@kici-dev/orchestrator 0.1.16 → 0.1.17

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/orchestrator@0.1.16",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Forchestrator/0.1.16/6b96d055-7c14-4de7-933b-c4d260b0d312",
+  "name": "@kici-dev/orchestrator@0.1.17",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Forchestrator/0.1.17/9fc65dab-8a17-45e5-a6b8-1e83bc726111",
   "creationInfo": {
-    "created": "2026-06-12T09:41:54Z",
+    "created": "2026-06-14T12:30:39Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -1477,9 +1477,9 @@
       "homepage": "https://ericsmekens.github.io/jsep/tree/master/packages/regex#readme"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.16",
+      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.17",
       "name": "@kici-dev/core",
-      "versionInfo": "0.1.16",
+      "versionInfo": "0.1.17",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1490,16 +1490,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.16"
+          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.17"
         }
       ],
       "description": "Light shared utilities for the KiCI stack (logging, errors, formatting, crypto, zx init, the TypeScript ESM loader hook). No server-side dependencies.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.16",
+      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.17",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.16",
+      "versionInfo": "0.1.17",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1510,7 +1510,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.16"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.17"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
@@ -1519,7 +1519,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/orchestrator",
-      "versionInfo": "0.1.16",
+      "versionInfo": "0.1.17",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1530,16 +1530,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/orchestrator@0.1.16"
+          "referenceLocator": "pkg:npm/%40kici-dev/orchestrator@0.1.17"
         }
       ],
       "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "name": "@kici-dev/shared",
-      "versionInfo": "0.1.16",
+      "versionInfo": "0.1.17",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1550,7 +1550,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.16"
+          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.17"
         }
       ],
       "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
@@ -5553,6 +5553,26 @@
       ],
       "description": "Node's event emitter for all engines."
     },
+    {
+      "SPDXID": "SPDXRef-Package-fast-cartesian-9.0.1",
+      "name": "fast-cartesian",
+      "versionInfo": "9.0.1",
+      "downloadLocation": "https://registry.npmjs.org/fast-cartesian/-/fast-cartesian-9.0.1.tgz",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "Apache-2.0",
+      "copyrightText": "NOASSERTION",
+      "supplier": "NOASSERTION",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:npm/fast-cartesian@9.0.1"
+        }
+      ],
+      "description": "Fast cartesian product",
+      "homepage": "https://www.github.com/ehmicky/fast-cartesian"
+    },
     {
       "SPDXID": "SPDXRef-Package-fast-content-type-parse-3.0.0",
       "name": "fast-content-type-parse",
@@ -6257,6 +6277,26 @@
       ],
       "description": "A very strict and proper argument parser."
     },
+    {
+      "SPDXID": "SPDXRef-Package-jose-6.2.3",
+      "name": "jose",
+      "versionInfo": "6.2.3",
+      "downloadLocation": "https://registry.npmjs.org/jose/-/jose-6.2.3.tgz",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "MIT",
+      "copyrightText": "NOASSERTION",
+      "supplier": "NOASSERTION",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:npm/jose@6.2.3"
+        }
+      ],
+      "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
+      "homepage": "https://github.com/panva/jose"
+    },
     {
       "SPDXID": "SPDXRef-Package-jsep-1.4.0",
       "name": "jsep",
@@ -10702,47 +10742,57 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.128.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.17",
+      "relatedSpdxElement": "SPDXRef-Package-fast-cartesian-9.0.1",
+      "relationshipType": "DEPENDS_ON"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.17",
+      "relatedSpdxElement": "SPDXRef-Package-jose-6.2.3",
+      "relationshipType": "DEPENDS_ON"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.4",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
       "relationshipType": "DEPENDS_ON"
     },
@@ -10778,12 +10828,12 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.16",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.17",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -10887,112 +10937,112 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package--aws-sdk-client-s3-3.1038.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.17",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.17",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-api-1.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-metrics-otlp-http-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-prometheus-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-trace-otlp-http-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-instrumentation-runtime-node-0.28.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-resources-2.7.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-sdk-node-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-semantic-conventions-1.40.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-archiver-7.0.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-diff-7.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-hono-4.12.18",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-kysely-0.29.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.128.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-pg-8.20.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-yaml-2.8.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },

