@kici-dev/engine 0.4.0 → 0.6.0

package/dist/repo/pattern-negation.d.ts

@@ -0,0 +1,73 @@
+/**
+ * The one classifier for "picomatch would read this repo pattern as a
+ * negation".
+ *
+ * Repo patterns are written on lists whose direction is already fixed by the
+ * list itself — a role's allowed repositories, a global-workflow allow list, a
+ * global-workflow deny list. A pattern picomatch reads as a negation inverts
+ * that direction inside a single entry, so an entry that reads as a restriction
+ * matches as its complement. On an allow list that grants almost everything; on
+ * a deny list it admits the one repository the entry named.
+ *
+ * This lives in the engine, and not beside either consumer, because two
+ * hand-maintained ban lists for one pattern language cannot be kept in step.
+ * The two ways they drift apart are both live hazards: a list that misses the
+ * regular-expression assertions accepts a real inversion, and a list that
+ * refuses `[!…]` turns away a genuine restriction. Every surface that stores a
+ * repo pattern reads its verdict from here, so neither can happen on one
+ * surface alone.
+ */
+/**
+ * The regular-expression negations picomatch passes through into the compiled
+ * matcher: the negative lookahead `(?!…)` and the negative lookbehind `(?<!…)`.
+ * The optional `<` is what makes one pattern cover both; the positive `(?=…)`,
+ * `(?<=…)`, `(?:…)` and a plain capture group are deliberately not matched.
+ */
+export declare const REGEX_NEGATIVE_ASSERTION: RegExp;
+/**
+ * Why picomatch would read `pattern` as a negation, or null when it would not.
+ *
+ * Four arms, because picomatch reads four negation forms, each of which turns a
+ * pattern that reads as a restriction into a grant.
+ *
+ * A leading `!` negates the whole pattern. The extglob complement `!(…)`
+ * negates wherever it appears, so `org/!(secret)` covers every repository under
+ * `org/` except that one — the same defect in a prefix-scoped shape. The
+ * negated character class `[^…]` does it one character at a time: `org/[^s]*`
+ * covers every repository under `org/` whose name does not begin with `s`. The
+ * negative assertions are the widest of the four, because they can spell a
+ * whole repository identifier rather than one character: picomatch compiles a
+ * pattern to a regular expression and passes a group it does not recognise
+ * through verbatim, so `(?!org/secret)**` reaches the matcher as a real
+ * lookahead and matches every repository in every organization except the one
+ * it names.
+ *
+ * The extglob arm matches the two-character sequence `!(` and nothing wider:
+ * `*(`, `+(`, `@(` and `?(` are the non-complementing extglob heads and do not
+ * invert, so rejecting a bare `(` would refuse four harmless forms for no gain.
+ * A `(` cannot appear in a repository identifier, so no legitimate pattern
+ * contains `!(`. The assertion arm is narrow for the same reason: `(?=…)`,
+ * `(?<=…)`, `(?:…)` and a plain capture group match strictly what they name, so
+ * only the two negative forms are refused.
+ *
+ * The character-class arm matches `[^` and nothing wider: a `[` cannot appear
+ * in a repository identifier either, and a bracket that is not a negation —
+ * `org/[abc]*` — is a legitimate restriction. It matches `[^` and NOT `[!`:
+ * picomatch does not read `[!…]` as the POSIX negation. It reads it as a
+ * literal class containing `!` and the listed characters, so `org/[!s]*`
+ * matches exactly the repositories whose name begins with `!` or `s` — the
+ * exact inverse of `org/[^s]*`, and a genuine restriction. Rejecting it would
+ * refuse a pattern that grants strictly less than it names while leaving the
+ * real inversion open.
+ *
+ * A bare `!` is different — it *can* appear in a repository name — so the first
+ * arm stays anchored: `org/we!rd` is a legitimate literal, and an
+ * `includes('!')` check would silently reject a valid repository name.
+ */
+export declare function negatedPatternReason(pattern: string): string | null;
+/**
+ * True when `pattern` is a picomatch negation — whole-pattern `!…`, extglob
+ * `!(…)`, negated character class `[^…]`, or a negative lookahead / lookbehind.
+ */
+export declare function isNegatedPattern(pattern: string): boolean;
+//# sourceMappingURL=pattern-negation.d.ts.map

