@kici-dev/orchestrator 0.1.23 → 0.1.25

package/dist/reporting/step-log-reader.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Shared step-log reader for the agent-facing step-logs endpoint.
+ *
+ * Resolves a step's stored log file via the same `execution_steps.log_path` +
+ * `LogStorage` access the dashboard step.logs path uses, then returns the lines
+ * with line-based cursor pagination. `toAgentStepLogs` wraps every line in an
+ * untrusted envelope (log content is process/user output — never trusted).
+ */
+import type { Kysely } from 'kysely';
+import { type AgentStepLogs } from '@kici-dev/engine';
+import type { Database } from '../db/types.js';
+import type { LogStorage } from './log-storage.js';
+export interface StepLogReaderDeps {
+    db: Kysely<Database>;
+    logStorage: LogStorage;
+}
+export interface RawStepLogs {
+    lines: string[];
+    totalLines: number;
+    nextCursor: string | null;
+}
+export interface ReadStepLogArgs {
+    runId: string;
+    jobId: string;
+    stepIndex: number;
+    /** Stringified line offset to start from (0-based). Default 0. */
+    cursor?: string;
+    /** Max number of lines to return. Default 500, hard cap applied by caller. */
+    limit?: number;
+}
+/**
+ * Read a page of a step's log lines. Returns an empty page (not an error) when
+ * the step row or its log file is absent, so a never-emitted-logs step reads as
+ * `{ lines: [], totalLines: 0, nextCursor: null }`.
+ */
+export declare function readStepLogLines(deps: StepLogReaderDeps, args: ReadStepLogArgs): Promise<RawStepLogs>;
+/** Wrap raw step logs into the untrusted-tagged `AgentStepLogs` shape. */
+export declare function toAgentStepLogs(runId: string, jobId: string, stepIndex: number, raw: RawStepLogs): AgentStepLogs;
+//# sourceMappingURL=step-log-reader.d.ts.map

package/dist/routes/admin-access-log.d.ts

@@ -8,7 +8,8 @@
  *
  *   GET /api/v1/admin/access-log
  *     Filters: orgId, actorType, actorId, action, source, outcome,
- *              targetType, targetId, from, to, limit, cursor
+ *              targetType, targetId, from, to, q, agentLabel, agentOnly,
+ *              limit, cursor
  *     Requires: access_log.read
  *
  *   GET /api/v1/admin/access-log/:id

package/dist/routes/admin-registrations.d.ts

@@ -10,6 +10,7 @@ import type { RegistrationStore } from '../registration/registration-store.js';
 import type { RegistrationIndex } from '../registration/registration-index.js';
 import type { TokenManager } from '../secrets/token-manager.js';
 import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { EnvironmentStore } from '../environments/environment-store.js';
 /**
  * Dependencies for admin registration routes.
  */
@@ -18,6 +19,13 @@ export interface AdminRegistrationRoutesDeps {
     registrationIndex: RegistrationIndex;
     tokenManager: TokenManager;
     rbac: RbacEnforcer;
+    /**
+     * Resolves a bound environment by name for registration-time satisfiability.
+     * When present, a manual registration is rejected up front if a job binds a
+     * provably-unsatisfiable environment list (missing/disabled env, or
+     * mutually-exclusive fixed branch/trigger/repo restrictions).
+     */
+    environmentStore?: Pick<EnvironmentStore, 'matchEnvironment'>;
 }
 /** Hono env type for admin registration routes with context variables. */
 type AdminRegEnv = {

package/dist/routes/admin-runs.d.ts

@@ -24,6 +24,7 @@ import type { Database } from '../db/types.js';
 import type { TokenManager } from '../secrets/token-manager.js';
 import type { RbacEnforcer, Role } from '../secrets/rbac.js';
 import type { AuditLogger } from '../secrets/audit-logger.js';
+import type { LogStorage } from '../reporting/log-storage.js';
 /**
  * Dependencies for admin run routes.
  */
@@ -38,6 +39,12 @@ export interface AdminRunRoutesDeps {
      * secret-output plaintext. Derived once per request via deriveKey().
      */
     masterSecretKey?: string;
+    /**
+     * Log storage backend. Required only by the agent step-logs endpoint
+     * (`/runs/:runId/jobs/:jobId/steps/:stepIndex/logs`); when absent, that
+     * path 503s cleanly.
+     */
+    logStorage?: LogStorage;
 }
 /** Hono env type for admin run routes with context variables. */
 type AdminRunEnv = {

package/dist/routes/admin.d.ts

@@ -113,6 +113,20 @@ export interface AdminRouteDeps {
      * write is best-effort, never gating.
      */
     accessLog?: AccessLogWriter;
+    /**
+     * Optional -- fulfil deferred attestations on demand (mints in the running
+     * orchestrator process, which owns the Platform WS). Backs
+     * `POST /api/v1/admin/attestations/retry` (the `kici-admin attestations retry`
+     * command). Unset on a WS-only / non-coordinator admin.
+     */
+    retryAttestations?: (opts: {
+        runId?: string;
+        includeRejected?: boolean;
+    }) => Promise<{
+        minted: number;
+        stillPending: number;
+        rejected: number;
+    }>;
 }
 /** Hono env type for admin routes with context variables. */
 type AdminEnv = {

