggers for global workflow matching.
+* Schema version 10 (BREAKING): removes notRepos/notPaths fields, negative patterns use ! prefix in repos/paths arrays.
+* Schema version 11 (additive): adds LockInlineValue type for pure function inline evaluation.
+* Schema version 14 (additive): adds declarative cache specs to LockJob and LockStep.
+* Schema version 15 (additive): adds per-job init config(s) to LockJob.
+* Schema version 16 (additive): adds normalized approval config to LockWorkflow/LockJob/LockStep.
+* Schema version 17 (additive): widens LockJob.init to typed presets ('mise' / { mise }) and 'auto' detection.
+* Schema version 18 (additive): adds LockJob.runsOnAll host fan-out predicate + onUnreachable policy.
+* Schema version 19 (additive): adds LockJob.maxParallel/failFast fan-out concurrency (rolling waves).
+* Schema version 20 (BREAKING): runsOn/runsOnAll/excludeLabels carry LabelMatcher (exact|regex) for glob+regex selectors.
+* Schema version 23 (additive): adds LockDispatchTrigger.inputs (typed dispatch inputs descriptors).
+* Schema version 24 (additive): adds LockJob.runsOnPick (deterministic single-host selection).
+* Schema version 25 (additive): adds LockStep.retry (step retry policy data subset; retryIf is execution-only).
+* Schema version 26 (additive): adds LockJob.includeUninitialized (runsOnAll fans out to declared-but-un-agented hosts, bringing up a temporary init-runner per fresh box).
+* Schema version 27 (additive): adds LockScheduleTrigger.inputs (defaults-only schedule dispatch inputs).
+* Schema version 30 (BREAKING): renames job-level `environments` to `contexts`.
+* Schema version 31 (additive): adds the workflows_failed_batch lock trigger.
+* Schema version 32 (additive): adds LockJob.sandbox (per-job escape-hatch request).
+*/
+/**
+* Schema version the compiler emits into every lock file. Incremented on ANY
+* schema change (additive or breaking); the bump-history comment above records
+* which. See `BREAKING_FLOOR` for the compatibility-window semantics.
 */
-/** Schema version - increment on breaking changes */
-const SCHEMA_VERSION = 29;
+const SCHEMA_VERSION = 32;
+/**
+* Oldest lock schema version this codebase can still read correctly — the lower
+* bound of the acceptance window.
+*
+* A lock at `schemaVersion >= BREAKING_FLOOR` parses correctly here even if it
+* is newer than `SCHEMA_VERSION` (additive bumps add fields this reader ignores).
+* A lock below the floor was produced by an SDK whose breaking change this
+* reader predates and must be rejected (it would mis-parse silently otherwise).
+*
+* Bump rule: move this to the current `SCHEMA_VERSION` ONLY in the commit that
+* lands a `BREAKING` schema change (see the bump-history convention above). It
+* currently sits at 30 because v30 (`environments`→`contexts`) was the most
+* recent breaking bump; v31 and v32 were additive, so a v30 lock still reads
+* correctly.
+*/
+const BREAKING_FLOOR = 30;
 /** Type guard distinguishing a parallel group from an ordinary lock step. */
 function isLockParallelStep(entry) {
 	return entry.kind === "parallel";
@@ -58,17 +88,22 @@ const WHEN_TO_RUN_ON = {
 	"on-success": [ExecutionJobStatus.enum.success],
 	always: [...TERMINAL_JOB_STATES],
 	"on-skip": [ExecutionJobStatus.enum.success, ExecutionJobStatus.enum.skipped],
-	"on-failure": [ExecutionJobStatus.enum.failed, ExecutionJobStatus.enum.timed_out_stale]
+	"on-failure": [...TERMINAL_JOB_STATES].filter(isFailureStatus)
 };
 /**
 * Resolve the author-facing `when` (keyword sugar | raw status-set | unset) to
 * the normalized status-set. An unset `when` defaults to success-only — the
 * downstream runs only when the upstream succeeded.
+*
+* Always a fresh array. The keyword arm used to hand back the shared
+* `WHEN_TO_RUN_ON` entry itself, so every lock-file edge compiled from the same
+* keyword aliased one array and any caller that sorted or mutated its result
+* silently reordered the keyword's expansion for every other edge.
 */
 function resolveWhenToRunOn(when) {
 	if (when === void 0) return [ExecutionJobStatus.enum.success];
-	if (Array.isArray(when)) return when;
-	return WHEN_TO_RUN_ON[when];
+	if (Array.isArray(when)) return [...when];
+	return [...WHEN_TO_RUN_ON[when]];
 }
 /**
 * Needs entry carrying the normalized run-on status-set.
@@ -111,6 +146,12 @@ const OnUnreachableMode = z.enum([
 * - `any`: pick any available agent (load spread).
 */
 const RunsOnPick = z.enum(["deterministic", "any"]);
+/** Container network posture: 'default' (bridge), 'none' (loopback-only), 'host' (host netns; gated). */
+const SANDBOX_NETWORK_MODES = [
+	"default",
+	"none",
+	"host"
+];
 /** Type guard for static jobs */
 function isLockStaticJob(job) {
 	return job._type === "static";
@@ -119,7 +160,24 @@ function isLockStaticJob(job) {
 function isLockDynamicJobFn(job) {
 	return job._type === "dynamic";
 }
+/**
+* Availability of the changed-files list for path-filter evaluation.
+*
+* Distinguishes three states that a bare `string[]` collapses into one:
+* - `skipped` — no trigger has path patterns, so the fetch never ran. Path
+*   filters are not evaluated (today's no-fetch fast path).
+* - `fetched` — the fetch succeeded and the list is authoritative; an empty
+*   list genuinely means "no files changed" and does NOT match a path filter.
+* - `unavailable` — the diff could not be determined (a provider capability
+*   gap such as universal-git PR events, or upstream degradation). Path
+*   filters match conservatively so a real change is never silently dropped.
+*/
+const changedFilesStatusSchema = z.enum([
+	"fetched",
+	"unavailable",
+	"skipped"
+]);
 //#endregion
-export { NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, resolveWhenToRunOn };
+export { BREAKING_FLOOR, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, changedFilesStatusSchema, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, resolveWhenToRunOn };
 
