@kici-dev/orchestrator 0.0.0 → 0.1.1

package/dist/reporting/log-writer.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Log writer that transforms agent log lines into JSONL and persists to LogStorage.
+ *
+ * Each log line is formatted as a JSON object with timestamp, level, message,
+ * and metadata fields. Lines are written to the standard log path layout:
+ * executions/{runId}/job-{name}/step-{index}.log
+ *
+ * For filesystem storage, data is appended immediately (no buffering).
+ * For S3 storage, the LogStorage backend handles read-concat-put.
+ */
+import type { LogStorage } from './log-storage.js';
+import type { ObserverRegistry } from '../ws/observer-registry.js';
+interface LogWriterDeps {
+    logStorage: LogStorage;
+    /** Optional observer registry for broadcasting log chunks to CLI observers. */
+    observerRegistry?: ObserverRegistry;
+    /** Optional function to check if a run is a test run (for observer broadcasting). */
+    isTestRun?: (runId: string) => boolean;
+}
+export declare class LogWriter {
+    private readonly logStorage;
+    private readonly observerRegistry?;
+    private readonly isTestRun?;
+    constructor(deps: LogWriterDeps);
+    /**
+     * Append log lines from an agent to storage in JSONL format.
+     *
+     * Each line is formatted as:
+     * {"ts":"2026-01-01T00:00:00.000Z","level":"stdout","msg":"line content","meta":{}}
+     *
+     * Also fans log chunks to connected observers for real-time streaming
+     * (test runs only, when observerRegistry is configured).
+     *
+     * @param runId - Execution run ID
+     * @param jobName - Job name (not job ID)
+     * @param stepIndex - Step index within the job (0-based)
+     * @param lines - Raw log lines from the agent
+     * @param timestamp - Timestamp from the agent message (epoch ms)
+     * @param jobId - Job ID for observer broadcasting (optional)
+     * @param stepName - Step name for observer broadcasting (optional)
+     */
+    appendChunk(runId: string, jobName: string, stepIndex: number, lines: string[], timestamp: number, jobId?: string, stepName?: string): Promise<void>;
+}
+export {};
+//# sourceMappingURL=log-writer.d.ts.map

package/dist/reporting/s3-log-storage.d.ts

@@ -0,0 +1,42 @@
+/**
+ * S3-backed log storage.
+ *
+ * Stores execution logs in S3. No TTL -- logs persist indefinitely.
+ *
+ * Implementation notes:
+ * - append() reads existing content + concatenates + puts back (acceptable
+ *   for the sequential step model where max ~10MB per step)
+ * - read() uses Range header for cursor-based pagination
+ * - exists() uses HeadObject
+ * - list() uses ListObjectsV2 with prefix
+ *
+ * Uses AWS SDK v3 modular imports -- only loaded when S3 storage is configured.
+ */
+import type { LogReadOptions, LogReadResult, LogStorage } from './log-storage.js';
+interface S3LogStorageOptions {
+    bucket: string;
+    prefix: string;
+    region?: string;
+    /** Custom endpoint URL for S3-compatible services (e.g., SeaweedFS, LocalStack) */
+    endpoint?: string;
+    /** Use path-style access instead of virtual-hosted-style (required for most S3-compatible services) */
+    forcePathStyle?: boolean;
+}
+export declare class S3LogStorage implements LogStorage {
+    private readonly client;
+    private readonly bucket;
+    private readonly prefix;
+    constructor(options: S3LogStorageOptions);
+    /** Build the full S3 object key from a log path. */
+    private objectKey;
+    /** Check if an error is a "not found" error (NoSuchKey, NotFound, 404). */
+    private isNotFoundError;
+    /** Read the full content of an S3 object as a string. Returns null if not found. */
+    private getContent;
+    append(path: string, data: string): Promise<void>;
+    read(path: string, options?: LogReadOptions): Promise<LogReadResult>;
+    exists(path: string): Promise<boolean>;
+    list(prefix: string): Promise<string[]>;
+}
+export {};
+//# sourceMappingURL=s3-log-storage.d.ts.map

