@kici-dev/orchestrator 0.1.22 → 0.1.24

package/dist/reporting/step-log-reader.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Shared step-log reader for the agent-facing step-logs endpoint.
+ *
+ * Resolves a step's stored log file via the same `execution_steps.log_path` +
+ * `LogStorage` access the dashboard step.logs path uses, then returns the lines
+ * with line-based cursor pagination. `toAgentStepLogs` wraps every line in an
+ * untrusted envelope (log content is process/user output — never trusted).
+ */
+import type { Kysely } from 'kysely';
+import { type AgentStepLogs } from '@kici-dev/engine';
+import type { Database } from '../db/types.js';
+import type { LogStorage } from './log-storage.js';
+export interface StepLogReaderDeps {
+    db: Kysely<Database>;
+    logStorage: LogStorage;
+}
+export interface RawStepLogs {
+    lines: string[];
+    totalLines: number;
+    nextCursor: string | null;
+}
+export interface ReadStepLogArgs {
+    runId: string;
+    jobId: string;
+    stepIndex: number;
+    /** Stringified line offset to start from (0-based). Default 0. */
+    cursor?: string;
+    /** Max number of lines to return. Default 500, hard cap applied by caller. */
+    limit?: number;
+}
+/**
+ * Read a page of a step's log lines. Returns an empty page (not an error) when
+ * the step row or its log file is absent, so a never-emitted-logs step reads as
+ * `{ lines: [], totalLines: 0, nextCursor: null }`.
+ */
+export declare function readStepLogLines(deps: StepLogReaderDeps, args: ReadStepLogArgs): Promise<RawStepLogs>;
+/** Wrap raw step logs into the untrusted-tagged `AgentStepLogs` shape. */
+export declare function toAgentStepLogs(runId: string, jobId: string, stepIndex: number, raw: RawStepLogs): AgentStepLogs;
+//# sourceMappingURL=step-log-reader.d.ts.map

package/dist/routes/admin-registrations.d.ts

@@ -10,6 +10,7 @@ import type { RegistrationStore } from '../registration/registration-store.js';
 import type { RegistrationIndex } from '../registration/registration-index.js';
 import type { TokenManager } from '../secrets/token-manager.js';
 import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { EnvironmentStore } from '../environments/environment-store.js';
 /**
  * Dependencies for admin registration routes.
  */
@@ -18,6 +19,13 @@ export interface AdminRegistrationRoutesDeps {
     registrationIndex: RegistrationIndex;
     tokenManager: TokenManager;
     rbac: RbacEnforcer;
+    /**
+     * Resolves a bound environment by name for registration-time satisfiability.
+     * When present, a manual registration is rejected up front if a job binds a
+     * provably-unsatisfiable environment list (missing/disabled env, or
+     * mutually-exclusive fixed branch/trigger/repo restrictions).
+     */
+    environmentStore?: Pick<EnvironmentStore, 'matchEnvironment'>;
 }
 /** Hono env type for admin registration routes with context variables. */
 type AdminRegEnv = {

package/dist/routes/admin-runs.d.ts

@@ -24,6 +24,7 @@ import type { Database } from '../db/types.js';
 import type { TokenManager } from '../secrets/token-manager.js';
 import type { RbacEnforcer, Role } from '../secrets/rbac.js';
 import type { AuditLogger } from '../secrets/audit-logger.js';
+import type { LogStorage } from '../reporting/log-storage.js';
 /**
  * Dependencies for admin run routes.
  */
@@ -38,6 +39,12 @@ export interface AdminRunRoutesDeps {
      * secret-output plaintext. Derived once per request via deriveKey().
      */
     masterSecretKey?: string;
+    /**
+     * Log storage backend. Required only by the agent step-logs endpoint
+     * (`/runs/:runId/jobs/:jobId/steps/:stepIndex/logs`); when absent, that
+     * path 503s cleanly.
+     */
+    logStorage?: LogStorage;
 }
 /** Hono env type for admin run routes with context variables. */
 type AdminRunEnv = {

package/dist/scaler/manager.d.ts

@@ -39,6 +39,23 @@ export interface ResolvedResources {
         memBytes: number;
     };
 }
+/**
+ * Build the scaler-usage metric rows: one per active scaler (stamped with its
+ * backend type) plus a `__global__` rollup row. Pure so it is unit-testable
+ * without constructing a full ScalerManager.
+ */
+export declare function buildScalerUsageRows(perScalerUsage: ReadonlyMap<string, {
+    cpus: number;
+    memBytes: number;
+}>, globalUsage: {
+    cpus: number;
+    memBytes: number;
+}, scalerTypeOf: (name: string) => string | undefined): Array<{
+    scaler: string;
+    scalerType?: string;
+    cpus: number;
+    memBytes: number;
+}>;
 /**
  * Status summary for metrics and health endpoints.
  */