package/dist/repo/pattern-negation.js

@@ -0,0 +1,86 @@
+import "../rolldown-runtime-ClRpJifh.js";
+//#region src/repo/pattern-negation.ts
+/**
+* The one classifier for "picomatch would read this repo pattern as a
+* negation".
+*
+* Repo patterns are written on lists whose direction is already fixed by the
+* list itself — a role's allowed repositories, a global-workflow allow list, a
+* global-workflow deny list. A pattern picomatch reads as a negation inverts
+* that direction inside a single entry, so an entry that reads as a restriction
+* matches as its complement. On an allow list that grants almost everything; on
+* a deny list it admits the one repository the entry named.
+*
+* This lives in the engine, and not beside either consumer, because two
+* hand-maintained ban lists for one pattern language cannot be kept in step.
+* The two ways they drift apart are both live hazards: a list that misses the
+* regular-expression assertions accepts a real inversion, and a list that
+* refuses `[!…]` turns away a genuine restriction. Every surface that stores a
+* repo pattern reads its verdict from here, so neither can happen on one
+* surface alone.
+*/
+/**
+* The regular-expression negations picomatch passes through into the compiled
+* matcher: the negative lookahead `(?!…)` and the negative lookbehind `(?<!…)`.
+* The optional `<` is what makes one pattern cover both; the positive `(?=…)`,
+* `(?<=…)`, `(?:…)` and a plain capture group are deliberately not matched.
+*/
+const REGEX_NEGATIVE_ASSERTION = /\(\?<?!/;
+/**
+* Why picomatch would read `pattern` as a negation, or null when it would not.
+*
+* Four arms, because picomatch reads four negation forms, each of which turns a
+* pattern that reads as a restriction into a grant.
+*
+* A leading `!` negates the whole pattern. The extglob complement `!(…)`
+* negates wherever it appears, so `org/!(secret)` covers every repository under
+* `org/` except that one — the same defect in a prefix-scoped shape. The
+* negated character class `[^…]` does it one character at a time: `org/[^s]*`
+* covers every repository under `org/` whose name does not begin with `s`. The
+* negative assertions are the widest of the four, because they can spell a
+* whole repository identifier rather than one character: picomatch compiles a
+* pattern to a regular expression and passes a group it does not recognise
+* through verbatim, so `(?!org/secret)**` reaches the matcher as a real
+* lookahead and matches every repository in every organization except the one
+* it names.
+*
+* The extglob arm matches the two-character sequence `!(` and nothing wider:
+* `*(`, `+(`, `@(` and `?(` are the non-complementing extglob heads and do not
+* invert, so rejecting a bare `(` would refuse four harmless forms for no gain.
+* A `(` cannot appear in a repository identifier, so no legitimate pattern
+* contains `!(`. The assertion arm is narrow for the same reason: `(?=…)`,
+* `(?<=…)`, `(?:…)` and a plain capture group match strictly what they name, so
+* only the two negative forms are refused.
+*
+* The character-class arm matches `[^` and nothing wider: a `[` cannot appear
+* in a repository identifier either, and a bracket that is not a negation —
+* `org/[abc]*` — is a legitimate restriction. It matches `[^` and NOT `[!`:
+* picomatch does not read `[!…]` as the POSIX negation. It reads it as a
+* literal class containing `!` and the listed characters, so `org/[!s]*`
+* matches exactly the repositories whose name begins with `!` or `s` — the
+* exact inverse of `org/[^s]*`, and a genuine restriction. Rejecting it would
+* refuse a pattern that grants strictly less than it names while leaving the
+* real inversion open.
+*
+* A bare `!` is different — it *can* appear in a repository name — so the first
+* arm stays anchored: `org/we!rd` is a legitimate literal, and an
+* `includes('!')` check would silently reject a valid repository name.
+*/
+function negatedPatternReason(pattern) {
+	if (pattern.startsWith("!")) return "negation ('!' prefix)";
+	if (pattern.includes("!(")) return "extglob negation ('!(…)')";
+	if (pattern.includes("[^")) return "character-class negation ('[^…]')";
+	if (REGEX_NEGATIVE_ASSERTION.test(pattern)) return "negative assertion ('(?!…)' / '(?<!…)')";
+	return null;
+}
+/**
+* True when `pattern` is a picomatch negation — whole-pattern `!…`, extglob
+* `!(…)`, negated character class `[^…]`, or a negative lookahead / lookbehind.
+*/
+function isNegatedPattern(pattern) {
+	return negatedPatternReason(pattern) !== null;
+}
+//#endregion
+export { REGEX_NEGATIVE_ASSERTION, isNegatedPattern, negatedPatternReason };
+
+//# sourceMappingURL=pattern-negation.js.map

