@kici-dev/engine 0.1.15 → 0.1.16

package/dist/protocol/messages/orchestrator-agent.js

@@ -1,5 +1,6 @@
 import "../../chunk-gOLHoazu.js";
 import { ExecutionJobStatus, ExecutionStepStatus } from "./execution-status.js";
+import { approverClauseSchema } from "../../approval/types.js";
 import { z } from "zod";
 //#region src/protocol/messages/orchestrator-agent.ts
 /**
@@ -554,6 +555,82 @@ const agentApiResponseSchema = z.object({
 	/** Error description (present on failure). */
 	error: z.string().optional()
 });
+/** Orchestrator asks an agent for its log/diagnostic mini-bundle. */
+const fleetLogsRequestSchema = z.object({
+	type: z.literal("fleet.logs.request"),
+	/** UUID correlating the chunked response. */
+	requestId: z.string(),
+	/** Hours of log history to include. */
+	logWindowHours: z.number(),
+	/** Per-node cap on raw log bytes. */
+	maxBytes: z.number()
+});
+/** One base64 frame of an agent's mini-bundle ZIP. */
+const fleetBundleChunkSchema = z.object({
+	type: z.literal("fleet.bundle.chunk"),
+	requestId: z.string(),
+	seq: z.number().int().nonnegative(),
+	isLast: z.boolean(),
+	dataB64: z.string()
+});
+/** Agent failed to build/stream its mini-bundle. */
+const fleetBundleErrorSchema = z.object({
+	type: z.literal("fleet.bundle.error"),
+	requestId: z.string(),
+	message: z.string()
+});
+/** Outcome of a step-level approval hold, sent back to the waiting agent. */
+const StepApprovalOutcome = z.enum([
+	"approved",
+	"rejected",
+	"expired"
+]);
+/**
+* Agent -> Orchestrator: a step carrying `requireApproval` is about to run and
+* the agent is blocking its step loop until the orchestrator resolves the
+* approval. The orchestrator creates a step-scoped `held_runs` row from the
+* normalized requirement and replies with `step.approval-resolved` once the
+* hold is approved, rejected, or expired. The agent keeps heartbeats flowing
+* during the wait so it is not reaped as stale.
+*
+* NOT fast-pathed — the `log.chunk` / `heartbeat` manual-validator invariant is
+* untouched by this message.
+*/
+const stepApprovalRequestSchema = z.object({
+	type: z.literal("step.approval-request"),
+	messageId: z.string(),
+	runId: z.string(),
+	jobId: z.string(),
+	stepIndex: z.number().int().nonnegative(),
+	stepName: z.string(),
+	/** AND-list of approver clauses (empty = any approval-capable member). */
+	clauses: z.array(approverClauseSchema),
+	/** Human label for the gate (from the SDK `requireApproval` reason). */
+	reason: z.string(),
+	/**
+	* Per-gate timeout override (seconds) from the SDK `requireApproval.timeout`.
+	* Absent ⇒ the orchestrator uses the org-default `approval_expiry_seconds`.
+	* The orchestrator owns the authoritative `expiresAt` computation.
+	*/
+	timeoutSeconds: z.number().int().positive().optional()
+});
+/**
+* Orchestrator -> Agent: resolution of a step-level approval hold. `requestId`
+* correlates to the originating `step.approval-request.messageId`. On
+* `approved` the agent runs the step with its live workspace intact; on
+* `rejected`/`expired` it fails the job with a clear reason.
+*/
+const stepApprovalResolvedSchema = z.object({
+	type: z.literal("step.approval-resolved"),
+	/** Correlates to the originating step.approval-request messageId. */
+	requestId: z.string(),
+	runId: z.string(),
+	jobId: z.string(),
+	stepIndex: z.number().int().nonnegative(),
+	outcome: StepApprovalOutcome,
+	/** Optional human reason (e.g. the reject reason). */
+	reason: z.string().optional()
+});
 /** All messages that flow from Orchestrator to Agent. */
 const orchestratorToAgentMessageSchema = z.discriminatedUnion("type", [
 	jobDispatchSchema,
@@ -566,7 +643,9 @@ const orchestratorToAgentMessageSchema = z.discriminatedUnion("type", [
 	eventEmitResponseSchema,
 	agentApiResponseSchema,
 	agentAuthSuccessSchema,
-	agentAuthFailureSchema
+	agentAuthFailureSchema,
+	fleetLogsRequestSchema,
+	stepApprovalResolvedSchema
 ]);
 /** All messages that flow from Agent to Orchestrator. */
 const agentToOrchestratorMessageSchema = z.discriminatedUnion("type", [
@@ -589,9 +668,12 @@ const agentToOrchestratorMessageSchema = z.discriminatedUnion("type", [
 	eventEmitSchema,
 	agentApiRequestSchema,
 	agentMetricsSchema,
-	agentAuthRequestSchema
+	agentAuthRequestSchema,
+	fleetBundleChunkSchema,
+	fleetBundleErrorSchema,
+	stepApprovalRequestSchema
 ]);
 //#endregion
-export { CacheRefScope, JobRejectReason, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, registerAckSchema };
+export { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, registerAckSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema };
 