package/dist/reporting/step-log-buffer.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Ring buffer for per-step log line retention.
+ *
+ * Stores the last N ANSI-stripped log lines per step for use in check run
+ * summaries. Log lines are keyed by `{runId}:{jobId}:{stepIndex}` so each
+ * step gets its own independent buffer. When the buffer exceeds maxLines,
+ * the oldest lines are evicted.
+ *
+ * The totalCount field tracks how many lines were added in total (not just
+ * retained), enabling the truncation indicator: "showing last 20 of N lines".
+ */
+/** Entry stored per step in the buffer. */
+export interface StepLogEntry {
+    /** The retained (last N) log lines, ANSI-stripped. */
+    lines: string[];
+    /** Total number of lines added (including evicted ones). */
+    totalCount: number;
+}
+export declare class StepLogBuffer {
+    private readonly maxLines;
+    private readonly entries;
+    constructor(opts?: {
+        maxLines?: number;
+    });
+    /**
+     * Build the composite key for a step.
+     */
+    private buildKey;
+    /**
+     * Add log lines for a step.
+     *
+     * ANSI codes are stripped from each line before storage.
+     * When the buffer exceeds maxLines, the oldest lines are evicted.
+     */
+    addLines(key: {
+        runId: string;
+        jobId: string;
+        stepIndex: number;
+    }, rawLines: string[]): void;
+    /**
+     * Get the last N lines and total count for a step.
+     *
+     * Returns undefined if no lines have been added for this step.
+     */
+    getLastLines(key: {
+        runId: string;
+        jobId: string;
+        stepIndex: number;
+    }): StepLogEntry | undefined;
+    /**
+     * Remove all entries for a given runId.
+     *
+     * Called when the execution tracker prunes a completed run from memory.
+     */
+    cleanup(runId: string): void;
+}
+//# sourceMappingURL=step-log-buffer.d.ts.map

package/dist/routes/admin-access-log.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Admin API routes for the access log (access_log table).
+ *
+ * Operator-facing read access to read + orchestrator-admin mutation attempts
+ * captured with ActorPrincipal attribution. Mirrors the dashboard's
+ * dashboard.access-log.list WS handler but exposed over HTTP + Bearer auth
+ * so operators can dogfood from the CLI without going through the dashboard.
+ *
+ *   GET /api/v1/admin/access-log
+ *     Filters: orgId, actorType, actorId, action, source, outcome,
+ *              targetType, targetId, from, to, limit, cursor
+ *     Requires: access_log.read
+ *
+ *   GET /api/v1/admin/access-log/:id
+ *     Requires: access_log.read
+ */
+import { Hono } from 'hono';
+import type { AccessLogWriter } from '../audit/access-log.js';
+import type { TokenManager } from '../secrets/token-manager.js';
+import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+export interface AdminAccessLogRoutesDeps {
+    accessLog: AccessLogWriter;
+    tokenManager: TokenManager;
+    rbac: RbacEnforcer;
+}
+type AdminEnv = {
+    Variables: {
+        role: Role;
+        userId: string;
+    };
+};
+export declare function createAdminAccessLogRoutes(deps: AdminAccessLogRoutesDeps): Hono<AdminEnv>;
+export {};
+//# sourceMappingURL=admin-access-log.d.ts.map

package/dist/routes/admin-backends.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Admin API routes for secret backend management.
+ *
+ * Provides CRUD, connectivity testing, and sync endpoints for managing
+ * secret backends (PG, Vault) through the admin API. Backend credentials
+ * are stored encrypted at rest and never exposed in API responses.
+ *
+ * All routes are mounted under /api/v1/admin/backends and protected by
+ * the admin auth middleware in admin.ts.
+ */
+import { Hono } from 'hono';
+import type { BackendSyncManager } from '@kici-dev/engine';
+import type { BackendRegistry } from '../secrets/backend-registry.js';
+import type { BackendHealthChecker } from '../secrets/backend-health.js';
+interface BackendRouteDeps {
+    registry: BackendRegistry;
+    healthChecker: BackendHealthChecker;
+    syncManager?: BackendSyncManager;
+}
+/**
+ * Create admin API routes for secret backend management.
+ *
+ * @param deps - Backend route dependencies (registry, health checker, sync manager)
+ * @returns Hono app with backend routes
+ */
+export declare function createBackendRoutes(deps: BackendRouteDeps): Hono;
+export {};
+//# sourceMappingURL=admin-backends.d.ts.map

