@kici-dev/orchestrator 0.1.23 → 0.1.24

package/dist/provenance/trust-root.d.ts

@@ -0,0 +1,24 @@
+import type { JSONWebKeySet } from 'jose';
+/**
+ * Derive the JWKS URI for a provenance OIDC issuer. Identical to the Platform's
+ * own derivation (`packages/platform/src/dashboard/routes/runs.ts`) so a bundle
+ * verified client-side and at ingest resolve the same key set.
+ */
+export declare function deriveJwksUri(issuer: string): string;
+/**
+ * The orchestrator's view of the provenance trust root. The issuer arrives over
+ * the `auth.success` connect message for the live process, or from config/env
+ * (`KICI_PROVENANCE_ISSUER`) for the CLI backfill which has no live handshake.
+ * The JWKS is fetched lazily and cached with a single refetch-on-`kid`-miss.
+ */
+export interface ProvenanceTrustRoot {
+    getIssuer(): string | null;
+    getJwks(kid?: string): Promise<JSONWebKeySet | null>;
+    setIssuer(issuer: string | null): void;
+}
+export declare function createProvenanceTrustRoot(opts?: {
+    issuer?: string | null;
+    fetchImpl?: typeof fetch;
+    ttlMs?: number;
+}): ProvenanceTrustRoot;
+//# sourceMappingURL=trust-root.d.ts.map

package/dist/provenance/verify-at-ingest.d.ts

@@ -0,0 +1,24 @@
+import { type AttestationVerifyStatus } from '@kici-dev/engine';
+import type { CacheStorage } from '../storage/types.js';
+import type { ProvenanceTrustRoot } from './trust-root.js';
+export interface AttestationVerdict {
+    verifyStatus: AttestationVerifyStatus;
+    verifyReason: string | null;
+    verifiedAt: Date | null;
+}
+/**
+ * Compute the verification verdict for a stored provenance bundle at ingest.
+ *
+ * Fail-closed: a missing trust root, unfetchable JWKS, missing storage, or an
+ * unreadable bundle all yield `unverifiable` (never silently `verified`). A
+ * bundle that verifies false yields `failed` with the first failure code. Any
+ * thrown error is caught and recorded as `unverifiable` — verification never
+ * fails the upload.
+ */
+export declare function computeAttestationVerdict(opts: {
+    trustRoot: ProvenanceTrustRoot | undefined;
+    storage: CacheStorage | undefined;
+    storageKey: string;
+    logWarn?: (reason: string) => void;
+}): Promise<AttestationVerdict>;
+//# sourceMappingURL=verify-at-ingest.d.ts.map

package/dist/reporting/agent-failure-category.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Derive a coarse, trusted run-failure classification from existing signals.
+ *
+ * Pure derivation — no heuristics, no flaky/regression detection (that's a
+ * deferred phase). KiCI computes this from data it already records, so the
+ * resulting category is a trusted field on the agent run-result.
+ */
+import { AgentFailureCategory } from '@kici-dev/engine';
+export interface FailureSignals {
+    /** `execution_runs.status`. */
+    runStatus: string;
+    /** A run- or job-scoped init failure was recorded. */
+    hasInitFailure: boolean;
+    /** The init-failure category (`InitFailureCategory`), if any. */
+    initFailureCategory: string | null;
+    /** Any job ended in `timed_out_stale` (or a workflow/job timeout fired). */
+    timedOut: boolean;
+    /** Any step recorded a non-zero exit code. */
+    anyStepNonZeroExit: boolean;
+}
+/**
+ * Returns the failure category, or null for a non-failed run (success, or still
+ * in flight). Precedence: init failure → timeout → cancelled → step exit →
+ * unknown.
+ */
+export declare function deriveFailureCategory(s: FailureSignals): AgentFailureCategory | null;
+//# sourceMappingURL=agent-failure-category.d.ts.map

package/dist/reporting/agent-run-result-mapper.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Map the canonical run detail into the provenance-tagged `AgentRunResult`.
+ *
+ * Trusted (plain): ids, enum statuses, exit codes, durations, timestamps,
+ * hashes, the derived failure category. Untrusted (enveloped): every name, ref,
+ * error string, contributor, job output value — anything sourced from the user's
+ * repo / contributor / process output. Secret output *values* are never emitted;
+ * only their key names appear.
+ */
+import { type AgentRunResult } from '@kici-dev/engine';
+import type { CanonicalRunDetail } from './run-aggregator.js';
+export declare function mapToAgentRunResult(d: CanonicalRunDetail): AgentRunResult;
+//# sourceMappingURL=agent-run-result-mapper.d.ts.map

