@kici-dev/orchestrator 0.1.24 → 0.1.25

package/dist/app.d.ts

@@ -54,6 +54,8 @@ import type { FleetAgentCollector } from './ws/fleet-agent-collector.js';
 import type { FleetTopology } from './diagnostics/fleet-topology.js';
 import type { TokenManager } from './secrets/token-manager.js';
 import type { SecretResolver } from './secrets/secret-resolver.js';
+import type { VerifyInboundDeps } from './webhook/verify-inbound.js';
+import type { SourceStore } from './sources/source-store.js';
 import { type AdminRouteDeps } from './routes/admin.js';
 import type { RegistrationStore } from './registration/registration-store.js';
 import type { RegistrationIndex } from './registration/registration-index.js';
@@ -83,6 +85,12 @@ export interface AppDependencies {
     db: Kysely<Database>;
     pool: pg.Pool;
     registry: AgentRegistry;
+    /**
+     * Warmth latch surfaced on `GET /ready`. Returns `true` only once the
+     * orchestrator boot sequence has finished. When provided, `/ready` returns
+     * `503` until boot completes. Absent → warm defaults to `true`.
+     */
+    isWarm?: () => boolean;
     /** Host roster store for runsOnAll fan-out resolution. */
     hostRosterStore?: HostRosterStore;
     dispatcher: Dispatcher;
@@ -91,6 +99,19 @@ export interface AppDependencies {
     lockFileCache: LockFileCache;
     providerRegistry: ProviderRegistry;
     platformClient?: PlatformClient;
+    /**
+     * Fulfil deferred attestations on demand (mints in this process, which owns
+     * the Platform WS). Backs `POST /api/v1/admin/attestations/retry`. Wired only
+     * in coordinator mode where the retrier exists.
+     */
+    retryAttestations?: (opts: {
+        runId?: string;
+        includeRejected?: boolean;
+    }) => Promise<{
+        minted: number;
+        stillPending: number;
+        rejected: number;
+    }>;
     scalerManager?: ScalerManager;
     /** Bundle cache for compiled workflow bundles. Optional — requires S3 storage. */
     sourceCache?: SourceCache;
@@ -169,6 +190,9 @@ export interface AppDependencies {
     eventEmitter?: EventEmitter;
     /** Generic webhook source manager. Optional -- if not set, generic webhooks are disabled. */
     genericSourceManager?: GenericSourceManager;
+    /** GitHub direct-ingress route deps (hybrid/independent only). Optional -- if not set, the direct GitHub ingress route is not mounted. */
+    githubSourceStore?: SourceStore;
+    githubVerifyDeps?: VerifyInboundDeps;
     /** Trust store for cross-repo event trust. Optional -- if not set, trust management admin routes are unavailable. */
     trustStore?: TrustStore;
     /** Observer registry for broadcasting status/log updates to CLI observers. Optional -- if not set, observer features are inactive. */

package/dist/audit/access-log.d.ts

@@ -36,6 +36,10 @@ export interface AccessLogQueryFilter {
     toTimestamp?: Date | string;
     /** Full-text search over error_message (trigram-indexed). */
     q?: string;
+    /** Exact-match filter on the agent provenance label (`agent_label` column). */
+    agentLabel?: string;
+    /** When true, return only agent-attributed rows (`agent_label IS NOT NULL`). */
+    agentOnly?: boolean;
     limit?: number;
     cursor?: string;
 }

package/dist/cancel/cancel-run.d.ts

@@ -33,6 +33,8 @@ export interface CancelRunOptions {
     force?: boolean;
     /** Attribution stamped into execution_runs.cancelled_by. */
     cancelledBy?: string;
+    /** Agent provenance label stamped into execution_runs.cancelled_by_agent_label. */
+    cancelledByAgentLabel?: string | null;
 }
 export interface CancelRunResult {
     /** Number of `job.cancel` messages dispatched to agents (running jobs). */

package/dist/cli/api-client.d.ts

@@ -444,6 +444,8 @@ export declare class AdminApiClient {
         from?: string;
         to?: string;
         q?: string;
+        agentLabel?: string;
+        agentOnly?: boolean;
         limit?: number;
         cursor?: string;
     }): Promise<{

