@kici-dev/engine 0.1.27 → 0.2.0

package/dist/provider/index.d.ts

@@ -15,10 +15,10 @@ export type { ProviderType } from './types.js';
 export type { WebhookNormalizer, AccessCacheInvalidation } from './webhook-normalizer.js';
 export type { LockFileFetcher } from './lock-file-fetcher.js';
 export { LockFileParseError } from './lock-file-parse-error.js';
-export type { ChangedFilesFetcher } from './changed-files-fetcher.js';
+export type { ChangedFilesFetcher, ChangedFilesResult } from './changed-files-fetcher.js';
 export type { CloneTokenProvider, ProviderGitAuth } from './clone-token-provider.js';
 export type { RepoUrlBuilder } from './repo-url-builder.js';
 export type { ContributorResolver, ContributorInfo, ContributorPermission, } from './contributor-resolver.js';
-export type { CheckStatusPoster, CheckStatus } from './check-status-poster.js';
+export type { CheckStatusPoster, CheckStatus, WorkflowModificationInfo, } from './check-status-poster.js';
 export * from './check-run-conclusion.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/registration/registerable-trigger-type.d.ts

@@ -25,28 +25,29 @@ import { z } from 'zod';
  * Access values: RegisterableTriggerType.enum.kici_event, etc.
  */
 export declare const RegisterableTriggerType: z.ZodEnum<{
+    comment: "comment";
+    create: "create";
+    delete: "delete";
     dispatch: "dispatch";
-    push: "push";
-    status: "status";
+    fork: "fork";
     generic_webhook: "generic_webhook";
+    job_complete: "job_complete";
+    kici_event: "kici_event";
+    lifecycle: "lifecycle";
     pr: "pr";
-    tag: "tag";
-    comment: "comment";
+    push: "push";
+    release: "release";
     review: "review";
     review_comment: "review_comment";
-    release: "release";
-    create: "create";
-    delete: "delete";
-    workflow_run: "workflow_run";
-    fork: "fork";
+    schedule: "schedule";
     star: "star";
+    status: "status";
+    tag: "tag";
     watch: "watch";
     webhook: "webhook";
-    kici_event: "kici_event";
     workflow_complete: "workflow_complete";
-    job_complete: "job_complete";
-    schedule: "schedule";
-    lifecycle: "lifecycle";
+    workflow_run: "workflow_run";
+    workflows_failed_batch: "workflows_failed_batch";
 }>;
 export type RegisterableTriggerType = z.infer<typeof RegisterableTriggerType>;
 //# sourceMappingURL=registerable-trigger-type.d.ts.map

package/dist/registration/registerable-trigger-type.js

@@ -29,6 +29,7 @@ import { z } from "zod";
 const RegisterableTriggerType = z.enum([
 	"kici_event",
 	"workflow_complete",
+	"workflows_failed_batch",
 	"job_complete",
 	"generic_webhook",
 	"schedule",

package/dist/sandbox/capabilities.d.ts

@@ -0,0 +1,6 @@
+export declare const KNOWN_LINUX_CAPABILITIES: ReadonlySet<string>;
+/** Normalize a capability name to the bare uppercase form used by CapAdd and the allow-list. */
+export declare function canonicalizeCapability(raw: string): string;
+/** True when `raw` (in either CAP_-prefixed or bare form) is a real Linux capability. */
+export declare function isKnownCapability(raw: string): boolean;
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/sandbox/capabilities.js

