@kici-dev/agent 0.1.15 → 0.1.17

package/dist/ws/orchestrator-client.d.ts

@@ -1,7 +1,7 @@
-import { type AgentToOrchestratorMessage, type JobDispatch, type JobCancel } from '@kici-dev/engine';
-import type { CacheRequestIpc, CacheResponseIpc } from '../execution/sandbox/index.js';
+import { type AgentToOrchestratorMessage, type JobDispatch, type JobCancel, type FleetLogsRequest } from '@kici-dev/engine';
+import type { CacheRequestIpc, CacheResponseIpc, ProvenanceRequestIpc, ProvenanceResponseIpc, StepApprovalRequestIpc, StepApprovalResolvedIpc } from '../execution/sandbox/index.js';
 export type ConnectionState = 'disconnected' | 'connecting' | 'authenticating' | 'registering' | 'registered';
-interface OrchestratorClientOptions {
+export interface OrchestratorClientOptions {
     /** WebSocket URL of the orchestrator. */
     url: string;
     /** Agent's unique identifier. */
@@ -35,6 +35,18 @@ interface OrchestratorClientOptions {
      * doesn't have to read process.env directly.
      */
     scalerManaged?: boolean;
+    /**
+     * Supplies the inputs for the agent fleet mini-bundle on a fleet.logs.request.
+     * Returns the agent's resolved config (redacted inside the bundle assembler),
+     * the log directory, and the current Prometheus metrics text. Omitted in
+     * tests / contexts that don't participate in fleet collection — the handler
+     * then replies with an empty-config bundle.
+     */
+    getFleetBundleInputs?: () => Promise<{
+        config: Record<string, unknown>;
+        logDir?: string;
+        metricsText?: string;
+    }>;
 }
 /**
  * WebSocket client that connects the agent to the customer orchestrator.
@@ -70,6 +82,13 @@ export declare class OrchestratorClient {
     private readonly pendingApiRequests;
     /** Pending user-cache restore/save requests awaiting orchestrator response. */
     private readonly pendingUserCacheRequests;
+    /**
+     * Pending step-approval requests awaiting the orchestrator's resolution.
+     * No client-side timeout: the orchestrator owns the (org-/SDK-configured)
+     * expiry and sends `step.approval-resolved: expired` when it lapses. The
+     * workflow-runner carries an outer safety-net timeout.
+     */
+    private readonly pendingStepApprovals;
     /** Pending concurrency report requests awaiting orchestrator ack. */
     private readonly pendingConcurrencyRequests;
     private readonly url;
@@ -83,6 +102,7 @@ export declare class OrchestratorClient {
     private readonly getInFlightJobs?;
     private readonly roles;
     private readonly scalerManaged;
+    private readonly getFleetBundleInputs?;
     /** Timestamp when the connection was lost, used for gap marker outage duration. */
     private disconnectedAt;
     /** Set to true when auth.failure is received. Prevents retrying with a bad token. */
@@ -166,6 +186,14 @@ export declare class OrchestratorClient {
         arch: string;
         depsHash?: string;
     }): void;
+    /**
+     * Request a presigned PUT URL for a provenance bundle. Sends a
+     * `provenance.upload.request` and waits for a `provenance.upload.response`
+     * (resolved via the shared upload-request pending map). Times out after 30s.
+     */
+    requestProvenanceUploadUrl(jobId: string, subjectDigest: string): Promise<string>;
+    /** Notify the orchestrator a provenance bundle upload completed (records an attestations row). */
+    sendProvenanceUploadComplete(jobId: string, subjectName: string, subjectDigest: string, mediaType: string): void;
     /**
      * Send an event.emit WS message to the orchestrator and await the response.
      *
@@ -180,6 +208,12 @@ export declare class OrchestratorClient {
         deliveryId?: string;
         error?: string;
     }>;
+    /**
+     * Build this agent's fleet mini-bundle and stream it back to the orchestrator
+     * as ordered fleet.bundle.chunk frames (the WS frame cap forbids one frame).
+     * On failure, sends a single fleet.bundle.error. Public for unit testing.
+     */
+    streamFleetBundle(req: FleetLogsRequest): Promise<void>;
     /**
      * Send a typed API request to the orchestrator and await the response.
      *
@@ -202,6 +236,22 @@ export declare class OrchestratorClient {
      * Times out after 30 seconds for the round-trip ops.
      */
     requestUserCache(jobId: string, request: CacheRequestIpc): Promise<CacheResponseIpc>;
+    /**
+     * Relay a provenance bundle upload operation to the orchestrator. Maps the
+     * IPC `provenance.request` onto `requestProvenanceUploadUrl` (returns the
+     * presigned URL) or `sendProvenanceUploadComplete` (fire-and-forget) and
+     * returns the result on the IPC response shape.
+     */
+    relayProvenance(jobId: string, request: ProvenanceRequestIpc): Promise<ProvenanceResponseIpc>;
+    /**
+     * Relay a step-level approval request to the orchestrator. Sends a
+     * `step.approval-request` WS message and resolves with the orchestrator's
+     * `step.approval-resolved` mapped onto the IPC response shape. No client-side
+     * timeout — the orchestrator owns the approval expiry and replies with an
+     * `expired` outcome when it lapses. Rejects only on disconnect (the relay
+     * caller treats a rejection as a fail-closed reject).
+     */
+    sendStepApproval(runId: string, jobId: string, request: StepApprovalRequestIpc): Promise<StepApprovalResolvedIpc>;
     /**
      * Send a job.context message to the orchestrator.
      *
@@ -283,5 +333,4 @@ export declare class OrchestratorClient {
     private scheduleReconnect;
     private cancelReconnect;
 }
-export {};
 //# sourceMappingURL=orchestrator-client.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/agent",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "Customer-deployable agent for the KiCI CI/CD stack. Connects to an orchestrator, clones the workflow repo, executes steps, and streams logs back.",
   "keywords": [
     "ci",
@@ -54,17 +54,19 @@
   },
   "dependencies": {
     "@hono/node-server": "^2.0.0",
+    "archiver": "^7.0.1",
     "dockerode": "^5.0.0",
     "hono": "^4.12.18",
+    "jose": "^6.1.0",
     "tar": "^7.5.13",
     "winston": "^3.19.0",
     "ws": "^8.20.0",
     "zod": "^4.3.6",
     "zx": "^8.8.5",
-    "@kici-dev/core": "0.1.15",
-    "@kici-dev/sdk": "0.1.15",
-    "@kici-dev/engine": "0.1.15",
-    "@kici-dev/shared": "0.1.15"
+    "@kici-dev/core": "0.1.17",
+    "@kici-dev/sdk": "0.1.17",
+    "@kici-dev/shared": "0.1.17",
+    "@kici-dev/engine": "0.1.17"
   },
   "kici": {
     "metrics": {
@@ -73,6 +75,7 @@
     }
   },
   "devDependencies": {
+    "@types/archiver": "^7.0.0",
     "@types/dockerode": "^4.0.1"
   },
   "scripts": {