@kici-dev/orchestrator 0.1.24 → 0.1.25

package/dist/helpers/rate-limiter.d.ts

@@ -1,13 +1,21 @@
 /**
  * Sliding-window rate limiter.
  *
- * Tracks timestamps of recent events per key and rejects new events
- * once the count within the window exceeds the configured maximum.
+ * Tracks timestamps of recent events per key and rejects new events once the
+ * count within the window exceeds the configured maximum.
+ *
+ * The internal Map stays bounded to the recently-active key set. A checked key
+ * whose window has fully expired is dropped before this call decides whether to
+ * record a new timestamp, so a call that records nothing (for example when the
+ * limit is zero) leaves no residual bucket. Keys that are never checked again
+ * are reclaimed by an amortized sweep that runs at most once per window, so the
+ * per-call hot path stays O(1) amortized even though a single sweep is O(n).
  */
 export declare class SlidingWindowRateLimiter {
     private readonly maxPerWindow;
     private readonly windowMs;
     private state;
+    private lastSweepAt;
     constructor(maxPerWindow: number, windowMs?: number);
     /**
      * Check if a new event is allowed for the given key.
@@ -18,6 +26,13 @@ export declare class SlidingWindowRateLimiter {
         allowed: boolean;
         retryAfterMs?: number;
     };
+    /**
+     * Evict buckets whose newest timestamp is outside the window. Runs at most
+     * once per window so the amortized cost per check() stays O(1).
+     */
+    private maybeSweep;
+    /** Number of tracked keys currently held in the internal map. */
+    get size(): number;
     reset(): void;
 }
 //# sourceMappingURL=rate-limiter.d.ts.map

package/dist/index.js

@@ -16,7 +16,6 @@ import { Octokit } from "@octokit/rest";
 import { createAppAuth } from "@octokit/auth-app";
 import { createServer } from "node:http";
 import { exec } from "node:child_process";
-import.meta.url;
 //#endregion
 //#region src/storage/s3.ts
 /**
@@ -1842,6 +1841,8 @@ var AdminApiClient = class {
 		if (opts?.from) params.set("from", opts.from);
 		if (opts?.to) params.set("to", opts.to);
 		if (opts?.q) params.set("q", opts.q);
+		if (opts?.agentLabel) params.set("agentLabel", opts.agentLabel);
+		if (opts?.agentOnly) params.set("agentOnly", "true");
 		if (opts?.limit !== void 0) params.set("limit", String(opts.limit));
 		if (opts?.cursor) params.set("cursor", opts.cursor);
 		const qs = params.toString();

package/dist/metrics/prometheus.d.ts

@@ -6,6 +6,12 @@ export declare function setConfigVersion(value: number): void;
 export declare function setDeclaredHostsUnreachable(value: number): void;
 /** Set the current number of stale runs detected. */
 export declare function setStaleRunsCurrent(value: number): void;
+/** Set the current number of deferred attestations awaiting a later mint. */
+export declare function setPendingAttestations(value: number): void;
+/** Set the age (seconds) of the oldest deferred attestation in the outbox. */
+export declare function setPendingAttestationOldestAgeSeconds(value: number): void;
+/** Set the current number of terminally-rejected deferred attestations. */
+export declare function setRejectedAttestations(value: number): void;
 interface ScalerUsageRow {
     scaler: string;
     /** Backend type for this scaler (rollup dimension). `__global__` for the orchestrator-wide row. */

package/dist/pipeline/dispatch-matched-workflow.d.ts

@@ -138,6 +138,12 @@ export interface DispatchMatchedWorkflowResult {
     dispatchedJobIds: string[];
     /** True when the workflow install gate paused the dispatch (held run). */
     held?: boolean;
+    /**
+     * User-visible warnings aggregated from dispatched jobs — today, one per job
+     * whose bound test-run environment(s) were unavailable and skipped. Surfaced
+     * on the accepted trigger response so the CLI can print them.
+     */
+    envWarnings?: string[];
 }
 /** Options controlling a (re-)dispatch of a matched workflow. */
 export interface DispatchMatchedWorkflowOptions {

package/dist/pipeline/manual-schedule.d.ts

@@ -15,7 +15,7 @@ import type { RegistrationIndex } from '../registration/registration-index.js';
 interface ManualScheduleDeps extends RerunDeps {
     registrationIndex: RegistrationIndex;
 }
-export declare function handleManualSchedule(registrationId: string, triggeredBy: string | null, deps: ManualScheduleDeps): Promise<{
+export declare function handleManualSchedule(registrationId: string, triggeredBy: string | null, triggeredByAgentLabel: string | null, deps: ManualScheduleDeps): Promise<{
     newRunId: string;
 }>;
 export declare function buildManualJobConfig(workflow: LockWorkflow, mat: MaterializedJob): {