@@ -0,0 +1,57 @@
+import "../rolldown-runtime-ClRpJifh.js";
+//#region src/sandbox/capabilities.ts
+const KNOWN_LINUX_CAPABILITIES = /* @__PURE__ */ new Set([
+	"CHOWN",
+	"DAC_OVERRIDE",
+	"DAC_READ_SEARCH",
+	"FOWNER",
+	"FSETID",
+	"KILL",
+	"SETGID",
+	"SETUID",
+	"SETPCAP",
+	"LINUX_IMMUTABLE",
+	"NET_BIND_SERVICE",
+	"NET_BROADCAST",
+	"NET_ADMIN",
+	"NET_RAW",
+	"IPC_LOCK",
+	"IPC_OWNER",
+	"SYS_MODULE",
+	"SYS_RAWIO",
+	"SYS_CHROOT",
+	"SYS_PTRACE",
+	"SYS_PACCT",
+	"SYS_ADMIN",
+	"SYS_BOOT",
+	"SYS_NICE",
+	"SYS_RESOURCE",
+	"SYS_TIME",
+	"SYS_TTY_CONFIG",
+	"MKNOD",
+	"LEASE",
+	"AUDIT_WRITE",
+	"AUDIT_CONTROL",
+	"SETFCAP",
+	"MAC_OVERRIDE",
+	"MAC_ADMIN",
+	"SYSLOG",
+	"WAKE_ALARM",
+	"BLOCK_SUSPEND",
+	"AUDIT_READ",
+	"PERFMON",
+	"BPF",
+	"CHECKPOINT_RESTORE"
+]);
+/** Normalize a capability name to the bare uppercase form used by CapAdd and the allow-list. */
+function canonicalizeCapability(raw) {
+	return raw.trim().toUpperCase().replace(/^CAP_/, "");
+}
+/** True when `raw` (in either CAP_-prefixed or bare form) is a real Linux capability. */
+function isKnownCapability(raw) {
+	return KNOWN_LINUX_CAPABILITIES.has(canonicalizeCapability(raw));
+}
+//#endregion
+export { KNOWN_LINUX_CAPABILITIES, canonicalizeCapability, isKnownCapability };
+
+//# sourceMappingURL=capabilities.js.map

package/dist/scaler/scaler-backend-type.d.ts

@@ -7,8 +7,8 @@ import { z } from 'zod';
  * Access values: ScalerBackendType.enum.container, ScalerBackendType.enum.firecracker, etc.
  */
 export declare const ScalerBackendType: z.ZodEnum<{
-    container: "container";
     "bare-metal": "bare-metal";
+    container: "container";
     firecracker: "firecracker";
     kubernetes: "kubernetes";
 }>;

package/dist/status/presentation.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Shared execution-status presentation vocabulary: the canonical status union,
+ * a total precedence order for roll-up aggregates, legacy-spelling resolution,
+ * and a per-status failure classification.
+ *
+ * Pure Zod (browser-safe): the engine barrel re-exports this module and the
+ * dashboard imports the barrel, so no Node built-in may appear here.
+ *
+ * Consumers keep their own presentation tables (badge colour, terminal colour,
+ * emoji, webhook event type) — those are medium-specific. What lives here is
+ * the vocabulary itself and the two questions every consumer asks about it:
+ * "which of these statuses wins?" and "is this status a failure?".
+ */
+import { z } from 'zod';
+import { ExecutionJobStatus, ExecutionRunStatus } from '../protocol/messages/execution-status.js';
+/**
+ * Every status a run or a job can hold. `ExecutionStepStatus` is a strict
+ * subset (running / success / failed / skipped / pending / cancelled), so a
+ * table keyed by this union also covers step surfaces.
+ */
+export type CanonicalStatus = ExecutionRunStatus | ExecutionJobStatus;
+/** Every canonical status, derived from the engine enums so it cannot drift. */
+export declare const CANONICAL_STATUSES: readonly CanonicalStatus[];
+/** Canonical statuses ordered worst-first. Derived from `STATUS_RANK`. */
+export declare const STATUS_PRECEDENCE: readonly CanonicalStatus[];
+/**
+ * Legacy status spellings that map onto a canonical status. An alias always
+ * resolves like the status it aliases, so a consumer never needs a second
+ * hand-written copy of the mapping.
+ */
+export declare const LEGACY_STATUS_ALIASES: Readonly<Record<string, CanonicalStatus>>;
+/**
+ * Resolve a status string onto its canonical status, or `undefined` when it is
+ * neither canonical nor a known legacy alias. Callers that accept mixed case
+ * lowercase their input first.
+ *
+ * `Object.hasOwn`, not a bare index: an object literal inherits
+ * `Object.prototype`, so indexing it with `toString` / `constructor` /
+ * `valueOf` would yield a function rather than `undefined` and the caller's
+ * fallback would never fire.
+ */
+export declare function toCanonicalStatus(status: string): CanonicalStatus | undefined;
+/**
+ * The winning status for a group of children, by `STATUS_RANK` precedence.
+ *
+ * Returns `undefined` when no input resolves, so the caller decides what to
+ * show rather than being handed a fabricated status. A roll-up must never
+ * invent "queued" or "success" for a child it did not recognise.
+ *
+ * An unrecognised child in an OTHERWISE resolvable group is skipped, so the
+ * aggregate reports the worst status this build understands. That is a
+ * deliberate trade: the alternative — refusing to aggregate at all — would blank
+ * the group header for one unknown child. It does mean an older bundle talking
+ * to a newer orchestrator can report a group as `success` when an unrecognised
+ * sibling was in fact a failure; the per-child badges still render each unknown
+ * status on its own terms, which is where the discrepancy is visible.
+ */
+export declare function worstStatus(statuses: readonly string[]): CanonicalStatus | undefined;
+/**
+ * How a status counts when deciding whether something failed.
+ *
+ *  - `failure`   — the workflow did not do what it declared. Drives the run
+ *                  roll-up and the `on-failure` needs-edge expansion.
+ *  - `cancelled` — deliberately stopped; its own outcome, not a failure.
+ *  - `neutral`   — terminal but never ran (skipped).
+ *  - `success`   — passed.
+ *  - `in-flight` — not terminal yet.
+ */
+export declare const StatusFailureClass: z.ZodEnum<{
+    cancelled: "cancelled";
+    failure: "failure";
+    "in-flight": "in-flight";
+    neutral: "neutral";
+    success: "success";
+}>;
+export type StatusFailureClass = z.infer<typeof StatusFailureClass>;
+/**
+ * Failure classification for every canonical status. Exhaustive by type, for
+ * the same reason as `STATUS_RANK`.
+ *
+ * `drift_dropped` is a `failure`: the job was dropped by determinism drift on
+ * the executing agent, so a job the workflow declared did not run. The run
+ * roll-up and the `on-failure` needs-edge both read this one table, which is
+ * what stops them from disagreeing.
+ */
+export declare const STATUS_FAILURE_CLASS: Readonly<Record<CanonicalStatus, StatusFailureClass>>;
+/** True when a status means the workflow did not do what it declared. */
+export declare function isFailureStatus(status: string): boolean;
+//# sourceMappingURL=presentation.d.ts.map