package/dist/routes/admin-config.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Admin REST API routes for config management.
+ *
+ * Provides endpoints under /admin/config/* for:
+ * - seed: bulk import shared config from JSON body
+ * - get: current effective config (merged local + shared + env)
+ * - set: update single field in shared config
+ * - delete: remove field from shared config
+ * - export: dump shared config (redacted)
+ * - validate: validate config against schema (no DB mutation)
+ * - diff: compare local YAML vs shared DB config
+ * - history: version history
+ * - rollback: rollback to specific version
+ * - reload: trigger config reload
+ *
+ * All routes protected by Bearer token auth (reuses admin middleware pattern).
+ */
+import { Hono } from 'hono';
+import type { SharedConfigStore } from '../config/shared-store.js';
+import type { ConfigReloader, ReloadResult } from '../config/reload.js';
+import type { LocalConfig } from '../config/types.js';
+/**
+ * Result of forwarding a reload request to a peer orchestrator.
+ *
+ * - `result` carries the ReloadResult from the target peer when delivery succeeded.
+ * - `result === null` means the target peer is not connected (or unknown).
+ */
+export interface PeerReloadForwardResult {
+    result: ReloadResult | null;
+}
+/**
+ * Dependencies for config admin routes.
+ */
+export interface ConfigRouteDeps {
+    sharedStore: SharedConfigStore;
+    configReloader: ConfigReloader;
+    localConfigPath?: string;
+    loadLocalConfig: () => Promise<LocalConfig>;
+    /** Admin token for Bearer auth. If undefined, routes return 503. */
+    adminToken?: string;
+    /**
+     * Forward a config reload request to a specific peer instance via the
+     * cluster peer connection. Returns the peer's ReloadResult, or `null` if
+     * the target peer is unknown / not connected. When omitted, per-instance
+     * targeting is unavailable and `target` requests return 501.
+     */
+    forwardReloadToPeer?: (targetInstanceId: string, opts: {
+        drain?: boolean;
+        timeoutMs?: number;
+    }) => Promise<ReloadResult | null>;
+}
+/**
+ * Create admin config routes.
+ * Returns a Hono app to be mounted at /admin/config.
+ */
+export declare function createConfigAdminRoutes(deps: ConfigRouteDeps): Hono;
+//# sourceMappingURL=admin-config.d.ts.map

package/dist/routes/admin-db.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Admin API routes for database migration management.
+ *
+ * Provides endpoints to run pending migrations and check migration status
+ * through the admin API. Uses advisory locking for concurrency safety
+ * across multiple orchestrator instances.
+ *
+ * All routes are mounted under /api/v1/admin/db and protected by
+ * the admin auth middleware in admin.ts.
+ */
+import { Hono } from 'hono';
+import type { Kysely } from 'kysely';
+import type pg from 'pg';
+interface DbRouteDeps {
+    db: Kysely<any>;
+    pool: pg.Pool;
+}
+export declare function createDbRoutes(deps: DbRouteDeps): Hono;
+export {};
+//# sourceMappingURL=admin-db.d.ts.map

package/dist/routes/admin-environments.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Admin API routes for environment management.
+ *
+ *   POST   /api/v1/admin/environments                        — create (upsert)
+ *   POST   /api/v1/admin/environments/:name/bind             — bind a scope pattern
+ *   PATCH  /api/v1/admin/environments/:name/policy           — update policy fields
+ *   GET    /api/v1/admin/environments?orgId=<id>             — list environments
+ *   GET    /api/v1/admin/environments/:name?orgId=<id>       — show env + vars + bindings
+ *   POST   /api/v1/admin/environments/templates              — create/update a template
+ *
+ * Backs the `kici-admin environment` dual-mode CLI. Offline (direct-DB) mode
+ * bypasses this router entirely — the CLI calls `*Direct` helpers from
+ * @kici-dev/shared. This HTTP surface exists so tooling with only an admin
+ * token (no DB reach) can do the same operations.
+ *
+ * All routes are protected by the admin auth middleware mounted in admin.ts
+ * (at `/api/v1/admin/*`). That middleware sets `role` + `userId` on the
+ * context, which we use for RBAC gating here.
+ */
+import { Hono } from 'hono';
+import { type Kysely } from 'kysely';
+import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+export interface AdminEnvironmentRoutesDeps {
+    db: Kysely<any>;
+    rbac: RbacEnforcer;
+}
+/** Hono env type for admin-environments routes with context variables. */
+type AdminEnvEnv = {
+    Variables: {
+        role: Role;
+        userId: string;
+    };
+};
+/**
+ * Create admin API routes for environment management.
+ *
+ * @param deps - db (Kysely) + rbac enforcer
+ * @returns Hono app mounted at /api/v1/admin
+ */
+export declare function createAdminEnvironmentRoutes(deps: AdminEnvironmentRoutesDeps): Hono<AdminEnvEnv>;
+export {};
+//# sourceMappingURL=admin-environments.d.ts.map