 //# sourceMappingURL=types.js.map

package/dist/webhook/event-types.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Shared outbound-webhook event-type vocabulary — the single source of truth for
+ * the event types a customer can subscribe an endpoint to, consumed by the
+ * Platform route validator and the dashboard endpoint-create checkbox list.
+ *
+ * Pure Zod (browser-safe): the engine barrel re-exports this module and the
+ * dashboard imports the barrel, so no Node built-in may appear here.
+ *
+ * `docs/user/dashboard/settings.md` § Webhooks lists the subscribable types in
+ * prose — adding a type here means updating that list in the same change.
+ */
+import { z } from 'zod';
+/**
+ * The connectivity-check event the test-endpoint button sends. It is not
+ * subscribable, and a failed ping never counts toward an endpoint's
+ * consecutive-failure budget — a customer probing a not-yet-live receiver must
+ * not be able to auto-disable their own endpoint.
+ */
+export declare const PING_EVENT_TYPE = "ping";
+/** Zod enum for the subscribable set — usable directly as a route schema. */
+export declare const SubscribableWebhookEventType: z.ZodEnum<{
+    "job.completed": "job.completed";
+    "job.failed": "job.failed";
+    "job.started": "job.started";
+    "run.completed": "run.completed";
+    "run.failed": "run.failed";
+    "run.started": "run.started";
+}>;
+export type SubscribableWebhookEventType = z.infer<typeof SubscribableWebhookEventType>;
+/**
+ * All outbound webhook event types (the Stripe-style envelope `type`, also sent
+ * as the X-KiCI-Event header): the subscribable set plus the ping, which is
+ * emitted only by the test-endpoint button and is never subscribable.
+ */
+export declare const WebhookEventType: z.ZodEnum<{
+    "job.completed": "job.completed";
+    "job.failed": "job.failed";
+    "job.started": "job.started";
+    ping: "ping";
+    "run.completed": "run.completed";
+    "run.failed": "run.failed";
+    "run.started": "run.started";
+}>;
+export type WebhookEventType = z.infer<typeof WebhookEventType>;
+/**
+ * Readonly value tuple for iteration (UI checkbox list, tests) — the accepted
+ * set of `SubscribableWebhookEventType`, in declaration order.
+ *
+ * A frozen copy, not `SubscribableWebhookEventType.options`: Zod hands back the
+ * validator's own internal array from that getter, so re-exporting it would let
+ * any consumer `push` / `sort` the shared vocabulary out from under every other
+ * module in the process. `event-types.test.ts` asserts the copy still matches
+ * the validator's options.
+ */
+export declare const SUBSCRIBABLE_WEBHOOK_EVENT_TYPES: readonly ("job.completed" | "job.failed" | "job.started" | "run.completed" | "run.failed" | "run.started")[];
+//# sourceMappingURL=event-types.d.ts.map