package/dist/safe-regex.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Reject a ReDoS-prone author-supplied regex before it is compiled.
+ *
+ * `safe-regex` is a star-height heuristic. The orchestrator is single-tenant, so
+ * a slipped-through pattern only stalls the author's own orchestrator — but every
+ * author regex the orchestrator compiles from lock-file data on the webhook path
+ * (label selectors, branch/tag/repo patterns, embedded JSONPath `/re/flags`,
+ * comment `bodyMatch`) must be checked so a catastrophic pattern is rejected at
+ * compile/registration time rather than silently compiled. Globs are linear by
+ * construction but pass through here for uniformity.
+ *
+ * `ctx` is a human label (e.g. "branch pattern", "job 'web' runsOn") woven into
+ * the thrown error so an operator can identify the offending pattern.
+ */
+export declare function assertSafeRegex(source: string, flags: string, ctx: string): void;
+//# sourceMappingURL=safe-regex.d.ts.map

package/dist/safe-regex.js

@@ -0,0 +1,24 @@
+import "./rolldown-runtime-ClRpJifh.js";
+import safeRegex from "safe-regex";
+//#region src/safe-regex.ts
+/**
+* Reject a ReDoS-prone author-supplied regex before it is compiled.
+*
+* `safe-regex` is a star-height heuristic. The orchestrator is single-tenant, so
+* a slipped-through pattern only stalls the author's own orchestrator — but every
+* author regex the orchestrator compiles from lock-file data on the webhook path
+* (label selectors, branch/tag/repo patterns, embedded JSONPath `/re/flags`,
+* comment `bodyMatch`) must be checked so a catastrophic pattern is rejected at
+* compile/registration time rather than silently compiled. Globs are linear by
+* construction but pass through here for uniformity.
+*
+* `ctx` is a human label (e.g. "branch pattern", "job 'web' runsOn") woven into
+* the thrown error so an operator can identify the offending pattern.
+*/
+function assertSafeRegex(source, flags, ctx) {
+	if (!safeRegex(new RegExp(source, flags))) throw new Error(`${ctx}: regex /${source}/${flags} is ReDoS-prone — rejected`);
+}
+//#endregion
+export { assertSafeRegex };
+
+//# sourceMappingURL=safe-regex.js.map

package/dist/scaler/registry-auth.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Registry-host extraction for container image references.
+ *
+ * Lives in the engine because three sites need the same answer: the agent's
+ * container sandbox, the container scaler backend, and the bare-metal backend
+ * in container mode. A private pull authenticates against the registry HOST,
+ * which is not a field of the image ref — it has to be derived from it.
+ */
+/**
+ * Registry host (a container runtime's `authconfig.serveraddress`) for an image ref.
+ *
+ * Docker's own rule: the first path segment is the registry only when it looks
+ * like a host — it contains a dot or a colon, or it is exactly `localhost`.
+ * Otherwise the ref is a Docker Hub short name (`nginx`, `acme/ci`) and the
+ * registry is `docker.io`.
+ */
+export declare function registryHostFromImageRef(image: string): string;
+//# sourceMappingURL=registry-auth.d.ts.map