package/dist/status/presentation.js

@@ -0,0 +1,163 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { ExecutionJobStatus, ExecutionRunStatus } from "../protocol/messages/execution-status.js";
+import { z } from "zod";
+//#region src/status/presentation.ts
+/**
+* Shared execution-status presentation vocabulary: the canonical status union,
+* a total precedence order for roll-up aggregates, legacy-spelling resolution,
+* and a per-status failure classification.
+*
+* Pure Zod (browser-safe): the engine barrel re-exports this module and the
+* dashboard imports the barrel, so no Node built-in may appear here.
+*
+* Consumers keep their own presentation tables (badge colour, terminal colour,
+* emoji, webhook event type) — those are medium-specific. What lives here is
+* the vocabulary itself and the two questions every consumer asks about it:
+* "which of these statuses wins?" and "is this status a failure?".
+*/
+/** Every canonical status, derived from the engine enums so it cannot drift. */
+const CANONICAL_STATUSES = Object.freeze([.../* @__PURE__ */ new Set([...ExecutionRunStatus.options, ...ExecutionJobStatus.options])]);
+const CANONICAL_SET = new Set(CANONICAL_STATUSES);
+/**
+* Precedence rank for roll-up aggregates — LOWER wins.
+*
+* Exhaustive by type: adding a value to either engine enum breaks this file's
+* typecheck. That is the whole point — `STATUS_PRECEDENCE` below is a plain
+* array, and an array literal missing a member would compile silently, so the
+* ordered list is derived from this record rather than written by hand.
+*
+*  - Failures outrank in-flight states, so one failed shard reddens a matrix
+*    group immediately rather than waiting for its siblings to settle.
+*  - `cancelling` sits above `recovering` and `running`: an in-flight cancel
+*    must stay visible on the group header.
+*  - `unroutable` sits beside the other "declared but never ran" failures: a
+*    job whose `runsOn` matched no agent must redden its group, since the
+*    workflow did not do what it declared.
+*  - `cancelled` sits below the actively-executing states (`running`,
+*    `recovering`, `cancelling`) but ABOVE the not-yet-started ones (`held`,
+*    `queued`, `pending`). A band with a live child is still running whatever
+*    happened to its cancelled sibling; a band whose only news is that a child
+*    was cancelled reads "Cancelled" rather than "Queued", because the
+*    cancellation is the thing an operator needs to see.
+*  - `success` outranks `skipped`, so a matrix where three shards were narrowed
+*    out and one passed reads green. Only a group with no successful child
+*    reads "Skipped".
+*/
+const STATUS_RANK = Object.freeze({
+	[ExecutionJobStatus.enum.failed]: 0,
+	[ExecutionJobStatus.enum.timed_out_stale]: 1,
+	[ExecutionJobStatus.enum.drift_dropped]: 2,
+	[ExecutionJobStatus.enum.unroutable]: 3,
+	[ExecutionJobStatus.enum.cancelling]: 4,
+	[ExecutionJobStatus.enum.recovering]: 5,
+	[ExecutionJobStatus.enum.running]: 6,
+	[ExecutionJobStatus.enum.cancelled]: 7,
+	[ExecutionRunStatus.enum.held]: 8,
+	[ExecutionJobStatus.enum.queued]: 9,
+	[ExecutionJobStatus.enum.pending]: 10,
+	[ExecutionJobStatus.enum.success]: 11,
+	[ExecutionJobStatus.enum.skipped]: 12
+});
+/** Canonical statuses ordered worst-first. Derived from `STATUS_RANK`. */
+const STATUS_PRECEDENCE = Object.freeze([...CANONICAL_STATUSES].sort((a, b) => STATUS_RANK[a] - STATUS_RANK[b]));
+/**
+* Legacy status spellings that map onto a canonical status. An alias always
+* resolves like the status it aliases, so a consumer never needs a second
+* hand-written copy of the mapping.
+*/
+const LEGACY_STATUS_ALIASES = Object.freeze({
+	passed: ExecutionRunStatus.enum.success,
+	completed: ExecutionRunStatus.enum.success,
+	in_progress: ExecutionRunStatus.enum.running,
+	error: ExecutionRunStatus.enum.failed,
+	canceled: ExecutionRunStatus.enum.cancelled,
+	waiting: ExecutionRunStatus.enum.pending
+});
+/**
+* Resolve a status string onto its canonical status, or `undefined` when it is