package/dist/webhook/event-types.js

@@ -0,0 +1,59 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { z } from "zod";
+//#region src/webhook/event-types.ts
+/**
+* Shared outbound-webhook event-type vocabulary — the single source of truth for
+* the event types a customer can subscribe an endpoint to, consumed by the
+* Platform route validator and the dashboard endpoint-create checkbox list.
+*
+* Pure Zod (browser-safe): the engine barrel re-exports this module and the
+* dashboard imports the barrel, so no Node built-in may appear here.
+*
+* `docs/user/dashboard/settings.md` § Webhooks lists the subscribable types in
+* prose — adding a type here means updating that list in the same change.
+*/
+/**
+* Subscribable webhook event types — the run/job lifecycle events a customer can
+* wire an endpoint to. Written once here; the full `WebhookEventType` enum
+* derives from these plus the non-subscribable ping. Module-private on purpose:
+* `SUBSCRIBABLE_WEBHOOK_EVENT_TYPES` is the one public name for this list, so
+* consumers cannot pick between two spellings of the same vocabulary.
+*/
+const SUBSCRIBABLE_EVENT_VALUES = [
+	"run.started",
+	"run.completed",
+	"run.failed",
+	"job.started",
+	"job.completed",
+	"job.failed"
+];
+/**
+* The connectivity-check event the test-endpoint button sends. It is not
+* subscribable, and a failed ping never counts toward an endpoint's
+* consecutive-failure budget — a customer probing a not-yet-live receiver must
+* not be able to auto-disable their own endpoint.
+*/
+const PING_EVENT_TYPE = "ping";
+/** Zod enum for the subscribable set — usable directly as a route schema. */
+const SubscribableWebhookEventType = z.enum(SUBSCRIBABLE_EVENT_VALUES);
+/**
+* All outbound webhook event types (the Stripe-style envelope `type`, also sent
+* as the X-KiCI-Event header): the subscribable set plus the ping, which is
+* emitted only by the test-endpoint button and is never subscribable.
+*/
+const WebhookEventType = z.enum([...SUBSCRIBABLE_EVENT_VALUES, PING_EVENT_TYPE]);
+/**
+* Readonly value tuple for iteration (UI checkbox list, tests) — the accepted
+* set of `SubscribableWebhookEventType`, in declaration order.
+*
+* A frozen copy, not `SubscribableWebhookEventType.options`: Zod hands back the
+* validator's own internal array from that getter, so re-exporting it would let
+* any consumer `push` / `sort` the shared vocabulary out from under every other
+* module in the process. `event-types.test.ts` asserts the copy still matches
+* the validator's options.
+*/
+const SUBSCRIBABLE_WEBHOOK_EVENT_TYPES = Object.freeze([...SUBSCRIBABLE_EVENT_VALUES]);
+//#endregion
+export { PING_EVENT_TYPE, SUBSCRIBABLE_WEBHOOK_EVENT_TYPES, SubscribableWebhookEventType, WebhookEventType };
+
+//# sourceMappingURL=event-types.js.map