package/dist/scaler/registry-auth.js

@@ -0,0 +1,28 @@
+import "../rolldown-runtime-ClRpJifh.js";
+//#region src/scaler/registry-auth.ts
+/**
+* Registry-host extraction for container image references.
+*
+* Lives in the engine because three sites need the same answer: the agent's
+* container sandbox, the container scaler backend, and the bare-metal backend
+* in container mode. A private pull authenticates against the registry HOST,
+* which is not a field of the image ref — it has to be derived from it.
+*/
+/**
+* Registry host (a container runtime's `authconfig.serveraddress`) for an image ref.
+*
+* Docker's own rule: the first path segment is the registry only when it looks
+* like a host — it contains a dot or a colon, or it is exactly `localhost`.
+* Otherwise the ref is a Docker Hub short name (`nginx`, `acme/ci`) and the
+* registry is `docker.io`.
+*/
+function registryHostFromImageRef(image) {
+	const firstSlash = image.indexOf("/");
+	if (firstSlash === -1) return "docker.io";
+	const candidate = image.slice(0, firstSlash);
+	return candidate.includes(".") || candidate.includes(":") || candidate === "localhost" ? candidate : "docker.io";
+}
+//#endregion
+export { registryHostFromImageRef };
+
+//# sourceMappingURL=registry-auth.js.map

package/dist/scaler/scaler-backend-type.d.ts

@@ -9,8 +9,43 @@ import { z } from 'zod';
 export declare const ScalerBackendType: z.ZodEnum<{
     "bare-metal": "bare-metal";
     container: "container";
+    event: "event";
     firecracker: "firecracker";
     kubernetes: "kubernetes";
 }>;
 export type ScalerBackendType = z.infer<typeof ScalerBackendType>;
+/**
+ * Reserved event-name prefix for KiCI-internal system events (today: the event
+ * scaler's scale-up / scale-down events). Custom events emitted from user
+ * workflow steps (`ctx.emit(...)`) MUST NOT use this prefix — both the SDK
+ * (client-side) and the orchestrator (authoritative) reject a name that starts
+ * with it, so a user step cannot forge a system event. The rate limiter also
+ * exempts it. Defined in `@kici-dev/engine` so the SDK and the orchestrator
+ * share one source of truth without the SDK importing the orchestrator.
+ */
+export declare const KICI_EVENT_NAME_PREFIX = "kici.";
+/**
+ * Reserved event-name prefix for the events the ORCHESTRATOR mints for itself
+ * (`__schedule_fire`, `__workflow_complete`, `__job_complete`,
+ * `__workflows_failed_batch`).
+ *
+ * Reserved for the same reason as {@link KICI_EVENT_NAME_PREFIX}, and more
+ * sharply: every name under this prefix is exempt from the event-storm rate
+ * limiter, and `__schedule_fire` is additionally classified as a TRUSTED ref —
+ * no run causes it, so nothing external shaped it. The other three ARE caused
+ * by runs and inherit the tier of the run (or, for the failure batch, the most
+ * restrictive tier across the runs) behind them, so they forge no privilege on
+ * their own. A user step that could emit any of them would forge the
+ * rate-limiter exemption, and `__schedule_fire` the trusted classification on
+ * top of it — so the same two-sided reservation applies to the whole prefix,
+ * SDK first and orchestrator authoritatively.
+ */
+export declare const INTERNAL_EVENT_NAME_PREFIX = "__";
+/**
+ * The reserved prefix `eventName` uses, or `undefined` when a user step may
+ * emit it. One definition of "reserved", so the SDK-side check and the
+ * orchestrator's authoritative backstop can never disagree about which names a
+ * workflow may emit.
+ */
+export declare function reservedEventNamePrefix(eventName: string): string | undefined;
 //# sourceMappingURL=scaler-backend-type.d.ts.map