+* neither canonical nor a known legacy alias. Callers that accept mixed case
+* lowercase their input first.
+*
+* `Object.hasOwn`, not a bare index: an object literal inherits
+* `Object.prototype`, so indexing it with `toString` / `constructor` /
+* `valueOf` would yield a function rather than `undefined` and the caller's
+* fallback would never fire.
+*/
+function toCanonicalStatus(status) {
+	if (Object.hasOwn(LEGACY_STATUS_ALIASES, status)) return LEGACY_STATUS_ALIASES[status];
+	return CANONICAL_SET.has(status) ? status : void 0;
+}
+/**
+* The winning status for a group of children, by `STATUS_RANK` precedence.
+*
+* Returns `undefined` when no input resolves, so the caller decides what to
+* show rather than being handed a fabricated status. A roll-up must never
+* invent "queued" or "success" for a child it did not recognise.
+*
+* An unrecognised child in an OTHERWISE resolvable group is skipped, so the
+* aggregate reports the worst status this build understands. That is a
+* deliberate trade: the alternative — refusing to aggregate at all — would blank
+* the group header for one unknown child. It does mean an older bundle talking
+* to a newer orchestrator can report a group as `success` when an unrecognised
+* sibling was in fact a failure; the per-child badges still render each unknown
+* status on its own terms, which is where the discrepancy is visible.
+*/
+function worstStatus(statuses) {
+	let best;
+	for (const raw of statuses) {
+		const canonical = toCanonicalStatus(raw);
+		if (canonical === void 0) continue;
+		if (best === void 0 || STATUS_RANK[canonical] < STATUS_RANK[best]) best = canonical;
+	}
+	return best;
+}
+/**
+* How a status counts when deciding whether something failed.
+*
+*  - `failure`   — the workflow did not do what it declared. Drives the run
+*                  roll-up and the `on-failure` needs-edge expansion.
+*  - `cancelled` — deliberately stopped; its own outcome, not a failure.
+*  - `neutral`   — terminal but never ran (skipped).
+*  - `success`   — passed.
+*  - `in-flight` — not terminal yet.
+*/
+const StatusFailureClass = z.enum([
+	"failure",
+	"cancelled",
+	"neutral",
+	"success",
+	"in-flight"
+]);
+/**
+* Failure classification for every canonical status. Exhaustive by type, for
+* the same reason as `STATUS_RANK`.
+*
+* `drift_dropped` is a `failure`: the job was dropped by determinism drift on
+* the executing agent, so a job the workflow declared did not run. The run
+* roll-up and the `on-failure` needs-edge both read this one table, which is
+* what stops them from disagreeing.
+*/
+const STATUS_FAILURE_CLASS = Object.freeze({
+	[ExecutionJobStatus.enum.failed]: StatusFailureClass.enum.failure,
+	[ExecutionJobStatus.enum.timed_out_stale]: StatusFailureClass.enum.failure,
+	[ExecutionJobStatus.enum.drift_dropped]: StatusFailureClass.enum.failure,
+	[ExecutionJobStatus.enum.unroutable]: StatusFailureClass.enum.failure,
+	[ExecutionJobStatus.enum.cancelled]: StatusFailureClass.enum.cancelled,
+	[ExecutionJobStatus.enum.skipped]: StatusFailureClass.enum.neutral,
+	[ExecutionJobStatus.enum.success]: StatusFailureClass.enum.success,
+	[ExecutionJobStatus.enum.pending]: StatusFailureClass.enum["in-flight"],
+	[ExecutionJobStatus.enum.queued]: StatusFailureClass.enum["in-flight"],
+	[ExecutionJobStatus.enum.running]: StatusFailureClass.enum["in-flight"],
+	[ExecutionJobStatus.enum.recovering]: StatusFailureClass.enum["in-flight"],
+	[ExecutionJobStatus.enum.cancelling]: StatusFailureClass.enum["in-flight"],
+	[ExecutionRunStatus.enum.held]: StatusFailureClass.enum["in-flight"]
+});
+/** True when a status means the workflow did not do what it declared. */
+function isFailureStatus(status) {
+	const canonical = toCanonicalStatus(status.toLowerCase());
+	return canonical !== void 0 && STATUS_FAILURE_CLASS[canonical] === StatusFailureClass.enum.failure;
+}
+//#endregion
+export { CANONICAL_STATUSES, LEGACY_STATUS_ALIASES, STATUS_FAILURE_CLASS, STATUS_PRECEDENCE, StatusFailureClass, isFailureStatus, toCanonicalStatus, worstStatus };
+
+//# sourceMappingURL=presentation.js.map

