@kici-dev/orchestrator 0.1.21 → 0.1.22

package/dist/pipeline/processor.d.ts

@@ -33,7 +33,7 @@ import type { HostRosterStore } from '../agent/host-roster.js';
 import type { RunCoordinator } from '../cluster/coordinator.js';
 import type { TeamMembershipLookup } from '../approvals/team-membership-lookup.js';
 import type { LogStorage } from '../reporting/log-storage.js';
-import type { SecretResolver } from '../secrets/secret-resolver.js';
+import type { SecretResolverApi } from '../secrets/secret-resolver.js';
 import type { ContributorCache } from '../security/contributor-cache.js';
 import type { AccessLogWriter } from '../audit/access-log.js';
 import type { LockFile as FullLockFile, LockWorkflow, SimulatedEvent, WebhookNormalizer } from '@kici-dev/engine';
@@ -281,7 +281,7 @@ export interface ProcessingDeps {
     /** Run coordinator for multi-orchestrator job routing. Optional -- if not set, all jobs dispatch locally (single-orchestrator mode). */
     coordinator?: RunCoordinator;
     /** Secret resolver for dispatch-time secret resolution. Optional -- if not set, secrets are not resolved. */
-    secretResolver?: SecretResolver;
+    secretResolver?: SecretResolverApi;
     /** Optional callback when source locations are extracted from a lock file workflow. */
     onSourceLocationsExtracted?: (workflowName: string, jobName: string, sourceLocations: Array<{
         file: string;