package/dist/ws/ws-like.d.ts

@@ -8,5 +8,18 @@ export interface WsLike {
     send(data: string | ArrayBuffer): void;
     close(code?: number, reason?: string): void;
     readyState: number;
+    /**
+     * Bytes queued in the socket's send buffer, when the transport exposes it.
+     * The `ws` library socket does; used by the browser fan-out to terminate a
+     * slow consumer past a watermark instead of buffering unboundedly in heap.
+     * Optional so mock sockets and non-`ws` transports need not provide it.
+     */
+    bufferedAmount?: number;
+    /**
+     * Force-close the underlying socket immediately, when the transport exposes
+     * it (the `ws` library socket does). Optional for the same reason as
+     * `bufferedAmount`.
+     */
+    terminate?(): void;
 }
 //# sourceMappingURL=ws-like.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/engine",
-  "version": "0.1.26",
+  "version": "0.2.0",
   "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
   "keywords": [
     "ci",
@@ -53,13 +53,13 @@
       "import": "./dist/labels/compile.js",
       "types": "./dist/labels/compile.d.ts"
     },
-    "./environment/host-match": {
-      "import": "./dist/environment/host-match.js",
-      "types": "./dist/environment/host-match.d.ts"
+    "./context/host-match": {
+      "import": "./dist/context/host-match.js",
+      "types": "./dist/context/host-match.d.ts"
     },
-    "./environment/scope-template": {
-      "import": "./dist/environment/scope-template.js",
-      "types": "./dist/environment/scope-template.d.ts"
+    "./context/scope-template": {
+      "import": "./dist/context/scope-template.js",
+      "types": "./dist/context/scope-template.d.ts"
     },
     "./protocol/dashboard-global-workflows": {
       "import": "./dist/protocol/dashboard-global-workflows.js",
@@ -69,6 +69,14 @@
       "import": "./dist/protocol/dashboard-write-operations.js",
       "types": "./dist/protocol/dashboard-write-operations.d.ts"
     },
+    "./protocol/dashboard-api-errors": {
+      "import": "./dist/protocol/dashboard-api-errors.js",
+      "types": "./dist/protocol/dashboard-api-errors.d.ts"
+    },
+    "./protocol/session-policy": {
+      "import": "./dist/protocol/session-policy.js",
+      "types": "./dist/protocol/session-policy.d.ts"
+    },
     "./protocol/analytics-events": {
       "import": "./dist/protocol/analytics-events.js",
       "types": "./dist/protocol/analytics-events.d.ts"
@@ -81,6 +89,10 @@
       "import": "./dist/protocol/messages/oidc-token-relay.js",
       "types": "./dist/protocol/messages/oidc-token-relay.d.ts"
     },
+    "./protocol/messages/dashboard-sealed-write": {
+      "import": "./dist/protocol/messages/dashboard-sealed-write.js",
+      "types": "./dist/protocol/messages/dashboard-sealed-write.d.ts"
+    },
     "./protocol/messages/oidc-mint": {
       "import": "./dist/protocol/messages/oidc-mint.js",
       "types": "./dist/protocol/messages/oidc-mint.d.ts"
@@ -112,12 +124,16 @@
     "./metrics/catalog-policy": {
       "import": "./dist/metrics/catalog-policy.js",
       "types": "./dist/metrics/catalog-policy.d.ts"
+    },
+    "./metrics/metric-kind-compat": {
+      "import": "./dist/metrics/metric-kind-compat.js",
+      "types": "./dist/metrics/metric-kind-compat.d.ts"
     }
   },
   "dependencies": {
     "jose": "^6.1.0",
     "jsonpath-plus": "^10.4.0",
-    "picomatch": "^4.0.4",
+    "picomatch": "^4.0.5",
     "safe-regex": "^2.1.1",
     "zod": "^4.4.3"
   },
@@ -126,8 +142,8 @@
     "@types/safe-regex": "^1.1.6"
   },
   "scripts": {
-    "build": "node ../../scripts/build-ts.mjs && tsc --emitDeclarationOnly",
-    "typecheck": "tsc --noEmit",
+    "build": "node ../../scripts/build-ts.mjs && tsgo --emitDeclarationOnly",
+    "typecheck": "tsgo --noEmit",
     "test": "vitest run"
   }
 }

