@kici-dev/orchestrator 0.1.23 → 0.1.25

package/dist/agent/token-store.d.ts

@@ -19,11 +19,15 @@ export declare class AgentTokenStore {
      * Static tokens have no expiry and are intended for manually-registered agents.
      *
      * @param opts.labels - Optional agent labels this token is authorized for.
+     * @param opts.mandatoryLabels - Optional taint labels (a Kubernetes-taint-style
+     *   gate): a static agent registering with this token only accepts a job when
+     *   every label here appears in the job's required labels. Undefined = no taint.
      * @param opts.createdBy - Optional creator identifier (e.g. "cli:admin").
      * @returns The plaintext token (shown once) and the DB row ID.
      */
     createStatic(opts: {
         labels?: string[];
+        mandatoryLabels?: string[];
         createdBy?: string;
     }): Promise<{
         token: string;

package/dist/app.d.ts

@@ -37,6 +37,7 @@ import type { PendingBuildTracker } from './cache/index.js';
 import type { PendingInitTracker } from './cache/index.js';
 import type { PendingDynamicTracker } from './cache/index.js';
 import type { CacheStorage } from './storage/types.js';
+import type { ProvenanceTrustRoot } from './provenance/trust-root.js';
 import { type CheckRunReporter } from './reporting/check-run-reporter.js';
 import type { ExecutionTracker } from './reporting/execution-tracker.js';
 import type { LogWriter } from './reporting/log-writer.js';
@@ -53,6 +54,8 @@ import type { FleetAgentCollector } from './ws/fleet-agent-collector.js';
 import type { FleetTopology } from './diagnostics/fleet-topology.js';
 import type { TokenManager } from './secrets/token-manager.js';
 import type { SecretResolver } from './secrets/secret-resolver.js';
+import type { VerifyInboundDeps } from './webhook/verify-inbound.js';
+import type { SourceStore } from './sources/source-store.js';
 import { type AdminRouteDeps } from './routes/admin.js';
 import type { RegistrationStore } from './registration/registration-store.js';
 import type { RegistrationIndex } from './registration/registration-index.js';
@@ -82,6 +85,12 @@ export interface AppDependencies {
     db: Kysely<Database>;
     pool: pg.Pool;
     registry: AgentRegistry;
+    /**
+     * Warmth latch surfaced on `GET /ready`. Returns `true` only once the
+     * orchestrator boot sequence has finished. When provided, `/ready` returns
+     * `503` until boot completes. Absent → warm defaults to `true`.
+     */
+    isWarm?: () => boolean;
     /** Host roster store for runsOnAll fan-out resolution. */
     hostRosterStore?: HostRosterStore;
     dispatcher: Dispatcher;
@@ -90,6 +99,19 @@ export interface AppDependencies {
     lockFileCache: LockFileCache;
     providerRegistry: ProviderRegistry;
     platformClient?: PlatformClient;
+    /**
+     * Fulfil deferred attestations on demand (mints in this process, which owns
+     * the Platform WS). Backs `POST /api/v1/admin/attestations/retry`. Wired only
+     * in coordinator mode where the retrier exists.
+     */
+    retryAttestations?: (opts: {
+        runId?: string;
+        includeRejected?: boolean;
+    }) => Promise<{
+        minted: number;
+        stillPending: number;
+        rejected: number;
+    }>;
     scalerManager?: ScalerManager;
     /** Bundle cache for compiled workflow bundles. Optional — requires S3 storage. */
     sourceCache?: SourceCache;
@@ -108,6 +130,8 @@ export interface AppDependencies {
     dispatchCacheRefs?: DispatchCacheRefTracker;
     /** Cache storage backend (S3) for metadata operations on upload completion. */
     cacheStorage?: CacheStorage;
+    /** Provenance trust root used to verify build-provenance bundles at ingest. */
+    provenanceTrustRoot?: ProvenanceTrustRoot;
     /**
      * Filesystem cache backend handle. Only set when KICI_STORAGE_TYPE is
      * `filesystem`. Drives the /api/v1/cache/blob/* HTTP route that serves and
@@ -166,6 +190,9 @@ export interface AppDependencies {
     eventEmitter?: EventEmitter;
     /** Generic webhook source manager. Optional -- if not set, generic webhooks are disabled. */
     genericSourceManager?: GenericSourceManager;
+    /** GitHub direct-ingress route deps (hybrid/independent only). Optional -- if not set, the direct GitHub ingress route is not mounted. */
+    githubSourceStore?: SourceStore;
+    githubVerifyDeps?: VerifyInboundDeps;
     /** Trust store for cross-repo event trust. Optional -- if not set, trust management admin routes are unavailable. */
     trustStore?: TrustStore;
     /** Observer registry for broadcasting status/log updates to CLI observers. Optional -- if not set, observer features are inactive. */