 //# sourceMappingURL=orchestrator-agent.js.map

package/dist/protocol/messages/peer.d.ts

@@ -302,6 +302,38 @@ export declare const peerConfigReloadResponseSchema: z.ZodObject<{
     restartRequired: z.ZodOptional<z.ZodArray<z.ZodString>>;
     fieldsChanged: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
+/** Which of THIS peer's downstream nodes to gather. all=true ignores the id lists. */
+export declare const fleetSelectionSchema: z.ZodObject<{
+    all: z.ZodBoolean;
+    agentIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    workerInstanceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+/** Ask a peer to assemble and stream back its subtree bundle. */
+export declare const peerLogsCollectRequestSchema: z.ZodObject<{
+    type: z.ZodLiteral<"peer.logs.collect.request">;
+    messageId: z.ZodString;
+    logWindowHours: z.ZodNumber;
+    includeCoordinatorMesh: z.ZodBoolean;
+    selection: z.ZodObject<{
+        all: z.ZodBoolean;
+        agentIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        workerInstanceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+/** One base64 frame of a peer's subtree ZIP. */
+export declare const peerLogsCollectChunkSchema: z.ZodObject<{
+    type: z.ZodLiteral<"peer.logs.collect.chunk">;
+    messageId: z.ZodString;
+    seq: z.ZodNumber;
+    isLast: z.ZodBoolean;
+    dataB64: z.ZodString;
+}, z.core.$strip>;
+/** Peer failed to assemble/stream its subtree. */
+export declare const peerLogsCollectErrorSchema: z.ZodObject<{
+    type: z.ZodLiteral<"peer.logs.collect.error">;
+    messageId: z.ZodString;
+    message: z.ZodString;
+}, z.core.$strip>;
 /** Graceful shutdown announcement. Peers remove sender from registry immediately. */
 export declare const peerLeavingSchema: z.ZodObject<{
     type: z.ZodLiteral<"peer.leaving">;
@@ -568,6 +600,26 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     errors: z.ZodOptional<z.ZodArray<z.ZodString>>;
     restartRequired: z.ZodOptional<z.ZodArray<z.ZodString>>;
     fieldsChanged: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"peer.logs.collect.request">;
+    messageId: z.ZodString;
+    logWindowHours: z.ZodNumber;
+    includeCoordinatorMesh: z.ZodBoolean;
+    selection: z.ZodObject<{
+        all: z.ZodBoolean;
+        agentIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        workerInstanceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"peer.logs.collect.chunk">;
+    messageId: z.ZodString;
+    seq: z.ZodNumber;
+    isLast: z.ZodBoolean;
+    dataB64: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"peer.logs.collect.error">;
+    messageId: z.ZodString;
+    message: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"peer.leaving">;
     instanceId: z.ZodString;
@@ -816,6 +868,26 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     errors: z.ZodOptional<z.ZodArray<z.ZodString>>;
     restartRequired: z.ZodOptional<z.ZodArray<z.ZodString>>;
     fieldsChanged: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"peer.logs.collect.request">;
+    messageId: z.ZodString;
+    logWindowHours: z.ZodNumber;
+    includeCoordinatorMesh: z.ZodBoolean;
+    selection: z.ZodObject<{
+        all: z.ZodBoolean;
+        agentIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        workerInstanceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"peer.logs.collect.chunk">;
+    messageId: z.ZodString;
+    seq: z.ZodNumber;
+    isLast: z.ZodBoolean;
+    dataB64: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"peer.logs.collect.error">;
+    messageId: z.ZodString;
+    message: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"peer.leaving">;
     instanceId: z.ZodString;
@@ -856,6 +928,10 @@ export type PeerConfigReload = z.infer<typeof peerConfigReloadSchema>;
 export type PeerConfigReloadResponse = z.infer<typeof peerConfigReloadResponseSchema>;
 export type PeerLeaving = z.infer<typeof peerLeavingSchema>;
 export type PeerAgentTokenRevoke = z.infer<typeof peerAgentTokenRevokeSchema>;
+export type FleetSelection = z.infer<typeof fleetSelectionSchema>;
+export type PeerLogsCollectRequest = z.infer<typeof peerLogsCollectRequestSchema>;
+export type PeerLogsCollectChunk = z.infer<typeof peerLogsCollectChunkSchema>;
+export type PeerLogsCollectError = z.infer<typeof peerLogsCollectErrorSchema>;
 export type PeerToPeerMessage = z.infer<typeof peerToPeerMessageSchema>;
 export {};
 //# sourceMappingURL=peer.d.ts.map