package/dist/reporting/execution-tracker.d.ts

@@ -23,6 +23,8 @@ export interface ExecutionContext {
     provider: string;
     repoIdentifier: string;
     sha: string;
+    /** True when the run executed an uploaded local working tree (`kici run remote`). */
+    localWorkingTree?: boolean;
     installationId?: number;
     requestId?: string;
     routingKey?: string;
@@ -38,6 +40,14 @@ export interface ExecutionContext {
     originalRunId?: string | null;
     /** User identity that triggered this re-run (null/undefined for webhook-triggered). */
     triggeredBy?: string | null;
+    /**
+     * Provider login of the person who triggered the run (pusher / PR author).
+     * Captured for all event types; forwarded to the Platform run projection and
+     * used to resolve actor-scope notifications.
+     */
+    triggerActorUsername?: string | null;
+    /** Immutable provider user id of the triggering actor (preferred for resolution). */
+    triggerActorUserId?: string | null;
     /** Workflow-level concurrency config from the lock file. */
     concurrency?: {
         cancelInProgress?: boolean;
@@ -112,7 +122,9 @@ export interface ExecutionTrackerDeps {
      * Structured init-failure signal. Set for synthetic rejected-* / init-failed-*
      * jobs that never started. Persisted in execution_jobs.init_failure.
      */
-    initFailure?: InitFailure) => void;
+    initFailure?: InitFailure, 
+    /** Ordered bound deployment-environment names for this job (multi-env jobs). */
+    environments?: string[]) => void;
     /**
      * Optional callback to emit run.event messages to Platform.
      * Fires at orchestrator lifecycle points (dispatch, agent assignment, job start/complete).
@@ -208,6 +220,7 @@ export declare class ExecutionTracker {
         waveGated?: boolean;
         waveMaxParallel?: number;
         waveFailFast?: boolean;
+        environments?: string[];
     }>, routingKey?: string, 
     /** Secret context names dispatched with jobs (for context-disable job lookup). */
     dispatchedContexts?: string[], 
@@ -229,7 +242,13 @@ export declare class ExecutionTracker {
     /** Workflow-level wall-clock timeout in ms from the lock file. Sets the run deadline. */
     workflowTimeoutMs?: number, 
     /** Run mode for idempotent steps; non-apply labels the run a check-mode preview. */
-    checkMode?: string): Promise<void>;
+    checkMode?: string, 
+    /** True when the run executes an uploaded local working tree (`kici run remote`). */
+    localWorkingTree?: boolean, 
+    /** Provider login of the triggering actor (pusher / PR author). */
+    triggerActorUsername?: string | null, 
+    /** Immutable provider user id of the triggering actor. */
+    triggerActorUserId?: string | null): Promise<void>;
     /**
      * Add additional jobs to an already-started execution run.
      * Used when build jobs are tracked early and regular jobs are dispatched later.
@@ -283,6 +302,7 @@ export declare class ExecutionTracker {
         baseJobName?: string;
         variantKind?: string;
         variantLabel?: string;
+        environments?: string[];
     }>, dispatchedContexts?: string[], 
     /** Synthetic job ID to replace (e.g. needs-pending-deploy-{uuid}). */
     replaceSyntheticId?: string): Promise<void>;