package/dist/scaler/scaler-backend-type.js

@@ -12,9 +12,46 @@ const ScalerBackendType = z.enum([
 	"container",
 	"bare-metal",
 	"firecracker",
-	"kubernetes"
+	"kubernetes",
+	"event"
 ]);
+/**
+* Reserved event-name prefix for KiCI-internal system events (today: the event
+* scaler's scale-up / scale-down events). Custom events emitted from user
+* workflow steps (`ctx.emit(...)`) MUST NOT use this prefix — both the SDK
+* (client-side) and the orchestrator (authoritative) reject a name that starts
+* with it, so a user step cannot forge a system event. The rate limiter also
+* exempts it. Defined in `@kici-dev/engine` so the SDK and the orchestrator
+* share one source of truth without the SDK importing the orchestrator.
+*/
+const KICI_EVENT_NAME_PREFIX = "kici.";
+/**
+* Reserved event-name prefix for the events the ORCHESTRATOR mints for itself
+* (`__schedule_fire`, `__workflow_complete`, `__job_complete`,
+* `__workflows_failed_batch`).
+*
+* Reserved for the same reason as {@link KICI_EVENT_NAME_PREFIX}, and more
+* sharply: every name under this prefix is exempt from the event-storm rate
+* limiter, and `__schedule_fire` is additionally classified as a TRUSTED ref —
+* no run causes it, so nothing external shaped it. The other three ARE caused
+* by runs and inherit the tier of the run (or, for the failure batch, the most
+* restrictive tier across the runs) behind them, so they forge no privilege on
+* their own. A user step that could emit any of them would forge the
+* rate-limiter exemption, and `__schedule_fire` the trusted classification on
+* top of it — so the same two-sided reservation applies to the whole prefix,
+* SDK first and orchestrator authoritatively.
+*/
+const INTERNAL_EVENT_NAME_PREFIX = "__";
+/**
+* The reserved prefix `eventName` uses, or `undefined` when a user step may
+* emit it. One definition of "reserved", so the SDK-side check and the
+* orchestrator's authoritative backstop can never disagree about which names a
+* workflow may emit.
+*/
+function reservedEventNamePrefix(eventName) {
+	for (const prefix of [KICI_EVENT_NAME_PREFIX, "__"]) if (eventName.startsWith(prefix)) return prefix;
+}
 //#endregion
-export { ScalerBackendType };
+export { INTERNAL_EVENT_NAME_PREFIX, KICI_EVENT_NAME_PREFIX, ScalerBackendType, reservedEventNamePrefix };
 
 //# sourceMappingURL=scaler-backend-type.js.map

package/dist/scaler/scaler-events.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Shared schemas and constants for the event scaler backend.
+ *
+ * The event scaler performs no local compute: its `spawn()` / `destroy()` emit
+ * reserved `kici.`-prefixed custom events (`kici.scaler.scale-up` /
+ * `kici.scaler.scale-down`) that a customer-authored provisioning / teardown
+ * workflow consumes via the `kiciEvent()` trigger. These schemas define the
+ * event payloads and the single source of truth for the reserved event names.
+ *
+ * They live here, not in the orchestrator, because both sides of the contract
+ * need them: the orchestrator emits, and a workflow file — which may import
+ * `@kici-dev/sdk` and nothing else — consumes. Engine is the only package both
+ * the SDK and the orchestrator depend on, so it is the shared floor. The SDK
+ * re-exports all four symbols; the orchestrator's `scaler/scaler-events.ts`
+ * re-exports them for its own call sites.
+ */
+import { z } from 'zod';
+/**
+ * Reserved event names the event scaler emits. Both start with
+ * `KICI_EVENT_NAME_PREFIX` (`./scaler-backend-type.ts`), so the rate limiter
+ * exempts them and user steps cannot forge them — `scaler-events.test.ts`
+ * asserts that relationship holds for both names.
+ */
+export declare const SCALER_EVENT_NAMES: {
+    readonly scaleUp: 'kici.scaler.scale-up';
+    readonly scaleDown: 'kici.scaler.scale-down';
+};
+/**
+ * Why the scaler asked for an agent to be torn down. Carried on the
+ * `kici.scaler.scale-down` event so a teardown workflow (and the timeline) can
+ * distinguish an idle reap from a job-complete teardown or a spawn timeout.
+ */
+export declare const ScaleDownReason: z.ZodEnum<{
+    drain: "drain";
+    "heartbeat-timeout": "heartbeat-timeout";
+    idle: "idle";
+    "job-complete": "job-complete";
+    shutdown: "shutdown";
+    "spawn-timeout": "spawn-timeout";
+}>;
+export type ScaleDownReason = z.infer<typeof ScaleDownReason>;
+/**
+ * Payload of a `kici.scaler.scale-up` event. Everything a provisioning workflow
+ * needs to boot an instance whose agent registers back with `agentId` and claim
+ * its ephemeral credentials with `claimCode`. The ephemeral token itself is
+ * NEVER in this payload — it is delivered only via the
+ * `scaler.claim-credentials` RPC response.
+ */
+export declare const ScalerScaleUpPayload: z.ZodObject<{
+    scalerName: z.ZodString;
+    agentId: z.ZodString;
+    labels: z.ZodArray<z.ZodString>;
+    mandatoryLabels: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    resources: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    orchestratorUrl: z.ZodString;
+    claimCode: z.ZodString;
+    jobId: z.ZodOptional<z.ZodString>;
+    requestId: z.ZodString;
+}, z.core.$strip>;
+export type ScalerScaleUpPayload = z.infer<typeof ScalerScaleUpPayload>;
+/**
+ * Payload of a `kici.scaler.scale-down` event. A teardown workflow deletes the
+ * instance registered under `agentId`.
+ */
+export declare const ScalerScaleDownPayload: z.ZodObject<{
+    scalerName: z.ZodString;
+    agentId: z.ZodString;
+    reason: z.ZodEnum<{
+        drain: "drain";
+        "heartbeat-timeout": "heartbeat-timeout";
+        idle: "idle";
+        "job-complete": "job-complete";
+        shutdown: "shutdown";
+        "spawn-timeout": "spawn-timeout";
+    }>;
+    requestId: z.ZodString;
+}, z.core.$strip>;
+export type ScalerScaleDownPayload = z.infer<typeof ScalerScaleDownPayload>;
+//# sourceMappingURL=scaler-events.d.ts.map