package/dist/protocol/messages/peer.js

@@ -316,6 +316,35 @@ const peerConfigReloadResponseSchema = z.object({
 	restartRequired: z.array(z.string()).optional(),
 	fieldsChanged: z.array(z.string()).optional()
 });
+/** Which of THIS peer's downstream nodes to gather. all=true ignores the id lists. */
+const fleetSelectionSchema = z.object({
+	all: z.boolean(),
+	agentIds: z.array(z.string()).default([]),
+	workerInstanceIds: z.array(z.string()).default([])
+});
+/** Ask a peer to assemble and stream back its subtree bundle. */
+const peerLogsCollectRequestSchema = z.object({
+	type: z.literal("peer.logs.collect.request"),
+	messageId: z.string(),
+	logWindowHours: z.number(),
+	/** Loop guard: false on every downstream request so the coordinator mesh never echoes. */
+	includeCoordinatorMesh: z.boolean(),
+	selection: fleetSelectionSchema
+});
+/** One base64 frame of a peer's subtree ZIP. */
+const peerLogsCollectChunkSchema = z.object({
+	type: z.literal("peer.logs.collect.chunk"),
+	messageId: z.string(),
+	seq: z.number().int().nonnegative(),
+	isLast: z.boolean(),
+	dataB64: z.string()
+});
+/** Peer failed to assemble/stream its subtree. */
+const peerLogsCollectErrorSchema = z.object({
+	type: z.literal("peer.logs.collect.error"),
+	messageId: z.string(),
+	message: z.string()
+});
 /** Graceful shutdown announcement. Peers remove sender from registry immediately. */
 const peerLeavingSchema = z.object({
 	type: z.literal("peer.leaving"),
@@ -377,6 +406,9 @@ const peerToPeerMessageSchema = z.discriminatedUnion("type", [
 	peerCacheUploadResponseSchema,
 	peerConfigReloadSchema,
 	peerConfigReloadResponseSchema,
+	peerLogsCollectRequestSchema,
+	peerLogsCollectChunkSchema,
+	peerLogsCollectErrorSchema,
 	peerLeavingSchema,
 	peerAgentTokenRevokeSchema,
 	peerScalerEventSchema
@@ -400,11 +432,14 @@ const peerFromPeerMessageSchema = z.discriminatedUnion("type", [
 	peerCacheUploadResponseSchema,
 	peerConfigReloadSchema,
 	peerConfigReloadResponseSchema,
+	peerLogsCollectRequestSchema,
+	peerLogsCollectChunkSchema,
+	peerLogsCollectErrorSchema,
 	peerLeavingSchema,
 	peerAgentTokenRevokeSchema,
 	peerScalerEventSchema
 ]);
 //#endregion
-export { jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema };
+export { fleetSelectionSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema };
 