package/dist/reporting/run-aggregator.d.ts

@@ -0,0 +1,161 @@
+/**
+ * Shared run-detail aggregator.
+ *
+ * One source of truth for "DB rows → canonical nested run detail (jobs with
+ * nested steps + needs + outputs)". The dashboard handler and the agent-facing
+ * structured run-result route both build on the same `buildRunDetailJobs` /
+ * `mapRunDetailStep` mapping, so the row→jobs shape never diverges between the
+ * two read surfaces.
+ *
+ * `aggregateRunDetail` is the warm-path convenience used by the agent route: it
+ * runs the run-header + per-run batch queries and returns the canonical detail.
+ * (Cold-store fallback stays a dashboard-handler concern — the agent read path
+ * is warm-only in v1.)
+ */
+import type { Kysely } from 'kysely';
+import type { ExecutionJobStatus, InitFailure } from '@kici-dev/engine';
+import type { Database } from '../db/types.js';
+/** A run-detail step row as queried from execution_steps (warm + cold paths). */
+export interface RunDetailStepRow {
+    step_index: number;
+    step_name: string;
+    status: string;
+    started_at: Date | null;
+    completed_at: Date | null;
+    duration_ms: number | null;
+    exit_code: number | null;
+    error_message: string | null;
+    step_type: string;
+    secrets_accessed: string | null;
+    check_outcome: string | null;
+    drift_summary: string | null;
+    concurrency_kind: string | null;
+    group_id: string | null;
+}
+/** Map a step row to the dashboard run-detail step shape (epoch-ms timestamps). */
+export declare function mapRunDetailStep(step: RunDetailStepRow): {
+    groupId?: string | undefined;
+    concurrencyKind?: string | undefined;
+    driftSummary?: string | undefined;
+    checkOutcome?: string | undefined;
+    secretsAccessed: string | null;
+    stepType?: string | undefined;
+    stepIndex: number;
+    stepName: string;
+    status: string;
+    startedAt: number | null;
+    completedAt: number | null;
+    durationMs: number | null;
+    exitCode: number | null;
+    errorMessage: string | null;
+};
+/** A run-detail job row as queried from execution_jobs (warm + cold paths). */
+export interface RunDetailJobRow {
+    job_id: string;
+    job_name: string;
+    status: string;
+    matrix_values: unknown;
+    base_job_name: string | null;
+    variant_kind: string | null;
+    variant_label: string | null;
+    started_at: Date | null;
+    completed_at: Date | null;
+    duration_ms: number | null;
+    agent_id: string | null;
+    error_message: string | null;
+    runs_on_labels: unknown;
+    environments: unknown;
+    outputs: unknown;
+    init_failure: unknown;
+}
+/** Lookups threaded into {@link buildRunDetailJobs} from the per-run batch queries. */
+export interface RunDetailJobLookups {
+    stepsByJob: Map<string, RunDetailStepRow[]>;
+    secretKeysByJob: Map<string, string[]>;
+    needsByJob: Map<string, Array<{
+        upstreamName: string;
+        runOn: ExecutionJobStatus[];
+    }>>;
+}
+/** Map queried job + step rows into the dashboard run-detail job DTO shape. */
+export declare function buildRunDetailJobs(jobs: RunDetailJobRow[], lookups: RunDetailJobLookups): {
+    needs: {
+        upstreamName: string;
+        runOn: ExecutionJobStatus[];
+    }[] | null;
+    steps: {
+        groupId?: string | undefined;
+        concurrencyKind?: string | undefined;
+        driftSummary?: string | undefined;
+        checkOutcome?: string | undefined;
+        secretsAccessed: string | null;
+        stepType?: string | undefined;
+        stepIndex: number;
+        stepName: string;
+        status: string;
+        startedAt: number | null;
+        completedAt: number | null;
+        durationMs: number | null;
+        exitCode: number | null;
+        errorMessage: string | null;
+    }[];
+    initFailure?: {
+        scope: "run" | "job";
+        category: "secret_resolution" | "install_secrets" | "lock_resolution" | "build_coordination" | "environment_rules" | "dynamic_eval" | "no_agent" | "matrix_expansion";
+        message: string;
+        jobName?: string | undefined;
+    } | undefined;
+    jobId: string;
+    jobName: string;
+    status: string;
+    matrixValues: Record<string, unknown> | null;
+    baseJobName: string | null;
+    variantKind: string | null;
+    variantLabel: string | null;
+    startedAt: number | null;
+    completedAt: number | null;
+    durationMs: number | null;
+    agentId: string | null;
+    orchestratorId: null;
+    errorMessage: string | null;
+    runsOnLabels: string[] | null;
+    environments: string[] | null;
+    outputs: any;
+    secretOutputKeys: string[] | null;
+}[];
+/** A dashboard-shaped run-detail job (epoch-ms timestamps). */
+export type CanonicalRunDetailJob = ReturnType<typeof buildRunDetailJobs>[number];
+/**
+ * Canonical run detail: the run header (raw `Date` timestamps) plus the
+ * dashboard-shaped nested jobs. The agent mapper formats timestamps to ISO and
+ * wraps untrusted fields; the dashboard handler consumes `buildRunDetailJobs`
+ * directly.
+ */
+export interface CanonicalRunDetail {
+    runId: string;
+    workflowName: string;
+    status: string;
+    provider: string;
+    repoIdentifier: string;
+    ref: string;
+    sha: string;
+    /** Best-effort base commit from provider context; null when unavailable. */
+    baseSha: string | null;
+    startedAt: Date | null;
+    completedAt: Date | null;
+    durationMs: number | null;
+    trustTier: string | null;
+    contributorUsername: string | null;
+    triggeredBy: string | null;
+    failureReason: string | null;
+    /** Run-scoped init failure (the run never executed a step). */
+    initFailure: InitFailure | null;
+    routingKey: string | null;
+    jobs: CanonicalRunDetailJob[];
+}
+/**
+ * Aggregate a run into the canonical nested detail (warm path). Returns null
+ * when the run row is absent in PostgreSQL.
+ */
+export declare function aggregateRunDetail(db: Kysely<Database>, runId: string): Promise<CanonicalRunDetail | null>;
+//# sourceMappingURL=run-aggregator.d.ts.map