package/dist/cli/commands/attestations-list.d.ts

@@ -0,0 +1,49 @@
+/**
+ * `kici-admin attestations list` runner — a read-only projection of the
+ * orchestrator `attestations` table into a JSON envelope mirroring
+ * `runs list --json`'s shape. The DB read is injected so the row→envelope
+ * mapping is unit-testable without a Postgres connection (mirrors
+ * attestations-retry.ts's injected-transport pattern).
+ */
+import type { Kysely } from 'kysely';
+import type { Database } from '../../db/types.js';
+/** One attestation row as read from the orchestrator DB (snake_case columns). */
+export interface AttestationListDbRow {
+    id: string;
+    run_id: string;
+    job_id: string;
+    subject_name: string;
+    verify_status: string;
+    created_at: Date;
+}
+/** One attestation as rendered in the CLI JSON envelope (camelCase). */
+export interface AttestationListItem {
+    id: string;
+    runId: string;
+    jobId: string;
+    subjectName: string;
+    verifyStatus: string;
+    createdAt: string;
+}
+/** Scope + bound for a list read. Filters are applied by the read fn. */
+export interface AttestationListOptions {
+    limit: number;
+    runId?: string;
+    jobId?: string;
+}
+/** The `--json` envelope (mirrors `runs list --json`'s `{ runs: [...] }`). */
+export interface AttestationListResult {
+    attestations: AttestationListItem[];
+}
+/**
+ * Map the injected DB read into the CLI envelope. `limit` / `runId` / `jobId`
+ * are honored by the injected `read` fn (the real one is a Kysely query); this
+ * runner owns only the row→envelope projection, so it stays pure and testable.
+ */
+export declare function runAttestationList(read: (opts: AttestationListOptions) => Promise<AttestationListDbRow[]>, opts: AttestationListOptions): Promise<AttestationListResult>;
+/**
+ * Build the real DB read: a Kysely query over `attestations`, newest first,
+ * with optional run/job filters and a row cap.
+ */
+export declare function readAttestations(db: Kysely<Database>): (opts: AttestationListOptions) => Promise<AttestationListDbRow[]>;
+//# sourceMappingURL=attestations-list.d.ts.map

package/dist/cli/commands/attestations-retry.d.ts

@@ -0,0 +1,28 @@
+/**
+ * `kici-admin attestations retry` runner. Triggers an immediate drain of the
+ * deferred-attestation outbox on the running orchestrator via the admin API —
+ * minting happens in the orchestrator process, which owns the authenticated
+ * Platform WebSocket. `--run-id` scopes to one run; otherwise the whole outbox
+ * drains (the `--all-pending` flag is the explicit form of the default).
+ */
+export interface AttestationRetryOptions {
+    runId?: string;
+    allPending?: boolean;
+    includeRejected?: boolean;
+}
+export interface AttestationRetryResult {
+    minted: number;
+    stillPending: number;
+    rejected: number;
+}
+/**
+ * Post the retry request through the injected transport (the admin API POST)
+ * and return the counts. Validates that the scope is unambiguous. When
+ * `includeRejected` is set, previously terminally-rejected rows are re-armed
+ * and re-attempted in the same drain.
+ */
+export declare function runAttestationRetry(post: (body: {
+    runId?: string;
+    includeRejected?: boolean;
+}) => Promise<AttestationRetryResult>, opts: AttestationRetryOptions): Promise<AttestationRetryResult>;
+//# sourceMappingURL=attestations-retry.d.ts.map

package/dist/cli/commands/attestations.d.ts

@@ -1,3 +1,4 @@
 import type { Command } from 'commander';
-export declare function registerAttestationsCommands(program: Command): void;
+import type { AdminApiClient } from '../api-client.js';
+export declare function registerAttestationsCommands(program: Command, getClient: () => AdminApiClient): void;
 //# sourceMappingURL=attestations.d.ts.map

package/dist/cli/commands/cluster.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+export declare function registerClusterCommands(program: Command): void;
+//# sourceMappingURL=cluster.d.ts.map

package/dist/cli/local-github-ingress-url.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Build the orchestrator's OWN direct GitHub ingress URL for a source, from
+ * the configured public base (`KICI_WEBHOOK_PUBLIC_URL`). Returns null when no
+ * public base is configured (the CLI then prints an honest "set
+ * KICI_WEBHOOK_PUBLIC_URL" note instead of a fabricated URL).
+ */
+export declare function buildLocalGithubIngressUrl(webhookPublicUrl: string | undefined, orgId: string, sourceId: string): string | null;
+//# sourceMappingURL=local-github-ingress-url.d.ts.map