package/dist/pipeline/process-webhook.d.ts

@@ -16,11 +16,24 @@
  * Internal helpers are pure phase functions returning typed results; the only
  * top-level export is `processWebhook`, callable from server.ts / app.ts.
  */
+import { z } from 'zod';
 import type { SimulatedEvent } from '@kici-dev/engine';
 import type { WebhookInfo } from '../webhook/handler.js';
 import type { ProviderBundle } from '../provider-registry.js';
 import type { TrustResolution } from '../security/trust-resolver.js';
 import { type ProcessingDeps } from './processor.js';
+/**
+ * Outcome of a single inbound-webhook ingestion. `duplicate` lets a direct-
+ * ingress route return `{ duplicate: true }` to GitHub's Recent Deliveries
+ * panel; `skipped` covers unknown provider / unknown event / no-repo paths;
+ * `processed` means the pipeline matched and dispatched (or recorded a run).
+ */
+export declare const WebhookIngestOutcome: z.ZodEnum<{
+    processed: "processed";
+    skipped: "skipped";
+    duplicate: "duplicate";
+}>;
+export type WebhookIngestOutcome = z.infer<typeof WebhookIngestOutcome>;
 interface TrustOutcome {
     trustResolution: TrustResolution | undefined;
     /** Default 'base' for PR events; trust resolution may override to 'head'. */
@@ -52,6 +65,6 @@ export declare function resolveTrustForPR(args: {
  *   9. Match + dispatch global workflows for OTHER repos
  *  10. Forward Platform trace + record event log
  */
-export declare function processWebhook(info: WebhookInfo, deps: ProcessingDeps): Promise<void>;
+export declare function processWebhook(info: WebhookInfo, deps: ProcessingDeps): Promise<WebhookIngestOutcome>;
 export {};
 //# sourceMappingURL=process-webhook.d.ts.map

package/dist/pipeline/rerun.d.ts

@@ -67,7 +67,7 @@ export interface RerunDeps {
      */
     coldStore: ColdStore | null;
 }
-export declare function handleRerun(originalRunId: string, triggeredBy: string | null, deps: RerunDeps, 
+export declare function handleRerun(originalRunId: string, triggeredBy: string | null, triggeredByAgentLabel: string | null, deps: RerunDeps, 
 /**
  * Phase F — routing key for the original run, forwarded by Platform
  * via the WS `run.rerun.request` payload. Required to address the

package/dist/pipeline/test-pipeline.d.ts

@@ -92,6 +92,12 @@ interface TestTriggerResult {
     reason?: string;
     /** Dispatched job IDs. */
     jobIds: string[];
+    /**
+     * User-visible warnings on an accepted run — today, one per job whose bound
+     * test-run environment(s) were unavailable (non-test or unconfigured) and
+     * skipped. Printed by the CLI on acceptance.
+     */
+    warnings?: string[];
 }
 /**
  * Repo identity for an inline-lock (local working tree) run. Derived from the

package/dist/provenance/attestation-retrier.d.ts

@@ -0,0 +1,92 @@
+import type { PendingAttestationsRepo, PendingAttestationRow } from './pending-attestations-repo.js';
+/** A minted token, a still-transient deferral, or a terminal rejection. */
+export type RetrierMintResult = {
+    token: string;
+    expiresIn: number;
+    jti: string;
+} | {
+    deferred: true;
+    code: string;
+} | {
+    rejected: true;
+    reason: string;
+};
+export interface AttestationRetrierDeps {
+    repo: PendingAttestationsRepo;
+    /** Mint the deferred token (the OIDC relay with deferred params, Task 5). */
+    requestMint: (args: {
+        orchestratorId: string;
+        runId: string;
+        jobId: string;
+        audience: string;
+        deferred: {
+            statementHash: string;
+            origin: 'deferred' | 'offline-backfill';
+        };
+    }) => Promise<RetrierMintResult>;
+    /** Assemble + upload the bundle to object storage (initMeta included). */
+    uploadBundle: (args: {
+        runId: string;
+        jobId: string;
+        subjectDigest: string;
+        bundle: Record<string, unknown>;
+        storageKey: string;
+    }) => Promise<void>;
+    computeVerdict: (storageKey: string) => Promise<{
+        verifyStatus: string;
+        verifyReason: string | null;
+        verifiedAt: Date | null;
+    }>;
+    recordAttestation: (args: {
+        runId: string;
+        jobId: string;
+        subjectName: string;
+        subjectDigest: string;
+        storageKey: string;
+        mediaType: string;
+        verifyStatus: string;
+        verifyReason: string | null;
+        verifiedAt: Date | null;
+    }) => Promise<void>;
+    /** Replay the run/job rows the Platform missed (offline-backfill only). */
+    backfillRun: (runId: string) => Promise<void>;
+    setMetrics: (count: number, oldestCreatedAt: Date | null, rejected: number) => void;
+    isLeader: () => boolean;
+    orchestratorId: string;
+    intervalMs: number;
+    provenanceStorageKey: (runId: string, jobId: string, subjectDigest: string) => string;
+}
+export declare class AttestationRetrier {
+    private readonly deps;
+    private interval;
+    private running;
+    constructor(deps: AttestationRetrierDeps);
+    /**
+     * Start the periodic timer. Each tick self-gates on `isLeader()`, so it is
+     * safe to start on every instance — only the current Raft leader acts, and
+     * the `attestations` unique index makes fulfilment idempotent regardless.
+     */
+    start(): void;
+    onBecomeLeader(): void;
+    onLoseLeadership(): void;
+    stop(): void;
+    /** On-reconnect trigger (Platform WS re-authenticated). Leader-gated inside tick. */
+    triggerNow(): void;
+    tick(): Promise<void>;
+    /**
+     * Fulfil the targeted pending rows once and report counts. Used by the manual
+     * `kici-admin attestations retry` path (via the orchestrator admin API): the
+     * operator explicitly requested a drain, so this is NOT leader-gated — the
+     * `attestations` unique index keeps a concurrent leader tick idempotent.
+     */
+    runOnce(opts?: {
+        runId?: string;
+        includeRejected?: boolean;
+    }): Promise<{
+        minted: number;
+        stillPending: number;
+        rejected: number;
+    }>;
+    fulfilOne(row: PendingAttestationRow): Promise<'minted' | 'rejected' | 'deferred'>;
+}
+//# sourceMappingURL=attestation-retrier.d.ts.map