package/dist/trigger/compiled-matchers.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Return a memoized RegExp for the given pattern + flags. The key encodes the
+ * flags first with a space separator; regex flags are restricted to
+ * `[gimsuydv]`, so the separator can never collide with a pattern that starts
+ * with a space.
+ */
+export declare function getCompiledRegex(pattern: string, flags?: string): RegExp;
+/**
+ * Return a memoized picomatch matcher function for the given glob pattern.
+ * `getGlobMatcher(pattern)(str)` is equivalent to `picomatch.isMatch(str, pattern)`.
+ */
+export declare function getGlobMatcher(pattern: string): (s: string) => boolean;
+//# sourceMappingURL=compiled-matchers.d.ts.map

package/dist/trigger/compiled-matchers.js

@@ -0,0 +1,44 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import picomatch from "picomatch";
+//#region src/trigger/compiled-matchers.ts
+/**
+* Bounded memo for compiled trigger matchers. Regex and glob compilation is
+* pure and deterministic per pattern string, so we compile each distinct
+* pattern once and reuse it across every match call. Insertion-ordered Map
+* with oldest-eviction keeps the memo bounded without a new dependency, and
+* keeps the engine barrel browser-safe (no node:* imports).
+*/
+const MAX_COMPILED = 5e3;
+function boundedGet(cache, key, make) {
+	const existing = cache.get(key);
+	if (existing !== void 0) return existing;
+	const value = make();
+	cache.set(key, value);
+	if (cache.size > MAX_COMPILED) {
+		const oldest = cache.keys().next().value;
+		if (oldest !== void 0) cache.delete(oldest);
+	}
+	return value;
+}
+const regexCache = /* @__PURE__ */ new Map();
+const globCache = /* @__PURE__ */ new Map();
+/**
+* Return a memoized RegExp for the given pattern + flags. The key encodes the
+* flags first with a space separator; regex flags are restricted to
+* `[gimsuydv]`, so the separator can never collide with a pattern that starts
+* with a space.
+*/
+function getCompiledRegex(pattern, flags) {
+	return boundedGet(regexCache, `${flags ?? ""} ${pattern}`, () => new RegExp(pattern, flags));
+}
+/**
+* Return a memoized picomatch matcher function for the given glob pattern.
+* `getGlobMatcher(pattern)(str)` is equivalent to `picomatch.isMatch(str, pattern)`.
+*/
+function getGlobMatcher(pattern) {
+	return boundedGet(globCache, pattern, () => picomatch(pattern));
+}
+//#endregion
+export { getCompiledRegex, getGlobMatcher };
+
+//# sourceMappingURL=compiled-matchers.js.map