package/dist/scaler/scaler-events.js

@@ -0,0 +1,87 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { z } from "zod";
+//#region src/scaler/scaler-events.ts
+/**
+* Shared schemas and constants for the event scaler backend.
+*
+* The event scaler performs no local compute: its `spawn()` / `destroy()` emit
+* reserved `kici.`-prefixed custom events (`kici.scaler.scale-up` /
+* `kici.scaler.scale-down`) that a customer-authored provisioning / teardown
+* workflow consumes via the `kiciEvent()` trigger. These schemas define the
+* event payloads and the single source of truth for the reserved event names.
+*
+* They live here, not in the orchestrator, because both sides of the contract
+* need them: the orchestrator emits, and a workflow file — which may import
+* `@kici-dev/sdk` and nothing else — consumes. Engine is the only package both
+* the SDK and the orchestrator depend on, so it is the shared floor. The SDK
+* re-exports all four symbols; the orchestrator's `scaler/scaler-events.ts`
+* re-exports them for its own call sites.
+*/
+/**
+* Reserved event names the event scaler emits. Both start with
+* `KICI_EVENT_NAME_PREFIX` (`./scaler-backend-type.ts`), so the rate limiter
+* exempts them and user steps cannot forge them — `scaler-events.test.ts`
+* asserts that relationship holds for both names.
+*/
+const SCALER_EVENT_NAMES = {
+	scaleUp: "kici.scaler.scale-up",
+	scaleDown: "kici.scaler.scale-down"
+};
+/**
+* Why the scaler asked for an agent to be torn down. Carried on the
+* `kici.scaler.scale-down` event so a teardown workflow (and the timeline) can
+* distinguish an idle reap from a job-complete teardown or a spawn timeout.
+*/
+const ScaleDownReason = z.enum([
+	"idle",
+	"job-complete",
+	"heartbeat-timeout",
+	"spawn-timeout",
+	"drain",
+	"shutdown"
+]);
+/**
+* Payload of a `kici.scaler.scale-up` event. Everything a provisioning workflow
+* needs to boot an instance whose agent registers back with `agentId` and claim
+* its ephemeral credentials with `claimCode`. The ephemeral token itself is
+* NEVER in this payload — it is delivered only via the
+* `scaler.claim-credentials` RPC response.
+*/
+const ScalerScaleUpPayload = z.object({
+	/** Name of the scaler entry that emitted the event. */
+	scalerName: z.string(),
+	/** Agent id the provisioned instance must register with (correlates the spawn). */
+	agentId: z.string(),
+	/** Exact label set the pending job needs. */
+	labels: z.array(z.string()),
+	/** Mandatory (taint) labels the pool gates on, if any. */
+	mandatoryLabels: z.array(z.string()).default([]),
+	/** Resolved resource hints for the provision (e.g. cpus / memBytes). */
+	resources: z.record(z.string(), z.unknown()).default({}),
+	/** Orchestrator WS URL the provisioned agent connects back to. */
+	orchestratorUrl: z.string(),
+	/** Single-use code the workflow exchanges for ephemeral agent credentials. */
+	claimCode: z.string(),
+	/** Execution job id the spawn is bound to (absent for unbound / warm spawns). */
+	jobId: z.string().optional(),
+	/** Correlation id for this scale-up request. */
+	requestId: z.string()
+});
+/**
+* Payload of a `kici.scaler.scale-down` event. A teardown workflow deletes the
+* instance registered under `agentId`.
+*/
+const ScalerScaleDownPayload = z.object({
+	/** Name of the scaler entry that emitted the event. */
+	scalerName: z.string(),
+	/** Agent id whose instance should be torn down. */
+	agentId: z.string(),
+	/** Why the teardown was requested. */
+	reason: ScaleDownReason,
+	/** Correlation id for this scale-down request. */
+	requestId: z.string()
+});
+//#endregion
+export { SCALER_EVENT_NAMES, ScaleDownReason, ScalerScaleDownPayload, ScalerScaleUpPayload };
+
+//# sourceMappingURL=scaler-events.js.map