package/dist/reporting/step-log-reader.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Shared step-log reader for the agent-facing step-logs endpoint.
+ *
+ * Resolves a step's stored log file via the same `execution_steps.log_path` +
+ * `LogStorage` access the dashboard step.logs path uses, then returns the lines
+ * with line-based cursor pagination. `toAgentStepLogs` wraps every line in an
+ * untrusted envelope (log content is process/user output — never trusted).
+ */
+import type { Kysely } from 'kysely';
+import { type AgentStepLogs } from '@kici-dev/engine';
+import type { Database } from '../db/types.js';
+import type { LogStorage } from './log-storage.js';
+export interface StepLogReaderDeps {
+    db: Kysely<Database>;
+    logStorage: LogStorage;
+}
+export interface RawStepLogs {
+    lines: string[];
+    totalLines: number;
+    nextCursor: string | null;
+}
+export interface ReadStepLogArgs {
+    runId: string;
+    jobId: string;
+    stepIndex: number;
+    /** Stringified line offset to start from (0-based). Default 0. */
+    cursor?: string;
+    /** Max number of lines to return. Default 500, hard cap applied by caller. */
+    limit?: number;
+}
+/**
+ * Read a page of a step's log lines. Returns an empty page (not an error) when
+ * the step row or its log file is absent, so a never-emitted-logs step reads as
+ * `{ lines: [], totalLines: 0, nextCursor: null }`.
+ */
+export declare function readStepLogLines(deps: StepLogReaderDeps, args: ReadStepLogArgs): Promise<RawStepLogs>;
+/** Wrap raw step logs into the untrusted-tagged `AgentStepLogs` shape. */
+export declare function toAgentStepLogs(runId: string, jobId: string, stepIndex: number, raw: RawStepLogs): AgentStepLogs;
+//# sourceMappingURL=step-log-reader.d.ts.map

package/dist/routes/admin-registrations.d.ts

@@ -10,6 +10,7 @@ import type { RegistrationStore } from '../registration/registration-store.js';
 import type { RegistrationIndex } from '../registration/registration-index.js';
 import type { TokenManager } from '../secrets/token-manager.js';
 import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { EnvironmentStore } from '../environments/environment-store.js';
 /**
  * Dependencies for admin registration routes.
  */
@@ -18,6 +19,13 @@ export interface AdminRegistrationRoutesDeps {
     registrationIndex: RegistrationIndex;
     tokenManager: TokenManager;
     rbac: RbacEnforcer;
+    /**
+     * Resolves a bound environment by name for registration-time satisfiability.
+     * When present, a manual registration is rejected up front if a job binds a
+     * provably-unsatisfiable environment list (missing/disabled env, or
+     * mutually-exclusive fixed branch/trigger/repo restrictions).
+     */
+    environmentStore?: Pick<EnvironmentStore, 'matchEnvironment'>;
 }
 /** Hono env type for admin registration routes with context variables. */
 type AdminRegEnv = {

package/dist/routes/admin-runs.d.ts

@@ -24,6 +24,7 @@ import type { Database } from '../db/types.js';
 import type { TokenManager } from '../secrets/token-manager.js';
 import type { RbacEnforcer, Role } from '../secrets/rbac.js';
 import type { AuditLogger } from '../secrets/audit-logger.js';
+import type { LogStorage } from '../reporting/log-storage.js';
 /**
  * Dependencies for admin run routes.
  */
@@ -38,6 +39,12 @@ export interface AdminRunRoutesDeps {
      * secret-output plaintext. Derived once per request via deriveKey().
      */
     masterSecretKey?: string;
+    /**
+     * Log storage backend. Required only by the agent step-logs endpoint
+     * (`/runs/:runId/jobs/:jobId/steps/:stepIndex/logs`); when absent, that
+     * path 503s cleanly.
+     */
+    logStorage?: LogStorage;
 }
 /** Hono env type for admin run routes with context variables. */
 type AdminRunEnv = {

package/dist/secrets/index.d.ts

@@ -7,7 +7,7 @@
 export { PgSecretStore } from './pg-secret-store.js';
 export { AuditLogger } from './audit-logger.js';
 export { loadMasterKey, loadOldMasterKey, loadSecretStoreConfig, type SecretStoreConfig, } from './config.js';
-export { encrypt, decrypt, deriveKey, generateMasterKey, type EncryptedValue } from './crypto.js';
+export { encrypt, decrypt, deriveKey, generateMasterKey, type EncryptedValue, } from '@kici-dev/shared';
 export { VaultSecretStore, type VaultConfig } from './vault-secret-store.js';
 export { SecretResolver, type SecretResolverDeps, type ResolvedSecretMeta, type EnvironmentStoreLike, type BindingStoreLike, type SecretStoreLike, } from './secret-resolver.js';
 export { BackendSyncManager } from './backend-sync.js';