package/dist/trigger/event-buckets.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Event-type bucketing for trigger matching. Walking every workflow per
+ * webhook is O(all-workflows) even though most reject on the event-type guard.
+ * We index workflows by the SimulatedEvent.type(s) they can match once per
+ * lockfile (memoized on the workflows-array identity) and, on the hot dispatch
+ * path, evaluate only the candidates for the incoming event type.
+ *
+ * Pure module — no node:* imports — so the engine barrel stays browser-safe.
+ */
+import type { LockWorkflow, SimulatedEvent } from './types.js';
+import type { WorkflowDecision } from './decision-trace.js';
+import type { TriggerEventType } from './trigger-event-type.js';
+/**
+ * Static inverse of the `event.type !== X` guards in matcher.ts. Every trigger
+ * `_type` maps to the set of SimulatedEvent.type values whose guard it passes.
+ *
+ * Two triggers are multi-type:
+ *  - `webhook` is NOT in this map — its event types are per-instance
+ *    (`trigger.events`), resolved in prepareEventBuckets.
+ *  - `workflows_failed_batch` matches TWO event types: a failed
+ *    `workflow_complete` (accumulation input) and the synthetic
+ *    `workflows_failed_batch` (dispatch), so it maps to both.
+ *
+ * Guarded against drift by event-buckets.test.ts (the equivalence + guard
+ * tests would fail if a guard changed without this map).
+ */
+export declare const TRIGGER_TYPE_TO_EVENT_TYPES: Record<string, readonly TriggerEventType[]>;
+/**
+ * Index workflows by every SimulatedEvent.type any of their triggers can match.
+ * Memoized on the workflows-array identity: LockFileCache returns the same
+ * LockFile (hence the same workflows array) on a cache hit, so buckets are
+ * built once per cached lockfile and GC'd with it.
+ */
+export declare function prepareEventBuckets(workflows: readonly LockWorkflow[]): Map<string, LockWorkflow[]>;
+/**
+ * Match only the workflows subscribed to the incoming event type. Returns
+ * candidate decisions (a superset of matched); callers filter `.matched`.
+ * The candidate set is a superset of every workflow matchAllWorkflows would
+ * mark matched — a workflow matches only if some trigger's guard passes for
+ * event.type, which means that trigger indexed the workflow under event.type —
+ * so the matched result is identical.
+ */
+export declare function matchWorkflowsForEvent(workflows: readonly LockWorkflow[], event: SimulatedEvent): WorkflowDecision[];
+//# sourceMappingURL=event-buckets.d.ts.map