package/dist/audit/access-log.d.ts

@@ -36,6 +36,10 @@ export interface AccessLogQueryFilter {
     toTimestamp?: Date | string;
     /** Full-text search over error_message (trigram-indexed). */
     q?: string;
+    /** Exact-match filter on the agent provenance label (`agent_label` column). */
+    agentLabel?: string;
+    /** When true, return only agent-attributed rows (`agent_label IS NOT NULL`). */
+    agentOnly?: boolean;
     limit?: number;
     cursor?: string;
 }

package/dist/cache/pending-inits.d.ts

@@ -3,13 +3,14 @@
  *
  * The orchestrator dispatches an init job for dynamic environment resolution
  * and waits for the agent to return the resolved field values
- * (environmentName, env, concurrencyGroup). The underlying tracker logic lives
+ * (environmentNames, env, concurrencyGroup). The underlying tracker logic lives
  * in `PendingTracker<InitResult>`; this subclass wires the init-specific
  * logger prefix and disconnect error.
  */
 import { PendingTracker } from './pending-tracker.js';
 export interface InitResult {
-    environmentName?: string;
+    /** Resolved bound-environment names, in merge order (one per `environments` element). */
+    environmentNames?: string[];
     env?: Record<string, string>;
     concurrencyGroup?: string;
     /**

package/dist/cancel/cancel-run.d.ts

@@ -33,6 +33,8 @@ export interface CancelRunOptions {
     force?: boolean;
     /** Attribution stamped into execution_runs.cancelled_by. */
     cancelledBy?: string;
+    /** Agent provenance label stamped into execution_runs.cancelled_by_agent_label. */
+    cancelledByAgentLabel?: string | null;
 }
 export interface CancelRunResult {
     /** Number of `job.cancel` messages dispatched to agents (running jobs). */

package/dist/cli/api-client.d.ts

@@ -206,6 +206,7 @@ export declare class AdminApiClient {
     revokeToken(id: string): Promise<void>;
     createAgentToken(opts: {
         labels?: string[];
+        mandatoryLabels?: string[];
     }): Promise<{
         id: string;
         token: string;
@@ -373,6 +374,13 @@ export declare class AdminApiClient {
     }): Promise<{
         jobs: Array<Record<string, unknown>>;
     }>;
+    /**
+     * Fetch the machine-first, provenance-tagged structured run result: typed
+     * job DAG, per-step exit codes / durations / statuses, derived failure
+     * category. Untrusted fields are envelope-tagged; secret values are never
+     * returned (only secret-output key names).
+     */
+    getRunStructured(runId: string): Promise<Record<string, unknown>>;
     /**
      * Fetch the scrub status of the run's ephemeral key. Never returns the
      * key material itself — only `{ exists, createdAt }`.
@@ -436,6 +444,8 @@ export declare class AdminApiClient {
         from?: string;
         to?: string;
         q?: string;
+        agentLabel?: string;
+        agentOnly?: boolean;
         limit?: number;
         cursor?: string;
     }): Promise<{