package/dist/providers/internal/index.d.ts

@@ -1,32 +0,0 @@
-/**
- * Internal provider implementations for KiCI E2E tests.
- *
- * Provides a complete provider bundle for testing the webhook processing pipeline
- * without GitHub dependencies. Uses file:// URLs for cloning and reads lock files
- * directly from the filesystem.
- *
- * Classes:
- * - InternalWebhookNormalizer -> WebhookNormalizer (extracts from custom headers)
- * - InternalLockFileFetcher -> LockFileFetcher (reads from local filesystem)
- * - InternalRepoUrlBuilder -> RepoUrlBuilder (returns file:// URLs)
- */
-import type { ProviderBundle } from '../../provider-registry.js';
-export { InternalWebhookNormalizer } from './normalizer.js';
-export { InternalLockFileFetcher } from './lock-file-fetcher.js';
-export { InternalRepoUrlBuilder } from './repo-url-builder.js';
-/**
- * Create a ProviderBundle for internal/test webhook sources.
- *
- * Provides normalizer, lock file fetcher, and repo URL builder.
- * Clone token provider and changed files fetcher are null since
- * file:// URLs need no auth and internal events don't track changed files.
- *
- * @param opts.repoBasePath - Base directory where test repos live on disk
- * @param opts.cloneUrlBase - Optional URL base for clone operations (e.g. git://host/path)
- * @returns Complete ProviderBundle for internal provider
- */
-export declare function createInternalProviderBundle(opts: {
-    repoBasePath: string;
-    cloneUrlBase?: string;
-}): ProviderBundle;
-//# sourceMappingURL=index.d.ts.map

package/dist/routes/test-trigger.d.ts

@@ -1,41 +0,0 @@
-/**
- * REST endpoints for CLI-initiated test runs.
- *
- * POST /api/v1/test/trigger           - Trigger a test run with a fixture event
- * GET  /api/v1/test/runs/:runId       - Get status of a test run
- * GET  /api/v1/test/runs/:runId/logs  - Get logs for a test run
- * POST /api/v1/test/cancel            - Cancel a running test run
- *
- * All endpoints require Bearer token authentication via the admin token system.
- * The test trigger injects a synthetic event into the existing pipeline,
- * reusing trigger matching and job dispatch.
- */
-import { Hono } from 'hono';
-import { type TestPipelineDeps } from '../pipeline/test-pipeline.js';
-import type { AppConfig } from '../config.js';
-import type { TokenManager } from '../secrets/token-manager.js';
-import type { Kysely } from 'kysely';
-import type { Database } from '../db/types.js';
-/** Hono env type for test trigger routes with context variables. */
-type TestTriggerEnv = {
-    Variables: {
-        userId: string;
-        routingKey: string | null;
-    };
-};
-/**
- * Dependencies for test trigger routes.
- * Extends TestPipelineDeps with additional route-specific deps.
- */
-export interface TestTriggerRouteDeps extends TestPipelineDeps {
-    config: AppConfig;
-    tokenManager?: TokenManager;
-    db: Kysely<Database>;
-    cacheStorage?: import('../storage/types.js').CacheStorage;
-}
-/**
- * Create Hono routes for test trigger and cancel endpoints.
- */
-export declare function createTestTriggerRoutes(deps: TestTriggerRouteDeps): Hono<TestTriggerEnv>;
-export {};
-//# sourceMappingURL=test-trigger.d.ts.map

package/dist/ws/observer-handler.d.ts

@@ -1,42 +0,0 @@
-/**
- * WebSocket handler for observer connections.
- *
- * CLI clients connect to observe a running execution in real-time.
- * The observer channel is read-only: clients subscribe with a run ID
- * and token, then receive log chunks, step status changes, and
- * completion events broadcast by the ObserverRegistry.
- *
- * Auth flow:
- * 1. Connection opens, 5-second auth timeout starts
- * 2. First message must be `observe.subscribe` with valid token and runId
- * 3. Token validated against admin_tokens (same as admin API auth)
- * 4. Run ID validated against execution_runs table
- * 5. If valid: registered in ObserverRegistry, initial status sent
- * 6. Subsequent messages ignored (read-only channel)
- * 7. On close: unregistered from ObserverRegistry
- */
-import type { WSEvents } from 'hono/ws';
-import type { Kysely } from 'kysely';
-import type { Database } from '../db/types.js';
-import type { ObserverRegistry } from './observer-registry.js';
-import type { TokenManager } from '../secrets/token-manager.js';
-export declare const WS_CLOSE_OBSERVER_AUTH_FAILED = 4001;
-export declare const WS_CLOSE_OBSERVER_AUTH_TIMEOUT = 4002;
-export declare const WS_CLOSE_OBSERVER_INVALID_MESSAGE = 4003;
-export declare const WS_CLOSE_OBSERVER_RUN_NOT_FOUND = 4030;
-export interface ObserverHandlerDeps {
-    observerRegistry: ObserverRegistry;
-    db: Kysely<Database>;
-    tokenManager: TokenManager;
-}
-/**
- * Create a Hono WS event handler for observer connections.
- *
- * Flow:
- * 1. onOpen: start 5-second auth timeout
- * 2. First onMessage: must be observe.subscribe with valid token + runId
- * 3. Subsequent messages: ignored (read-only channel)
- * 4. onClose: cleanup from registry
- */
-export declare function createObserverWsHandler(deps: ObserverHandlerDeps): WSEvents;
-//# sourceMappingURL=observer-handler.d.ts.map