package/dist/trigger/event-buckets.js

@@ -0,0 +1,93 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { matchWorkflowTriggers } from "./matcher.js";
+//#region src/trigger/event-buckets.ts
+/**
+* Static inverse of the `event.type !== X` guards in matcher.ts. Every trigger
+* `_type` maps to the set of SimulatedEvent.type values whose guard it passes.
+*
+* Two triggers are multi-type:
+*  - `webhook` is NOT in this map — its event types are per-instance
+*    (`trigger.events`), resolved in prepareEventBuckets.
+*  - `workflows_failed_batch` matches TWO event types: a failed
+*    `workflow_complete` (accumulation input) and the synthetic
+*    `workflows_failed_batch` (dispatch), so it maps to both.
+*
+* Guarded against drift by event-buckets.test.ts (the equivalence + guard
+* tests would fail if a guard changed without this map).
+*/
+const TRIGGER_TYPE_TO_EVENT_TYPES = {
+	pr: ["pull_request"],
+	push: ["push"],
+	tag: ["tag"],
+	comment: ["comment"],
+	review: ["review"],
+	review_comment: ["review_comment"],
+	release: ["release"],
+	dispatch: ["dispatch"],
+	create: ["create"],
+	delete: ["delete"],
+	status: ["status"],
+	workflow_run: ["workflow_run"],
+	fork: ["fork"],
+	star: ["star"],
+	watch: ["watch"],
+	kici_event: ["kici_event"],
+	workflow_complete: ["workflow_complete"],
+	workflows_failed_batch: ["workflow_complete", "workflows_failed_batch"],
+	job_complete: ["job_complete"],
+	generic_webhook: ["generic_webhook"],
+	schedule: ["schedule"],
+	lifecycle: ["lifecycle"]
+};
+const WEBHOOK_TRIGGER_TYPE = "webhook";
+const bucketMemo = /* @__PURE__ */ new WeakMap();
+/**
+* Index workflows by every SimulatedEvent.type any of their triggers can match.
+* Memoized on the workflows-array identity: LockFileCache returns the same
+* LockFile (hence the same workflows array) on a cache hit, so buckets are
+* built once per cached lockfile and GC'd with it.
+*/
+function prepareEventBuckets(workflows) {
+	const cached = bucketMemo.get(workflows);
+	if (cached) return cached;
+	const buckets = /* @__PURE__ */ new Map();
+	const add = (eventType, w, seen) => {
+		if (seen.has(eventType)) return;
+		seen.add(eventType);
+		let arr = buckets.get(eventType);
+		if (!arr) {
+			arr = [];
+			buckets.set(eventType, arr);
+		}
+		arr.push(w);
+	};
+	for (const w of workflows) {
+		const seen = /* @__PURE__ */ new Set();
+		for (const trigger of w.triggers) {
+			if (trigger == null) continue;
+			if (trigger._type === WEBHOOK_TRIGGER_TYPE) {
+				for (const evt of trigger.events) add(evt, w, seen);
+				continue;
+			}
+			const eventTypes = TRIGGER_TYPE_TO_EVENT_TYPES[trigger._type];
+			if (eventTypes) for (const evt of eventTypes) add(evt, w, seen);
+		}
+	}
+	bucketMemo.set(workflows, buckets);
+	return buckets;
+}
+/**
+* Match only the workflows subscribed to the incoming event type. Returns
+* candidate decisions (a superset of matched); callers filter `.matched`.
+* The candidate set is a superset of every workflow matchAllWorkflows would
+* mark matched — a workflow matches only if some trigger's guard passes for
+* event.type, which means that trigger indexed the workflow under event.type —
+* so the matched result is identical.
+*/
+function matchWorkflowsForEvent(workflows, event) {
+	return (prepareEventBuckets(workflows).get(event.type) ?? []).map((w) => matchWorkflowTriggers(w, event));
+}
+//#endregion
+export { TRIGGER_TYPE_TO_EVENT_TYPES, matchWorkflowsForEvent, prepareEventBuckets };
+
+//# sourceMappingURL=event-buckets.js.map

package/dist/trigger/matcher.d.ts

@@ -1,5 +1,5 @@
-import type { LockWorkflow, LockBranchPattern, SimulatedEvent } from './types.js';
-import { type WorkflowDecision } from './decision-trace.js';
+import type { LockTrigger, LockWorkflow, LockBranchPattern, SimulatedEvent, ChangedFilesStatus } from './types.js';
+import { type TraceEntry, type WorkflowDecision } from './decision-trace.js';
 /**
  * Match a branch pattern against a branch name.
  */
@@ -9,7 +9,7 @@ export declare function matchBranchPattern(pattern: LockBranchPattern, branch: s
  * Patterns prefixed with ! are exclusions. Remaining patterns are inclusions.
  * An all-negation array has implicit match-all semantics for non-excluded files.
  */
-export declare function matchPathPatterns(paths: readonly string[], changedFiles: string[]): boolean;
+export declare function matchPathPatterns(paths: readonly string[], changedFiles: string[], status?: ChangedFilesStatus): boolean;
 /**
  * Match repo patterns against a source repository identifier.
  * Patterns with ! prefix in the pattern string are exclusions.
@@ -17,6 +17,10 @@ export declare function matchPathPatterns(paths: readonly string[], changedFiles
  * Empty array = no filtering (matches all repos).
  */
 export declare function matchRepoPatterns(repos: readonly LockBranchPattern[], sourceRepo: string): boolean;
+/**
+ * Match a trigger against a simulated event.
+ */
+export declare function matchTrigger(trigger: LockTrigger, event: SimulatedEvent, traces: TraceEntry[]): boolean;
 /**
  * Match all triggers for a workflow against an event.
  * Returns WorkflowDecision with full trace.