@kici-dev/orchestrator 0.1.16 → 0.1.17

package/dist/agent/dispatcher.d.ts

@@ -55,6 +55,13 @@ export declare class Dispatcher {
     private readonly agentJobs;
     /** Reverse map: jobId -> agentId, for cancel-run lookups. */
     private readonly jobToAgent;
+    /**
+     * jobId -> runId for currently-tracked jobs. Populated alongside
+     * `jobToAgent`/`agentJobs` at dispatch time and cleared with them, so the
+     * provenance token relay can resolve a job's runId from the dispatcher's own
+     * state (`resolveOwnedJob`) rather than trusting an agent-asserted value.
+     */
+    private readonly jobRunIds;
     /**
      * Grace window for recently completed jobs.
      * Allows late messages (log.chunk, step.status) to be accepted for a short
@@ -296,7 +303,7 @@ export declare class Dispatcher {
      * reconnecting agent reporting the job in-flight means it had started,
      * so mark it started for disconnect triage.
      */
-    restoreJobForAgent(agentId: string, jobId: string): void;
+    restoreJobForAgent(agentId: string, jobId: string, runId?: string): void;
     /**
      * Start a recovery timer for a job found in 'dispatched' state on startup.
      * Called by server.ts/standalone.ts to create recovery timers for jobs
@@ -349,6 +356,16 @@ export declare class Dispatcher {
     /** Remove expired entries from the completedJobs grace window map. */
     private cleanupExpiredGraceEntries;
     private trackJobForAgent;
+    /**
+     * Verify `agentId` currently owns `jobId`; if so, return the job's runId from
+     * the dispatcher's own tracking. Used by the provenance token relay so the
+     * orchestrator binds a minted token to a job the agent actually owns — the
+     * agent never asserts a runId. Returns `undefined` when the agent does not
+     * own the job (or the runId is no longer tracked).
+     */
+    resolveOwnedJob(agentId: string, jobId: string): {
+        runId: string;
+    } | undefined;
     /**
      * Cancel a queued job (mark as failed in the dispatch queue).
      * Used by the coordinator to clean up local fallback entries when a peer

package/dist/approvals/apply-decision.d.ts

@@ -40,15 +40,25 @@ export interface ApplyDecisionDeps {
     allowSelfApproval: boolean;
     /** Resolve the Keycloak sub of the user who triggered a run (for the self-approval gate). */
     resolveTriggererSub: (runId: string) => Promise<string | undefined>;
-    /** Called when a job/workflow hold is released — re-dispatch the element. */
+    /** Called when a job hold is released — re-dispatch the element. */
     onJobRelease: (signal: ReleaseSignal) => Promise<void>;
     /** Called when a step hold is released — notify the waiting agent (approved). */
     onStepRelease?: (signal: ReleaseSignal) => Promise<void>;
+    /**
+     * Called when a workflow-scoped hold is released (install gate approved) —
+     * rebuild the dispatch context and resume the workflow from the install gate.
+     */
+    onWorkflowRelease?: (signal: ReleaseSignal) => Promise<void>;
     /**
      * Called when a step-scoped hold is rejected — notify the waiting agent so it
      * fails the step instead of blocking until expiry. Carries the holdId.
      */
     onStepReject?: (heldRunId: string, reason?: string) => Promise<void> | void;
+    /**
+     * Called when a workflow-scoped hold is rejected (install gate rejected) —
+     * cancel the run and drop the pending workflow context. Carries the runId.
+     */
+    onWorkflowReject?: (runId: string) => Promise<void>;
 }
 /** Apply a single approve/reject decision to a hold. */
 export declare function applyDecision(deps: ApplyDecisionDeps, args: {

package/dist/cache/pending-inits.d.ts

@@ -12,6 +12,11 @@ export interface InitResult {
     environmentName?: string;
     env?: Record<string, string>;
     concurrencyGroup?: string;
+    /**
+     * Resolved matrix combinations when the target job's matrix is a dynamic
+     * function. The dispatch path re-materializes these into N execution jobs.
+     */
+    matrixValues?: Array<Record<string, string | undefined>>;
 }
 export declare class PendingInitTracker extends PendingTracker<InitResult> {
     constructor();

package/dist/cli/api-client.d.ts

@@ -25,6 +25,14 @@ export interface FleetTopologyResponse {
  * avoid a cross-package import in the CLI wire type.
  */
 export type GenericSourceGitConfigPayload = Record<string, unknown>;
+/**
+ * Wire shape for a local filesystem source's config (`{ repoBasePath, cloneUrlBase? }`).
+ * Matches `LocalSourceConfigSchema` in `providers/local/local-source-config.ts`.
+ */
+export interface GenericSourceLocalConfigPayload {
+    repoBasePath: string;
+    cloneUrlBase?: string;
+}
 /**
  * Response shape for generic webhook sources from the admin API.
  */
@@ -134,6 +142,7 @@ export declare class AdminApiClient {
         rateLimitRpm?: number;
         providerType?: string;
         gitConfig?: GenericSourceGitConfigPayload;
+        localConfig?: GenericSourceLocalConfigPayload;
     }): Promise<{
         source: GenericSourceResponse;
     }>;
@@ -159,6 +168,8 @@ export declare class AdminApiClient {
         providerType?: string;
         /** `null` clears the config; omit to leave unchanged. */
         gitConfig?: GenericSourceGitConfigPayload | null;
+        /** `null` clears the config; omit to leave unchanged. */
+        localConfig?: GenericSourceLocalConfigPayload | null;
     }): Promise<{
         source: GenericSourceResponse;
     }>;