package/dist/routes/admin-errors.d.ts

@@ -0,0 +1,4 @@
+export declare function handleAdminError(c: any, err: unknown, logger: {
+    error: (msg: string, meta?: Record<string, unknown>) => void;
+}): any;
+//# sourceMappingURL=admin-errors.d.ts.map

package/dist/routes/admin-event-dlq.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Admin API routes for the event DLQ (dead-letter queue).
+ *
+ * Exposes the orchestrator-side DLQ — events that exhausted their dispatch
+ * retry budget — over Bearer-auth HTTP so operators can list, manually retry,
+ * or discard rows from the kici-admin CLI / dashboard.
+ *
+ *   GET    /api/v1/admin/event-dlq        — list DLQ events (limit + cursor)
+ *   GET    /api/v1/admin/event-dlq/count  — number of DLQ events (for badge)
+ *   POST   /api/v1/admin/event-dlq/:id/retry  — clear DLQ flag, schedule for retry
+ *   DELETE /api/v1/admin/event-dlq/:id    — permanently discard a DLQ event
+ *
+ * The retry path also issues `pg_notify('kici_event_channel', id)` so a
+ * healthy node picks the event up immediately rather than waiting for the
+ * leader-only retry scanner's next tick.
+ *
+ * Mutations write an access_log row (event_dlq.retry / event_dlq.discard).
+ */
+import { Hono } from 'hono';
+import type { EventStore } from '../events/event-store.js';
+import type { TokenManager } from '../secrets/token-manager.js';
+import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { AccessLogWriter } from '../audit/access-log.js';
+export interface AdminEventDlqRoutesDeps {
+    eventStore: EventStore;
+    tokenManager: TokenManager;
+    rbac: RbacEnforcer;
+    /** Required so retry/discard mutations land in the access log. */
+    accessLog?: AccessLogWriter;
+}
+type AdminEnv = {
+    Variables: {
+        role: Role;
+        userId: string;
+    };
+};
+export declare function createAdminEventDlqRoutes(deps: AdminEventDlqRoutesDeps): Hono<AdminEnv>;
+export {};
+//# sourceMappingURL=admin-event-dlq.d.ts.map

package/dist/routes/admin-event-log.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Admin API routes for the inbound webhook delivery log (event_log table).
+ *
+ * Operator-facing read access to the per-delivery records the orchestrator
+ * persists for every inbound webhook. Mirrors the dashboard's WS handler
+ * (`DashboardHandler.handleEventLogList/Detail`) but is exposed over HTTP +
+ * Bearer auth so operators can dogfood from the CLI without going through
+ * the dashboard.
+ *
+ *   GET /api/v1/admin/event-log
+ *     Filters: orgId, routingKey, event, status, from, to, deliveryId, limit, offset
+ *     Requires: event_log.read
+ *
+ *   GET /api/v1/admin/event-log/:deliveryId
+ *     Query: orgId (required), includePayload (default false)
+ *     Requires: event_log.read
+ *     The `includePayload` flag additionally requires event_log.read_payload.
+ */
+import { Hono } from 'hono';
+import { type ColdStore } from '@kici-dev/shared';
+import type { Kysely } from 'kysely';
+import type { Database } from '../db/types.js';
+import type { TokenManager } from '../secrets/token-manager.js';
+import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { LogStorage } from '../reporting/log-storage.js';
+export interface AdminEventLogRoutesDeps {
+    db: Kysely<Database>;
+    logStorage: LogStorage;
+    tokenManager: TokenManager;
+    rbac: RbacEnforcer;
+    /** Phase E: optional cold-store for archived event_log rows. */
+    coldStore?: ColdStore;
+}
+type AdminEnv = {
+    Variables: {
+        role: Role;
+        userId: string;
+    };
+};
+export declare function createAdminEventLogRoutes(deps: AdminEventLogRoutesDeps): Hono<AdminEnv>;
+export {};
+//# sourceMappingURL=admin-event-log.d.ts.map