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/engine@0.1.26",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.1.26/aac1dbb3-c6f9-48b3-8675-85b4ba20c113",
+  "name": "@kici-dev/engine@0.2.0",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.2.0/542cdb3d-4979-42ab-ac13-1e4b9c793893",
   "creationInfo": {
-    "created": "2026-07-06T04:29:39Z",
+    "created": "2026-08-08T04:27:05Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -54,7 +54,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.26",
+      "versionInfo": "0.2.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -65,7 +65,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.26"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.2.0"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
@@ -132,10 +132,10 @@
       "homepage": "https://github.com/s3u/JSONPath"
     },
     {
-      "SPDXID": "SPDXRef-Package-picomatch-4.0.4",
+      "SPDXID": "SPDXRef-Package-picomatch-4.0.5",
       "name": "picomatch",
-      "versionInfo": "4.0.4",
-      "downloadLocation": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "versionInfo": "4.0.5",
+      "downloadLocation": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "MIT",
@@ -145,7 +145,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/picomatch@4.0.4"
+          "referenceLocator": "pkg:npm/picomatch@4.0.5"
         }
       ],
       "description": "Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.",
@@ -240,7 +240,7 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.4",
+      "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.5",
       "relationshipType": "DEPENDS_ON"
     },
     {

package/dist/environment/index.d.ts

@@ -1,6 +0,0 @@
-export type { Environment, EnvironmentBinding, EnvironmentVariable, EnvironmentSourceOverride, ScopedSecret, HeldRun, ProtectionGateResult, TrustTier, } from './types.js';
-export { TrustTierSchema } from './types.js';
-export { resolveSecretsForEnvironment, matchScopePattern, stripScopePrefix, } from './scope-resolver.js';
-export type { HostFacts } from './host-match.js';
-export { mergeOrderedMaps, EnvGateRejectReason } from './multi-env.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/environment/index.js

@@ -1,5 +0,0 @@
-import "../rolldown-runtime-ClRpJifh.js";
-import { TrustTierSchema } from "./types.js";
-import { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix } from "./scope-resolver.js";
-import { EnvGateRejectReason, mergeOrderedMaps } from "./multi-env.js";
-export { EnvGateRejectReason, TrustTierSchema, matchScopePattern, mergeOrderedMaps, resolveSecretsForEnvironment, stripScopePrefix };

package/dist/environment/multi-env.d.ts

@@ -1,30 +0,0 @@
-/**
- * Multi-environment merge helpers shared across the orchestrator dispatch path.
- *
- * A job may bind several deployment environments in order; their resolved
- * secrets/variables are folded last-wins (a later environment's key overrides an
- * earlier one) and their protection gates combine all-must-pass. This module is
- * browser-safe (pure functions + a Zod enum, no Node built-ins) so it can be
- * exported from the engine environment barrel.
- */
-import { z } from 'zod';
-/**
- * Reason a single bound environment rejects a run under all-must-pass
- * aggregation. Used to name which environment and which rule blocked dispatch.
- */
-export declare const EnvGateRejectReason: z.ZodEnum<{
-    branch_restricted: "branch_restricted";
-    trigger_filtered: "trigger_filtered";
-    repo_unmatched: "repo_unmatched";
-    trust_too_low: "trust_too_low";
-    env_disabled: "env_disabled";
-    env_not_found: "env_not_found";
-}>;
-export type EnvGateRejectReason = z.infer<typeof EnvGateRejectReason>;
-/**
- * Fold an ordered list of per-environment resolved maps into one. Later entries
- * override earlier keys (last-wins), matching the documented merge order for
- * `environments: [...]`.
- */
-export declare function mergeOrderedMaps(maps: ReadonlyArray<Record<string, string>>): Record<string, string>;
-//# sourceMappingURL=multi-env.d.ts.map

package/dist/environment/multi-env.js

@@ -1,38 +0,0 @@
-import "../rolldown-runtime-ClRpJifh.js";
-import { z } from "zod";
-//#region src/environment/multi-env.ts
-/**
-* Multi-environment merge helpers shared across the orchestrator dispatch path.
-*
-* A job may bind several deployment environments in order; their resolved
-* secrets/variables are folded last-wins (a later environment's key overrides an
-* earlier one) and their protection gates combine all-must-pass. This module is
-* browser-safe (pure functions + a Zod enum, no Node built-ins) so it can be
-* exported from the engine environment barrel.
-*/
-/**
-* Reason a single bound environment rejects a run under all-must-pass
-* aggregation. Used to name which environment and which rule blocked dispatch.
-*/
-const EnvGateRejectReason = z.enum([
-	"branch_restricted",
-	"trigger_filtered",
-	"repo_unmatched",
-	"trust_too_low",
-	"env_disabled",
-	"env_not_found"
-]);
-/**
-* Fold an ordered list of per-environment resolved maps into one. Later entries
-* override earlier keys (last-wins), matching the documented merge order for
-* `environments: [...]`.
-*/
-function mergeOrderedMaps(maps) {
-	const out = {};
-	for (const m of maps) Object.assign(out, m);
-	return out;
-}
-//#endregion
-export { EnvGateRejectReason, mergeOrderedMaps };
-
-//# sourceMappingURL=multi-env.js.map