package/dist/secrets/index.d.ts

@@ -7,7 +7,7 @@
 export { PgSecretStore } from './pg-secret-store.js';
 export { AuditLogger } from './audit-logger.js';
 export { loadMasterKey, loadOldMasterKey, loadSecretStoreConfig, type SecretStoreConfig, } from './config.js';
-export { encrypt, decrypt, deriveKey, generateMasterKey, type EncryptedValue } from './crypto.js';
+export { encrypt, decrypt, deriveKey, generateMasterKey, type EncryptedValue, } from '@kici-dev/shared';
 export { VaultSecretStore, type VaultConfig } from './vault-secret-store.js';
 export { SecretResolver, type SecretResolverDeps, type ResolvedSecretMeta, type EnvironmentStoreLike, type BindingStoreLike, type SecretStoreLike, } from './secret-resolver.js';
 export { BackendSyncManager } from './backend-sync.js';

package/dist/secrets/secret-resolver.d.ts

@@ -15,7 +15,7 @@
  * longest-path-wins uses scope path after stripping backend prefix.
  * audit log includes backend name.
  */
-import { type EnvironmentBinding, type ScopedSecret } from '@kici-dev/engine';
+import { type EnvironmentBinding, type HostFacts, type ScopedSecret } from '@kici-dev/engine';
 import type { Logger } from '@kici-dev/shared';
 import type { AuditLogger } from './audit-logger.js';
 /**
@@ -69,13 +69,13 @@ export interface ResolvedSecretMeta {
  * can flow through `ProcessingDeps.secretResolver`.
  */
 export interface SecretResolverApi {
-    resolveForJob(orgId: string, environmentName: string): Promise<Record<string, string>>;
+    resolveForJob(orgId: string, environmentName: string, hostCtx?: HostFacts): Promise<Record<string, string>>;
     resolveNamed(orgId: string, scope: string, key: string, opts?: {
         store?: string;
         runId?: string;
         jobId?: string;
     }): Promise<string | null>;
-    resolveForJobWithMeta(orgId: string, environmentName: string): Promise<Record<string, ResolvedSecretMeta>>;
+    resolveForJobWithMeta(orgId: string, environmentName: string, hostCtx?: HostFacts): Promise<Record<string, ResolvedSecretMeta>>;
 }
 /**
  * Resolves secrets for a job by matching environment bindings against scoped secrets
@@ -98,9 +98,13 @@ export declare class SecretResolver implements SecretResolverApi {
      *
      * @param orgId - Organization ID
      * @param environmentName - Environment name to resolve secrets for
+     * @param hostCtx - Optional fan-out child identity for per-host resolution.
+     *   When supplied, each binding is gated by its `host_pattern` and its
+     *   `scope_pattern` is templated per-child; when omitted, only fleet-wide
+     *   (`'**'`) non-templated bindings contribute.
      * @returns Flat map of decrypted secret key-value pairs
      */
-    resolveForJob(orgId: string, environmentName: string): Promise<Record<string, string>>;
+    resolveForJob(orgId: string, environmentName: string, hostCtx?: HostFacts): Promise<Record<string, string>>;
     /**
      * Resolve a single named secret by (orgId, scope, key), optionally scoped to
      * a specific backend. Bypasses environment bindings — this is a direct
@@ -126,7 +130,7 @@ export declare class SecretResolver implements SecretResolverApi {
      *
      * Returns the secret value along with which backend and scope provided it.
      */
-    resolveForJobWithMeta(orgId: string, environmentName: string): Promise<Record<string, ResolvedSecretMeta>>;
+    resolveForJobWithMeta(orgId: string, environmentName: string, hostCtx?: HostFacts): Promise<Record<string, ResolvedSecretMeta>>;
     /**
      * Collect all secrets from all backend stores, prefixing scopes.
      * Per /: unreachable backends are tracked but not fatal here.
@@ -145,8 +149,17 @@ export declare class SecretResolver implements SecretResolverApi {
      */
     private checkScopedFailure;
     /**
-     * Find the winning secret for a given key (highest scope depth after prefix strip).
+     * Find the winning secret for a given key, mirroring the engine scope
+     * resolver's host-aware matching and `(host specificity, scope depth)`
+     * precedence so the enriched metadata reports the same secret the flat
+     * resolution selected.
      */
     private findWinningSecret;
+    /**
+     * Resolve the effective scope pattern a binding contributes for a host,
+     * applying the host gate and per-child scope templating. Mirrors the engine
+     * scope resolver's `bindingScopeForHost`. Returns `null` to skip the binding.
+     */
+    private bindingScopeForHost;
 }
 //# sourceMappingURL=secret-resolver.d.ts.map