package/dist/routes/github-webhook.d.ts

@@ -0,0 +1,37 @@
+import { Hono } from 'hono';
+import type { WebhookInfo } from '../webhook/handler.js';
+import type { SourceStore } from '../sources/source-store.js';
+import { type VerifyInboundDeps } from '../webhook/verify-inbound.js';
+import { WebhookIngestOutcome } from '../pipeline/process-webhook.js';
+/** Dependencies for the direct GitHub webhook ingress route. */
+export interface GithubWebhookRoutesDeps {
+    /** Local source lookup (by UUID). */
+    sourceStore: SourceStore;
+    /** Inbound verification deps (db + secret store + generic source manager). */
+    verifyDeps: VerifyInboundDeps;
+    /** Pipeline entry — owns the atomic dedup claim + dispatch. */
+    onWebhook: (info: WebhookInfo) => Promise<WebhookIngestOutcome>;
+}
+/**
+ * Whether the orchestrator serves the direct GitHub ingress route for a given
+ * operating mode. Hybrid + independent run local source config; platform mode
+ * is relay-only (no local GitHub source to serve).
+ */
+export declare function shouldServeGithubIngress(mode: 'platform' | 'hybrid' | 'independent'): boolean;
+/**
+ * Direct GitHub-App webhook ingress: `POST /webhook/:orgId/github/:sourceId`.
+ *
+ * Bypasses the Platform relay. Handles both operator topologies on one route:
+ *  - App-level repoint: the App's single webhook URL points here, so GitHub
+ *    sends `X-GitHub-Hook-Installation-Target-Type: integration` +
+ *    `-Target-ID: <appId>` — validated against the source's routing key.
+ *  - Classic per-repo webhook: a repo-level hook points here with no App
+ *    target headers — `:sourceId` already identifies the source, so the
+ *    App-header check is skipped.
+ *
+ * Verification is the existing local `verify-inbound.ts` GitHub path (secret
+ * read from the orchestrator secret store; rotation-aware). Dedup + dispatch
+ * are the universal `processWebhook` pipeline via `onWebhook`.
+ */
+export declare function createGithubWebhookRoutes(deps: GithubWebhookRoutesDeps): Hono;
+//# sourceMappingURL=github-webhook.d.ts.map

package/dist/routes/health.d.ts

@@ -3,6 +3,15 @@ import type { Database } from '../db/types.js';
 export interface HealthRoutesDeps {
     /** Optional DB instance for readiness checks */
     db?: Kysely<Database>;
+    /**
+     * Optional warmth latch. Returns `true` only once the orchestrator boot
+     * sequence has finished (all subsystems started, HTTP server serving). When
+     * provided, `/ready` returns `503` until it flips `true`, so a caller can
+     * gate on the orchestrator being ready to serve rather than merely live.
+     * Absent → warm defaults to `true` (callers that don't wire the latch are
+     * unaffected).
+     */
+    isWarm?: () => boolean;
 }
 /**
  * Create orchestrator health routes with database readiness check.

package/dist/routes/webhooks.d.ts

@@ -1,17 +1,15 @@
 import { Hono } from 'hono';
-import type { DedupCache } from '../webhook/dedup.js';
 import type { WebhookInfo } from '../webhook/handler.js';
 import type { GenericSourceManager } from '../webhook/generic-sources.js';
+import { WebhookIngestOutcome } from '../pipeline/process-webhook.js';
 /**
  * Dependencies for generic webhook routes.
  */
 export interface GenericWebhookRoutesDeps {
     /** Generic source manager for source lookup and validation */
     sourceManager: GenericSourceManager;
-    /** Delivery ID deduplication cache */
-    dedup: DedupCache;
     /** Processing callback -- connects to the trigger matching pipeline */
-    onWebhook: (info: WebhookInfo) => Promise<void>;
+    onWebhook: (info: WebhookInfo) => Promise<WebhookIngestOutcome>;
 }
 /**
  * Create generic webhook routes for non-GitHub webhook ingestion.

package/dist/secrets/index.d.ts

@@ -7,7 +7,7 @@
 export { PgSecretStore } from './pg-secret-store.js';
 export { AuditLogger } from './audit-logger.js';
 export { loadMasterKey, loadOldMasterKey, loadSecretStoreConfig, type SecretStoreConfig, } from './config.js';
-export { encrypt, decrypt, deriveKey, generateMasterKey, type EncryptedValue } from './crypto.js';
+export { encrypt, decrypt, deriveKey, generateMasterKey, type EncryptedValue, } from '@kici-dev/shared';
 export { VaultSecretStore, type VaultConfig } from './vault-secret-store.js';
 export { SecretResolver, type SecretResolverDeps, type ResolvedSecretMeta, type EnvironmentStoreLike, type BindingStoreLike, type SecretStoreLike, } from './secret-resolver.js';
 export { BackendSyncManager } from './backend-sync.js';