package/dist/environment/scope-resolver.d.ts

@@ -1,46 +0,0 @@
-import type { EnvironmentBinding, ScopedSecret } from './types.js';
-import { type HostFacts } from './host-match.js';
-export type { HostFacts } from './host-match.js';
-/**
- * Check whether a scope string matches a pattern.
- *
- * Supports exact match and glob patterns (via picomatch).
- * Scope paths use '/' as separator (e.g., 'aws/prod/db').
- *
- * For prefixed scopes (e.g., 'pg:aws/prod'), the pattern may be prefixed too
- * (e.g., 'pg:**'). In this case, the backend prefix must match exactly and
- * the path portion is matched separately against the glob. This is needed
- * because picomatch's '**' requires '/' separators — 'pg:**' wouldn't match
- * 'pg:aws/prod' without splitting on the colon.
- */
-export declare function matchScopePattern(scope: string, pattern: string): boolean;
-/**
- * Strip the backend prefix from a scope string.
- * Prefixed scopes have the form "backendName:path" (e.g., "pg:aws/prod").
- * Returns the path after the first colon, or the full scope if no prefix.
- */
-export declare function stripScopePrefix(scope: string): string;
-/**
- * Resolve secrets for an environment by matching bindings against scoped secrets.
- *
- * Takes already-filtered bindings (for the target environment). For each binding,
- * finds secrets whose (substituted) scope matches the binding's scopePattern via
- * picomatch. When multiple scopes provide the same key, precedence is the tuple
- * `(host specificity, scope depth)` — a per-host binding (exact host) overrides a
- * fleet-wide one, then longest scope path wins. Scope depth is computed AFTER
- * stripping the backend prefix.
- *
- * When `hostFacts` is supplied (a fan-out child's identity), each binding is
- * gated by its `host_pattern` and its `scope_pattern` is templated per-child
- * (`${agentId}`/`${host}`/`${label:NAME}`). When omitted, only fleet-wide
- * (`'**'`/NULL) non-templated bindings contribute — preserving the workflow-level
- * (no-host) behaviour.
- *
- * @param bindings - Bindings already filtered for the target environment
- * @param allSecrets - All scoped secrets in the org
- * @param decryptFn - Pure decryption function (keeps this module crypto-free)
- * @param hostFacts - Optional fan-out child identity for per-host resolution
- * @returns Flat record of decrypted secret key-value pairs
- */
-export declare function resolveSecretsForEnvironment(bindings: EnvironmentBinding[], allSecrets: ScopedSecret[], decryptFn: (s: ScopedSecret) => string, hostFacts?: HostFacts): Record<string, string>;
-//# sourceMappingURL=scope-resolver.d.ts.map

package/dist/package-manager.d.ts

@@ -1,20 +0,0 @@
-/**
- * Package-manager wire identity for protocol schemas and the lock-file type.
- *
- * Engine has no internal `@kici-dev/*` dependencies (it is a leaf imported by
- * the browser dashboard), so it owns the wire enum for the package manager
- * rather than importing the detection enum from `@kici-dev/shared`. The three
- * values are identical to `@kici-dev/shared`'s `PackageManager` enum; a
- * compile-time assignability test in a package that imports both guards
- * against drift.
- */
-import { z } from 'zod';
-/** Wire schema for the package manager that resolves `.kici/` dependencies. */
-export declare const packageManagerSchema: z.ZodEnum<{
-    npm: "npm";
-    pnpm: "pnpm";
-    yarn: "yarn";
-}>;
-/** `'npm' | 'pnpm' | 'yarn'` — the package-manager identity on the wire. */
-export type PackageManagerId = z.infer<typeof packageManagerSchema>;
-//# sourceMappingURL=package-manager.d.ts.map