package/dist/cli/commands/attestations-list.d.ts

@@ -0,0 +1,49 @@
+/**
+ * `kici-admin attestations list` runner — a read-only projection of the
+ * orchestrator `attestations` table into a JSON envelope mirroring
+ * `runs list --json`'s shape. The DB read is injected so the row→envelope
+ * mapping is unit-testable without a Postgres connection (mirrors
+ * attestations-retry.ts's injected-transport pattern).
+ */
+import type { Kysely } from 'kysely';
+import type { Database } from '../../db/types.js';
+/** One attestation row as read from the orchestrator DB (snake_case columns). */
+export interface AttestationListDbRow {
+    id: string;
+    run_id: string;
+    job_id: string;
+    subject_name: string;
+    verify_status: string;
+    created_at: Date;
+}
+/** One attestation as rendered in the CLI JSON envelope (camelCase). */
+export interface AttestationListItem {
+    id: string;
+    runId: string;
+    jobId: string;
+    subjectName: string;
+    verifyStatus: string;
+    createdAt: string;
+}
+/** Scope + bound for a list read. Filters are applied by the read fn. */
+export interface AttestationListOptions {
+    limit: number;
+    runId?: string;
+    jobId?: string;
+}
+/** The `--json` envelope (mirrors `runs list --json`'s `{ runs: [...] }`). */
+export interface AttestationListResult {
+    attestations: AttestationListItem[];
+}
+/**
+ * Map the injected DB read into the CLI envelope. `limit` / `runId` / `jobId`
+ * are honored by the injected `read` fn (the real one is a Kysely query); this
+ * runner owns only the row→envelope projection, so it stays pure and testable.
+ */
+export declare function runAttestationList(read: (opts: AttestationListOptions) => Promise<AttestationListDbRow[]>, opts: AttestationListOptions): Promise<AttestationListResult>;
+/**
+ * Build the real DB read: a Kysely query over `attestations`, newest first,
+ * with optional run/job filters and a row cap.
+ */
+export declare function readAttestations(db: Kysely<Database>): (opts: AttestationListOptions) => Promise<AttestationListDbRow[]>;
+//# sourceMappingURL=attestations-list.d.ts.map

package/dist/cli/commands/attestations-retry.d.ts

@@ -0,0 +1,28 @@
+/**
+ * `kici-admin attestations retry` runner. Triggers an immediate drain of the
+ * deferred-attestation outbox on the running orchestrator via the admin API —
+ * minting happens in the orchestrator process, which owns the authenticated
+ * Platform WebSocket. `--run-id` scopes to one run; otherwise the whole outbox
+ * drains (the `--all-pending` flag is the explicit form of the default).
+ */
+export interface AttestationRetryOptions {
+    runId?: string;
+    allPending?: boolean;
+    includeRejected?: boolean;
+}
+export interface AttestationRetryResult {
+    minted: number;
+    stillPending: number;
+    rejected: number;
+}
+/**
+ * Post the retry request through the injected transport (the admin API POST)
+ * and return the counts. Validates that the scope is unambiguous. When
+ * `includeRejected` is set, previously terminally-rejected rows are re-armed
+ * and re-attempted in the same drain.
+ */
+export declare function runAttestationRetry(post: (body: {
+    runId?: string;
+    includeRejected?: boolean;
+}) => Promise<AttestationRetryResult>, opts: AttestationRetryOptions): Promise<AttestationRetryResult>;
+//# sourceMappingURL=attestations-retry.d.ts.map

package/dist/cli/commands/attestations-reverify.d.ts

@@ -0,0 +1,18 @@
+import type { Kysely } from 'kysely';
+import type { Database } from '../../db/types.js';
+import type { CacheStorage } from '../../storage/types.js';
+import type { ProvenanceTrustRoot } from '../../provenance/trust-root.js';
+/**
+ * Backfill / refresh attestation verdicts. By default it re-evaluates only rows
+ * that have no usable verdict yet (`pending` / `unverifiable`) — the rollout
+ * path for rows recorded before verify-at-ingest, or before an org configured
+ * provenance. With `--all` it re-evaluates every row. Idempotent: re-running
+ * over already-verified rows (when `--all`) recomputes the same verdict.
+ */
+export declare function reverifyAttestations(db: Kysely<Database>, trustRoot: ProvenanceTrustRoot, storage: CacheStorage | undefined, opts: {
+    all: boolean;
+}): Promise<{
+    updated: number;
+    scanned: number;
+}>;
+//# sourceMappingURL=attestations-reverify.d.ts.map