 //# sourceMappingURL=peer.js.map

package/dist/protocol/messages/platform-orchestrator.d.ts

@@ -5,17 +5,17 @@ export declare const trustPolicyUpdateSchema: z.ZodObject<{
     orgId: z.ZodString;
     policy: z.ZodObject<{
         forkPolicy: z.ZodEnum<{
-            hold: "hold";
             reject: "reject";
+            hold: "hold";
             allow: "allow";
         }>;
         unknownContributorPolicy: z.ZodEnum<{
-            hold: "hold";
             reject: "reject";
+            hold: "hold";
         }>;
         workflowChangePolicy: z.ZodEnum<{
-            hold: "hold";
             reject: "reject";
+            hold: "hold";
             allow: "allow";
         }>;
         approvalExpiryHours: z.ZodNumber;
@@ -32,6 +32,10 @@ export declare const trustPolicyUpdateSchema: z.ZodObject<{
         write: "write";
         admin: "admin";
     }>>;
+    teamMemberships: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        teamName: z.ZodString;
+        memberUserIds: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>>;
 }, z.core.$strip>;
 export type TrustPolicyUpdate = z.infer<typeof trustPolicyUpdateSchema>;
 /**
@@ -350,17 +354,17 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     orgId: z.ZodString;
     policy: z.ZodObject<{
         forkPolicy: z.ZodEnum<{
-            hold: "hold";
             reject: "reject";
+            hold: "hold";
             allow: "allow";
         }>;
         unknownContributorPolicy: z.ZodEnum<{
-            hold: "hold";
             reject: "reject";
+            hold: "hold";
         }>;
         workflowChangePolicy: z.ZodEnum<{
-            hold: "hold";
             reject: "reject";
+            hold: "hold";
             allow: "allow";
         }>;
         approvalExpiryHours: z.ZodNumber;
@@ -377,6 +381,10 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         write: "write";
         admin: "admin";
     }>>;
+    teamMemberships: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        teamName: z.ZodString;
+        memberUserIds: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"source.register.ack">;
     messageId: z.ZodString;
@@ -1853,6 +1861,8 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         "held_run.list.read": "held_run.list.read";
         "held_run.approve": "held_run.approve";
         "held_run.reject": "held_run.reject";
+        "held_run.request": "held_run.request";
+        "held_run.expire": "held_run.expire";
         "registration.list.read": "registration.list.read";
         "diagnostics.read": "diagnostics.read";
         "scaler.capacity.read": "scaler.capacity.read";

package/dist/protocol/messages/platform-orchestrator.js

@@ -44,7 +44,18 @@ const trustPolicyUpdateSchema = z.object({
 		"read",
 		"write",
 		"admin"
-	]))
+	])),
+	/**
+	* Operator-defined teams and their member user ids. The orchestrator has no
+	* identity store, so team membership is delivered here (next to
+	* `identityLinks`) and cached in-memory. The approval resolver matches a
+	* `{team}` clause by looking up the team's members in this list.
+	* `.default([])` keeps an older Platform that doesn't send it valid.
+	*/
+	teamMemberships: z.array(z.object({
+		teamName: z.string(),
+		memberUserIds: z.array(z.string())
+	})).default([])
 });
 /**
 * Internal shape of a fully-reassembled, HMAC-verified webhook relay handed