package/dist/cli/commands/local-hook.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Render the post-receive hook script. For each pushed ref the hook calls
+ * `kici-admin source trigger-local <id> --ref <ref> --sha <new> --base-url <url>`,
+ * so a push to any branch dispatches a run for that ref.
+ */
+export declare function renderPostReceiveHook(opts: {
+    sourceId: string;
+    baseUrl: string;
+}): string;
+/**
+ * Write the rendered hook into the repo's `.git/hooks/post-receive` and make it
+ * executable. Throws when the path is not a git repo (no `.git/hooks` dir).
+ */
+export declare function installPostReceiveHook(repoPath: string, script: string): string;
+//# sourceMappingURL=local-hook.d.ts.map

package/dist/cli/commands/local-trigger.d.ts

@@ -0,0 +1,24 @@
+export interface LocalTriggerInput {
+    orgId: string;
+    sourceId: string;
+    repoFullName: string;
+    event: 'push' | 'pull_request';
+    ref: string;
+    sha: string;
+    defaultBranch: string;
+}
+export interface LocalTriggerRequest {
+    path: string;
+    headers: Record<string, string>;
+    body: string;
+}
+/** Build the GitHub-shaped webhook request the local provider normalizer expects. */
+export declare function buildLocalTriggerRequest(input: LocalTriggerInput): LocalTriggerRequest;
+/** Read HEAD ref + sha from a local git repo (used when the operator omits --ref/--sha). */
+export declare function readRepoHead(repoPath: string): {
+    ref: string;
+    sha: string;
+};
+/** POST the trigger request to the orchestrator base URL. Returns the HTTP status. */
+export declare function sendLocalTrigger(baseUrl: string, req: LocalTriggerRequest): Promise<number>;
+//# sourceMappingURL=local-trigger.d.ts.map

package/dist/cli/commands/remote-source.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Remote-source inspection command for kici-admin.
+ *
+ * Subcommand namespace: `kici-admin remote-source show`.
+ *
+ * The remote-source anchor (`remote_sources` table) maps the deterministic
+ * routing key `remote:<orgId>` to the orchestrator's canonical org id so a
+ * Platform-relayed `kici run remote` resolves the real tenant. It is
+ * auto-provisioned on Platform auth; this command lets an operator inspect or
+ * confirm the row when debugging org-anchor issues on a hidden orchestrator.
+ *
+ * Reads the orchestrator DB directly (on-host operator inspection), so it stays
+ * usable even when Platform is unreachable.
+ */
+import type { Command } from 'commander';
+export declare function registerRemoteSourceCommands(program: Command): void;
+//# sourceMappingURL=remote-source.d.ts.map

package/dist/cli/commands/shared/versioned-upgrade.d.ts

@@ -85,6 +85,20 @@ export declare function getInstallBase(platform: ServicePlatform, name: string):
  * 5. Update symlink (Unix) or service registration (Windows)
  * 6. Start service
  */
+/**
+ * Resolve the target version for an npm-source upgrade (no --from/--url).
+ *
+ * The npm-source flow assumes the operator already ran
+ * `npm install -g @kici-dev/<pkg>@<version>`, which overwrites the global
+ * package in place. The running `kici-admin` binary is therefore the new
+ * version, and `running` is its self-reported version. We default the target
+ * to it, or validate an explicitly-passed --version matches — a mismatch means
+ * the npm install did not actually update the global binary.
+ */
+export declare function resolveNpmSourceVersion(opts: {
+    requested: string | undefined;
+    running: string;
+}): string;
 export declare function performVersionedUpgrade(component: UpgradeComponent, opts: VersionedUpgradeOptions): Promise<void>;
 export {};
 //# sourceMappingURL=versioned-upgrade.d.ts.map

package/dist/cli/kici-admin.d.ts

@@ -19,4 +19,17 @@ import { Command } from 'commander';
 export declare function buildProgram(): Command;
 /** Build the program and parse argv — the bin-shim entry point. */
 export declare function runCli(argv?: string[]): void;
+/**
+ * Canonicalize a path through any symlinks, falling back to a plain `resolve`
+ * when the target does not exist on disk. The entry-point guard compares the
+ * invoked script path against this module's own path; both sides must be fully
+ * canonicalized or a symlinked invocation path silently fails the match. The
+ * canonical example is the light-package launcher running
+ * `node /tmp/.../kici-admin.cjs` on macOS, where `/tmp` is a symlink to
+ * `/private/tmp`: `process.argv[1]` keeps the `/tmp` form while the bundle's
+ * `import.meta.url` resolves to the real `/private/tmp` path, so an
+ * un-canonicalized comparison is always false and the CLI exits 0 without
+ * running any command.
+ */
+export declare function canonicalize(p: string): string;
 //# sourceMappingURL=kici-admin.d.ts.map