package/dist/routes/admin-events.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Admin API routes for generic webhook sources and trust management.
+ *
+ * Provides CRUD endpoints for managing generic webhook sources (create, list,
+ * get, update, delete, enable, disable) and cross-repo trust relationships.
+ *
+ * All routes are protected by Bearer token authentication via the existing
+ * admin auth middleware pattern from admin.ts.
+ */
+import { Hono } from 'hono';
+import type pg from 'pg';
+import type { GenericSourceManager } from '../webhook/generic-sources.js';
+import type { TrustStore } from '../events/trust-store.js';
+import type { TokenManager } from '../secrets/token-manager.js';
+import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+/**
+ * Dependencies for admin event routes.
+ */
+interface AdminEventRouteDeps {
+    sourceManager: GenericSourceManager;
+    trustStore: TrustStore;
+    tokenManager: TokenManager;
+    rbac: RbacEnforcer;
+    /**
+     * Optional — when provided, the `POST /api/v1/admin/events/emit` route is
+     * mounted so operators can INSERT into `kici_events` + `pg_notify` via HTTP.
+     * Mirrors `emitKiciEventDirect` in `@kici-dev/shared` (direct-DB CLI mode).
+     */
+    pool?: pg.Pool;
+}
+/** Hono env type for admin event routes with context variables. */
+type AdminEventEnv = {
+    Variables: {
+        role: Role;
+        userId: string;
+    };
+};
+/**
+ * Create admin API routes for generic webhook sources and trust management.
+ *
+ * @param deps - Admin event route dependencies
+ * @returns Hono app with admin event routes mounted at /api/v1/admin/*
+ */
+export declare function createAdminEventRoutes(deps: AdminEventRouteDeps): Hono<AdminEventEnv>;
+export {};
+//# sourceMappingURL=admin-events.d.ts.map

package/dist/routes/admin-maintenance.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Admin API routes for ops-grade maintenance operations that don't fit
+ * cleanly under a single resource namespace:
+ *
+ *   POST /api/v1/admin/queue/clear             — TRUNCATE dispatch_queue
+ *   POST /api/v1/admin/execution/purge-stale   — DELETE execution runs + jobs
+ *   POST /api/v1/admin/sources/purge-stale     — DELETE orphan sources + scoped secrets
+ *   POST /api/v1/admin/secrets/purge           — DELETE scoped_secrets (bulk)
+ *
+ * Each endpoint accepts a minimal JSON body for scoping (e.g. routing key,
+ * org ID) and supports a "dry run" mode where applicable. All mutations are
+ * gated by the admin auth middleware in admin.ts, so unauthenticated access
+ * is impossible.
+ */
+import { Hono } from 'hono';
+import type { Kysely } from 'kysely';
+interface MaintenanceRouteDeps {
+    db: Kysely<any>;
+}
+export declare function createMaintenanceRoutes(deps: MaintenanceRouteDeps): Hono;
+export {};
+//# sourceMappingURL=admin-maintenance.d.ts.map

package/dist/routes/admin-org-settings.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Admin API routes for org-level global workflow settings.
+ *
+ * Exposes GET / PATCH `/api/v1/admin/org-settings/global-workflows` so
+ * `kici-admin` can read and write the per-org row in `org_settings`
+ * without going through the Platform dashboard proxy — the CLI stays
+ * operable even when Platform is unavailable.
+ *
+ * Mutations require the `secret.write` RBAC capability (already granted to
+ * admin / owner roles), matching the gating posture used by source admin.
+ */
+import { Hono } from 'hono';
+import { type Kysely } from 'kysely';
+import type { Database } from '../db/types.js';
+import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+interface OrgSettingsRouteDeps {
+    db: Kysely<Database>;
+    rbac: RbacEnforcer;
+}
+type AdminEnv = {
+    Variables: {
+        role: Role;
+        userId: string;
+        routingKey: string | null;
+    };
+};
+export declare function createOrgSettingsRoutes(deps: OrgSettingsRouteDeps): Hono<AdminEnv>;
+export {};
+//# sourceMappingURL=admin-org-settings.d.ts.map