package/dist/trigger/compiled-matchers.d.ts

@@ -3,11 +3,31 @@
  * flags first with a space separator; regex flags are restricted to
  * `[gimsuydv]`, so the separator can never collide with a pattern that starts
  * with a space.
+ *
+ * Every pattern reaching here is author-supplied (branch/tag/repo patterns and
+ * comment `bodyMatch`), so it is ReDoS-checked before compiling. The guard runs
+ * inside the memo factory, so a benign pattern pays the check once (on cache
+ * miss) and a catastrophic one throws — and, being unsafe, is never cached, so
+ * it is rejected on every attempt. `ctx` names the dialect in the thrown error.
  */
-export declare function getCompiledRegex(pattern: string, flags?: string): RegExp;
+export declare function getCompiledRegex(pattern: string, flags?: string, ctx?: string): RegExp;
 /**
  * Return a memoized picomatch matcher function for the given glob pattern.
  * `getGlobMatcher(pattern)(str)` is equivalent to `picomatch.isMatch(str, pattern)`.
  */
 export declare function getGlobMatcher(pattern: string): (s: string) => boolean;
+/**
+ * Repo-identifier matcher. Identical to {@link getGlobMatcher} except it sets
+ * picomatch's `dot: true`, so a dot-prefixed identifier (`.hidden/repo`) is
+ * matched by `**` — `repos: ['**']` is documented as "every repo in the org",
+ * and silently excluding a whole class of identifier contradicts that.
+ *
+ * Deliberately NOT the shared matcher: `dot: true` on path globs would make
+ * `paths: ['**']` start matching `.github/**` for every existing workflow, a
+ * semantics change this does not intend.
+ *
+ * Note a bare `.` still does not match, in either mode — picomatch will not
+ * match a lone `.`. That is upstream behavior, not something this option fixes.
+ */
+export declare function getRepoGlobMatcher(pattern: string): (s: string) => boolean;
 //# sourceMappingURL=compiled-matchers.d.ts.map