package/dist/pipeline/test-pipeline.d.ts

@@ -1,36 +1,28 @@
 /**
- * Test pipeline processor for CLI-initiated test runs.
+ * Test-trigger adapter for CLI-initiated runs (`kici run`).
  *
- * Reuses the existing webhook processing pipeline steps (lock file fetch,
- * trigger matching, job dispatch) but injects a synthetic event instead
- * of processing a real webhook. This avoids the anti-pattern of calling
- * processWebhook() directly (which expects WebhookInfo from a real webhook).
+ * Resolves the lock file, matched decisions, and fixture-specific concerns
+ * (inline-vs-provider lock, decision selection, fixture-payload storage, the
+ * `allow_local_execution` environment gate, CLI-secret overlay, in-memory
+ * test-run marking), then dispatches each matched workflow through the SAME
+ * shared core as webhooks (`dispatchMatchedWorkflow`). The test path is a thin
+ * adapter — needs-DAG scheduling, `expansionMap` fan-out edges, `runsOnAll`
+ * host fan-out, and deferred init/dynamic dispatch all come from the core.
  *
- * Key differences from processWebhook():
- * - Skips dedup check (test runs are always unique)
- * - Skips webhook normalization (event is already in SimulatedEvent shape)
- * - Skips repo extraction from payload (routing key is provided directly)
- * - deliveryId has `test:` prefix for identification
- * - Execution runs are marked with is_test_run=true and fixture_id
- * - Supports direct workflow execution (bypass trigger matching)
+ * Differences from a webhook run:
+ * - the synthetic event is injected directly (no provider normalization/dedup);
+ * - the lock file may be inline (local repos have no remote provider, so
+ *   `bundle` is undefined);
+ * - `deliveryId` carries a `test:` prefix;
+ * - the run is stamped `is_test_run = true` + `fixture_id` (via the core's
+ *   `testRun` meta) and marked in-memory for live-log broadcast to the CLI;
+ * - CLI-uploaded local secrets win over orchestrator env secrets (the
+ *   decorating secret resolver), and the fixture's `secrets` context mapping
+ *   resolves into namespaced secrets;
+ * - direct workflow execution (bypass trigger matching) is supported.
  */
-import type { LockFileCache } from '../lockfile-cache.js';
-import type { Dispatcher } from '../agent/dispatcher.js';
-import type { CheckRunReporter } from '../reporting/check-run-reporter.js';
-import type { ExecutionTracker } from '../reporting/execution-tracker.js';
-import type { AgentRegistry } from '../agent/registry.js';
-import type { ProviderRegistry } from '../provider-registry.js';
-import type { SourceCache } from '../cache/index.js';
-import type { BuildCoordinator } from '../cache/index.js';
-import type { DepCache } from '../cache/index.js';
-import type { PendingBuildTracker } from '../cache/index.js';
-import type { SecretResolver } from '../secrets/secret-resolver.js';
-import type { EnvironmentStore } from '../environments/environment-store.js';
-import type { VariableStore } from '../environments/variable-store.js';
-import type { LogStorage } from '../reporting/log-storage.js';
-import type { Kysely } from 'kysely';
-import type { Database } from '../db/types.js';
-import type { CheckMode } from '@kici-dev/engine';
+import { type ProcessingDeps } from './processor.js';
+import type { CheckMode, HostTargetSelector } from '@kici-dev/engine';
 /**
  * Input for a test trigger request.
  */
@@ -76,6 +68,11 @@ export interface TestTriggerInput {
      * Omitted means `apply`.
      */
     checkMode?: CheckMode;
+    /**
+     * Runtime host narrowing from `kici run --target`. Threaded onto the dispatch
+     * context, where it post-filters each runsOnAll job's matched roster.
+     */
+    target?: HostTargetSelector;
 }
 /**
  * Result of processing a test trigger.
@@ -91,37 +88,12 @@ interface TestTriggerResult {
     jobIds: string[];
 }
 /**
- * Dependencies for the test pipeline processor.
- * All injected for testability.
- */
-export interface TestPipelineDeps {
-    lockFileCache: LockFileCache;
-    dispatcher: Dispatcher;
-    executionTracker?: ExecutionTracker;
-    checkRunReporter?: CheckRunReporter;
-    sourceCache?: SourceCache;
-    buildCoordinator?: BuildCoordinator;
-    depCache?: DepCache;
-    pendingBuilds?: PendingBuildTracker;
-    secretResolver?: SecretResolver;
-    agentRegistry: AgentRegistry;
-    providerRegistry: ProviderRegistry;
-    /** Log storage for persisting test fixture payloads. Optional -- if not set, payload storage is skipped. */
-    logStorage?: LogStorage;
-    /** Database connection for environment protection checks. Optional. */
-    db?: Kysely<Database>;
-    /** Environment store for resolving environment ids in test dispatch parity. Optional. */
-    environmentStore?: EnvironmentStore;
-    /** Variable store for resolving environment variables in test dispatch parity. Optional. */
-    variableStore?: VariableStore;
-}
-/**
- * Process a test trigger through the existing pipeline.
+ * Process a test trigger through the shared dispatch core.
  *
- * Reuses pipeline steps starting from lock file fetch, skipping webhook
- * normalization and dedup. Supports both trigger-matched and direct
- * workflow execution modes.
+ * Resolves the lock file + matched decisions + fixture concerns, then builds a
+ * `WorkflowDispatchContext` per matched workflow and calls
+ * `dispatchMatchedWorkflow` — the same core the webhook path uses.
  */
-export declare function processTestTrigger(input: TestTriggerInput, deps: TestPipelineDeps): Promise<TestTriggerResult>;
+export declare function processTestTrigger(input: TestTriggerInput, deps: ProcessingDeps): Promise<TestTriggerResult>;
 export {};
 //# sourceMappingURL=test-pipeline.d.ts.map