package/dist/routes/admin-queue-execution.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Admin API routes for queue + execution READ operations (5a #3 /).
+ *
+ *   GET /api/v1/admin/queue                   — list dispatch_queue
+ *   GET /api/v1/admin/queue/:id               — show one dispatch_queue row
+ *   GET /api/v1/admin/executions              — list execution_runs
+ *   GET /api/v1/admin/executions/:runId       — show one run + its jobs
+ *
+ * All routes are gated by the admin auth middleware mounted in admin.ts
+ * and require `secret.read` RBAC (the closest existing read-grade permission).
+ */
+import { Hono } from 'hono';
+import { type Kysely } from 'kysely';
+import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+export interface AdminQueueExecutionRoutesDeps {
+    db: Kysely<any>;
+    rbac: RbacEnforcer;
+}
+type AdminQEEnv = {
+    Variables: {
+        role: Role;
+        userId: string;
+    };
+};
+export declare function createAdminQueueExecutionRoutes(deps: AdminQueueExecutionRoutesDeps): Hono<AdminQEEnv>;
+export {};
+//# sourceMappingURL=admin-queue-execution.d.ts.map

package/dist/routes/admin-registrations.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Admin API routes for workflow registration management.
+ *
+ * Provides endpoints for listing, inspecting, refreshing, and deleting
+ * workflow registrations. All routes are protected by Bearer token
+ * authentication via the existing admin auth middleware pattern.
+ */
+import { Hono } from 'hono';
+import type { RegistrationStore } from '../registration/registration-store.js';
+import type { RegistrationIndex } from '../registration/registration-index.js';
+import type { TokenManager } from '../secrets/token-manager.js';
+import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+/**
+ * Dependencies for admin registration routes.
+ */
+export interface AdminRegistrationRoutesDeps {
+    registrationStore: RegistrationStore;
+    registrationIndex: RegistrationIndex;
+    tokenManager: TokenManager;
+    rbac: RbacEnforcer;
+}
+/** Hono env type for admin registration routes with context variables. */
+type AdminRegEnv = {
+    Variables: {
+        role: Role;
+        userId: string;
+    };
+};
+/**
+ * Create admin API routes for workflow registration management.
+ *
+ * @param deps - Admin registration route dependencies
+ * @returns Hono app with registration routes mounted at /api/v1/admin/registrations
+ */
+export declare function createAdminRegistrationRoutes(deps: AdminRegistrationRoutesDeps): Hono<AdminRegEnv>;
+export {};
+//# sourceMappingURL=admin-registrations.d.ts.map

package/dist/routes/admin-runs.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Admin API routes for execution run inspection.
+ *
+ * Provides read-only endpoints for listing runs and inspecting per-run
+ * sub-resources (jobs, ephemeral key status, secret outputs). All routes
+ * are protected by Bearer token authentication and an RBAC permission
+ * check (`run.read` for most, `secret.reveal` for the reveal variant of
+ * `secret-outputs`).
+ *
+ * Endpoints:
+ *   GET /api/v1/admin/runs                        — list runs with filters
+ *   GET /api/v1/admin/runs/:runId                 — run header fields only
+ *   GET /api/v1/admin/runs/:runId/jobs            — jobs list (optional steps)
+ *   GET /api/v1/admin/runs/:runId/ephemeral-key   — scrub status
+ *   GET /api/v1/admin/runs/:runId/secret-outputs  — masked by default; ?reveal=true
+ *
+ * This is the server-side counterpart to `kici-admin runs` — the dogfooded
+ * replacement for hand-rolled curl commands and dashboard clicks when
+ * verifying execution state.
+ */
+import { Hono } from 'hono';
+import type { Kysely } from 'kysely';
+import type { Database } from '../db/types.js';
+import type { TokenManager } from '../secrets/token-manager.js';
+import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { AuditLogger } from '../secrets/audit-logger.js';
+/**
+ * Dependencies for admin run routes.
+ */
+export interface AdminRunRoutesDeps {
+    db: Kysely<Database>;
+    tokenManager: TokenManager;
+    rbac: RbacEnforcer;
+    /** Required to reveal secret-output plaintext via ?reveal=true. */
+    auditLogger?: AuditLogger;
+    /**
+     * Orchestrator master secret key (raw hex / base64). Required to reveal
+     * secret-output plaintext. Derived once per request via deriveKey().
+     */
+    masterSecretKey?: string;
+}
+/** Hono env type for admin run routes with context variables. */
+type AdminRunEnv = {
+    Variables: {
+        role: Role;
+        userId: string;
+    };
+};
+/**
+ * Create admin API routes for execution run inspection.
+ *
+ * @param deps - Admin run route dependencies
+ * @returns Hono app with run routes mounted at /api/v1/admin/runs
+ */
+export declare function createAdminRunRoutes(deps: AdminRunRoutesDeps): Hono<AdminRunEnv>;
+export {};
+//# sourceMappingURL=admin-runs.d.ts.map