package/dist/cli/commands/attestations.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from 'commander';
+import type { AdminApiClient } from '../api-client.js';
+export declare function registerAttestationsCommands(program: Command, getClient: () => AdminApiClient): void;
+//# sourceMappingURL=attestations.d.ts.map

package/dist/cli/commands/cluster.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+export declare function registerClusterCommands(program: Command): void;
+//# sourceMappingURL=cluster.d.ts.map

package/dist/cli/commands/shared/versioned-upgrade.d.ts

@@ -27,6 +27,7 @@ interface VersionedUpgradeOptions {
     yes?: boolean;
     cleanup?: boolean;
     rollback?: boolean;
+    pick?: boolean;
     force?: boolean;
 }
 /**
@@ -74,6 +75,40 @@ export declare function resolveUpgradeTarget(args: {
  *   - windows:           C:\Program Files\KiCI\<name>\
  */
 export declare function getInstallBase(platform: ServicePlatform, name: string): string;
+/** A choice row for the `--pick` interactive select. */
+export interface PickChoice {
+    value: string;
+    name: string;
+    /** `false` when selectable; a reason string when disabled (inquirer renders it). */
+    disabled: boolean | string;
+}
+/**
+ * Build the interactive `--pick` choices, newest-first (lexicographic, matching
+ * the rest of the versioned-directory handling). The currently-active version is
+ * labeled `(current)` and disabled so it cannot be selected — picking it would be
+ * a no-op restart.
+ */
+export declare function buildPickChoices(versions: string[], current: string | null): PickChoice[];
+/**
+ * The versions a `--pick` switch may target: every installed version except the
+ * currently-active one. Empty when only the current version (or nothing) is
+ * installed — the caller turns that into a "nothing to pick" error.
+ */
+export declare function selectablePickTargets(versions: string[], current: string | null): string[];
+/**
+ * Validate that `--pick` is not combined with a source/mode flag it conflicts
+ * with. `--pick` activates an already-installed version, so it never downloads
+ * (`--from`/`--url`), never takes an explicit `--version`, and is its own mode
+ * (not `--rollback`/`--cleanup`). Returns an error message, or null when OK.
+ */
+export declare function checkPickFlagConflicts(opts: {
+    pick?: boolean;
+    from?: string;
+    url?: string;
+    version?: string;
+    rollback?: boolean;
+    cleanup?: boolean;
+}): string | null;
 /**
  * Perform a versioned directory upgrade for a KiCI component.
  *
@@ -123,5 +158,22 @@ export declare function verifyNpmSourceLaunch(opts: {
     force: boolean;
 }): NpmSourceLaunchVerdict;
 export declare function performVersionedUpgrade(component: UpgradeComponent, opts: VersionedUpgradeOptions): Promise<void>;
+/**
+ * Stop the service, switch the active version pointer to an already-installed
+ * versioned directory (atomic symlink on Unix; uninstall→install + version file
+ * on Windows), restart, and persist the new `kiciVersion` into the manifest.
+ *
+ * Shared by `--rollback` (switch to the previous version) and `--pick` (switch
+ * to any chosen installed version).
+ */
+export declare function switchToInstalledVersion(args: {
+    component: UpgradeComponent;
+    platform: ServicePlatform;
+    installBase: string;
+    config: ServiceConfig;
+    manager: ServiceManager;
+    resolvedInstance: ResolvedInstance;
+    targetVersion: string;
+}): Promise<void>;
 export {};
 //# sourceMappingURL=versioned-upgrade.d.ts.map

package/dist/cli/local-github-ingress-url.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Build the orchestrator's OWN direct GitHub ingress URL for a source, from
+ * the configured public base (`KICI_WEBHOOK_PUBLIC_URL`). Returns null when no
+ * public base is configured (the CLI then prints an honest "set
+ * KICI_WEBHOOK_PUBLIC_URL" note instead of a fabricated URL).
+ */
+export declare function buildLocalGithubIngressUrl(webhookPublicUrl: string | undefined, orgId: string, sourceId: string): string | null;
+//# sourceMappingURL=local-github-ingress-url.d.ts.map