package/dist/trigger/compiled-matchers.js

@@ -1,4 +1,5 @@
 import "../rolldown-runtime-ClRpJifh.js";
+import { assertSafeRegex } from "../safe-regex.js";
 import picomatch from "picomatch";
 //#region src/trigger/compiled-matchers.ts
 /**
@@ -22,14 +23,24 @@ function boundedGet(cache, key, make) {
 }
 const regexCache = /* @__PURE__ */ new Map();
 const globCache = /* @__PURE__ */ new Map();
+const repoGlobCache = /* @__PURE__ */ new Map();
 /**
 * Return a memoized RegExp for the given pattern + flags. The key encodes the
 * flags first with a space separator; regex flags are restricted to
 * `[gimsuydv]`, so the separator can never collide with a pattern that starts
 * with a space.
+*
+* Every pattern reaching here is author-supplied (branch/tag/repo patterns and
+* comment `bodyMatch`), so it is ReDoS-checked before compiling. The guard runs
+* inside the memo factory, so a benign pattern pays the check once (on cache
+* miss) and a catastrophic one throws — and, being unsafe, is never cached, so
+* it is rejected on every attempt. `ctx` names the dialect in the thrown error.
 */
-function getCompiledRegex(pattern, flags) {
-	return boundedGet(regexCache, `${flags ?? ""} ${pattern}`, () => new RegExp(pattern, flags));
+function getCompiledRegex(pattern, flags, ctx = "trigger pattern") {
+	return boundedGet(regexCache, `${flags ?? ""} ${pattern}`, () => {
+		assertSafeRegex(pattern, flags ?? "", ctx);
+		return new RegExp(pattern, flags);
+	});
 }
 /**
 * Return a memoized picomatch matcher function for the given glob pattern.
@@ -38,7 +49,23 @@ function getCompiledRegex(pattern, flags) {
 function getGlobMatcher(pattern) {
 	return boundedGet(globCache, pattern, () => picomatch(pattern));
 }
+/**
+* Repo-identifier matcher. Identical to {@link getGlobMatcher} except it sets
+* picomatch's `dot: true`, so a dot-prefixed identifier (`.hidden/repo`) is
+* matched by `**` — `repos: ['**']` is documented as "every repo in the org",
+* and silently excluding a whole class of identifier contradicts that.
+*
+* Deliberately NOT the shared matcher: `dot: true` on path globs would make
+* `paths: ['**']` start matching `.github/**` for every existing workflow, a
+* semantics change this does not intend.
+*
+* Note a bare `.` still does not match, in either mode — picomatch will not
+* match a lone `.`. That is upstream behavior, not something this option fixes.
+*/
+function getRepoGlobMatcher(pattern) {
+	return boundedGet(repoGlobCache, pattern, () => picomatch(pattern, { dot: true }));
+}
 //#endregion
-export { getCompiledRegex, getGlobMatcher };
+export { getCompiledRegex, getGlobMatcher, getRepoGlobMatcher };
 
 //# sourceMappingURL=compiled-matchers.js.map

package/dist/trigger/content-requirements.d.ts

@@ -0,0 +1,31 @@
+import type { LockContentRequirement } from './types.js';
+export type { ContentFormat, ContentRequirement, LockContentRequirement } from './types.js';
+/** Result of evaluating a `requires` list: a definite verdict, or fail-visible indeterminate. */
+export interface ContentRequirementResult {
+    readonly pass: boolean;
+    /** Set (with `pass:false`) when a file could not be evaluated — never a silent pass. */
+    readonly indeterminate?: string;
+}
+/**
+ * Parse `bytes` for the given concrete format. `text` returns the raw string;
+ * `json` uses `JSON.parse`; `yaml` uses a hardened `yaml.parse` with an explicit
+ * anchor/alias cap. Throws on a malformed document (the caller treats a throw as
+ * indeterminate).
+ */
+export declare function parseForFormat(bytes: string, format: 'json' | 'yaml' | 'text'): unknown;
+/**
+ * Evaluate an AND-ed list of content requirements against a resolved file map.
+ *
+ * Every entry must pass for the overall result to pass; an empty list passes.
+ * The first indeterminate entry short-circuits and is surfaced (fail-visible):
+ * an unevaluable file NEVER passes silently.
+ *
+ * @param reqs  The lock `requires` list (each entry AND-ed).
+ * @param files Resolved file contents keyed by repo-relative path. A missing key
+ *              or `{ present: false }` means the file does not exist at the ref.
+ */
+export declare function evaluateContentRequirements(reqs: readonly LockContentRequirement[], files: Map<string, {
+    present: boolean;
+    bytes?: string;
+}>): ContentRequirementResult;
+//# sourceMappingURL=content-requirements.d.ts.map