package/dist/providers/github/manifest.d.ts

@@ -33,11 +33,21 @@ export interface GithubAppManifest {
     default_permissions: Record<string, string>;
     default_events: string[];
 }
+/**
+ * Validate a self-hosted webhook URL supplied via `source add github
+ * --webhook-url`. Must be a well-formed absolute `https://` URL. Returns the URL
+ * verbatim on success; throws a clear error otherwise. The validated URL is
+ * baked into `manifest.hook_attributes.url` as-is — KiCI adds no ingress and
+ * does not receive events at it; the operator owns delivery.
+ */
+export declare function validateWebhookUrl(value: string): string;
 export declare function buildGithubAppManifest(input: GithubManifestInput): GithubAppManifest;
 /** Credentials returned by GitHub's manifest-conversion endpoint. */
 export interface GithubAppCredentials {
     appId: string;
     slug: string;
+    /** GitHub's display name for the App (the authoritative stored name). */
+    name: string;
     privateKey: string;
     webhookSecret: string;
     clientId?: string;
@@ -52,6 +62,21 @@ export interface GithubAppCredentials {
 export declare function convertManifestCode(code: string, deps?: {
     octokit?: Pick<Octokit, 'request'>;
 }): Promise<GithubAppCredentials>;
+/**
+ * Ask GitHub who this App is (`GET /app`, authenticated as the App via its
+ * JWT) and return its authoritative display `name` + `slug`. This is the single
+ * "fetch the App's identity from GitHub" helper, reused at source creation, by
+ * the daily refresher, and by `kici-admin source refresh`.
+ *
+ * GitHub is the source of truth: a rename in the GitHub UI changes the value
+ * `GET /app` returns, which is what keeps the dashboard name fresh.
+ */
+export declare function fetchGithubAppIdentity(creds: Pick<GithubAppCredentials, 'appId' | 'privateKey'>, deps?: {
+    appOctokit?: Pick<Octokit, 'request'>;
+}): Promise<{
+    name: string;
+    slug: string;
+}>;
 /**
  * Poll GitHub (as the App, via a JWT) until at least one installation exists,
  * returning the first installation's id + account login. Throws on timeout.

package/dist/routes/admin-sources.d.ts

@@ -11,6 +11,7 @@
 import { Hono } from 'hono';
 import type { SourceStore } from '../sources/source-store.js';
 import type { Role } from '../secrets/rbac.js';
+import { type FetchGithubAppIdentity } from '../github-app-name-refresher/github-app-name-refresher.js';
 interface SourceRouteDeps {
     sourceStore: SourceStore;
     /**
@@ -39,6 +40,12 @@ interface SourceRouteDeps {
         webhookUrl: string | null;
         webhookNote?: string;
     }>;
+    /**
+     * Fetch a GitHub App's authoritative `{ name, slug }` from GitHub. Injectable
+     * for tests; defaults to the real `fetchGithubAppIdentity`. Used by the
+     * `source refresh` route.
+     */
+    fetchAppIdentity?: FetchGithubAppIdentity;
 }
 type AdminSourcesEnv = {
     Variables: {

package/dist/secrets/secret-resolver.d.ts

@@ -62,6 +62,21 @@ export interface ResolvedSecretMeta {
     backend: string;
     scope: string;
 }
+/**
+ * The public secret-resolution surface consumed by the dispatch path and the
+ * universal-git provider. `SecretResolver` implements this; the test adapter's
+ * `DecoratingSecretResolver` (CLI-secret overlay) implements it too, so either
+ * can flow through `ProcessingDeps.secretResolver`.
+ */
+export interface SecretResolverApi {
+    resolveForJob(orgId: string, environmentName: string): Promise<Record<string, string>>;
+    resolveNamed(orgId: string, scope: string, key: string, opts?: {
+        store?: string;
+        runId?: string;
+        jobId?: string;
+    }): Promise<string | null>;
+    resolveForJobWithMeta(orgId: string, environmentName: string): Promise<Record<string, ResolvedSecretMeta>>;
+}
 /**
  * Resolves secrets for a job by matching environment bindings against scoped secrets
  * from multiple backends.
@@ -71,7 +86,7 @@ export interface ResolvedSecretMeta {
  * are matched against binding patterns, and longest-path-wins uses the path AFTER
  * stripping the backend prefix.
  */
-export declare class SecretResolver {
+export declare class SecretResolver implements SecretResolverApi {
     private readonly environmentStore;
     private readonly bindingStore;
     private readonly backendStores;