package/dist/provenance/backfill-run.d.ts

@@ -0,0 +1,41 @@
+import type { OrchestratorToPlatformMessage } from '@kici-dev/engine';
+/** The local `execution_runs` fields the backfill needs (production reads via Kysely). */
+export interface BackfillRunRow {
+    run_id: string;
+    workflow_name: string;
+    status: string;
+    repo_identifier: string | null;
+    provider: string | null;
+    local_working_tree: boolean | null;
+    sha: string | null;
+    ref: string | null;
+    job_count: number | null;
+    started_at: Date | null;
+    completed_at: Date | null;
+    duration_ms: number | null;
+}
+/** The local `execution_jobs` fields the backfill needs. */
+export interface BackfillJobRow {
+    run_id: string;
+    job_id: string;
+    job_name: string;
+    status: string;
+    started_at: Date | null;
+    completed_at: Date | null;
+    agent_id: string | null;
+    orchestrator_id: string | null;
+}
+export interface BackfillRunDeps {
+    send: (message: OrchestratorToPlatformMessage) => void;
+    loadRun: (runId: string) => Promise<BackfillRunRow | null>;
+    loadJobs: (runId: string) => Promise<BackfillJobRow[]>;
+}
+/**
+ * Send one `execution.status` (terminal) followed by one `job.status.forward`
+ * per job, populating exactly the fields the Platform's `handler.ts` upserts.
+ * Ordered execution.status FIRST so the run row exists before the job rows
+ * reference it. A no-op (throws) when the run is not found locally — the caller
+ * leaves the pending row `deferred` with a clear error.
+ */
+export declare function backfillRunToPlatform(deps: BackfillRunDeps, runId: string): Promise<void>;
+//# sourceMappingURL=backfill-run.d.ts.map

package/dist/provenance/pending-attestations-repo.d.ts

@@ -0,0 +1,64 @@
+import { type Kysely } from 'kysely';
+import type { AttestationOrigin } from '@kici-dev/engine';
+import type { Database, PendingAttestationRow } from '../db/types.js';
+/** The non-`live` AttestationOrigin values a pending row can carry. */
+export type PendingAttestationOrigin = Exclude<AttestationOrigin, 'live'>;
+export interface PendingAttestationInput {
+    id: string;
+    runId: string;
+    jobId: string;
+    subjectName: string;
+    subjectDigest: string;
+    audience: string;
+    dsseEnvelope: unknown;
+    publicKey: unknown;
+    mediaType: string;
+    statementHash: string;
+    originKind: PendingAttestationOrigin;
+}
+export type { PendingAttestationRow } from '../db/types.js';
+/** Typed CRUD over the deferred-attestation outbox (shared orchestrator DB). */
+export declare class PendingAttestationsRepo {
+    private readonly db;
+    constructor(db: Kysely<Database>);
+    /** Insert a pending row; re-deferring the same subject is a no-op. */
+    insert(row: PendingAttestationInput): Promise<void>;
+    /**
+     * List pending rows oldest-first, optionally scoped to a run. Terminally
+     * rejected rows (`rejected_at IS NOT NULL`) are excluded — the retrier never
+     * re-picks a row the Platform definitively cannot mint.
+     */
+    list(opts?: {
+        runId?: string;
+        limit?: number;
+    }): Promise<PendingAttestationRow[]>;
+    /** Bump the attempt counter + record the last error on a still-failing retry. */
+    recordAttempt(id: string, lastError: string | null): Promise<void>;
+    /** Remove a fulfilled pending row. */
+    delete(id: string): Promise<void>;
+    /**
+     * Outbox depth + oldest entry, feeding the metrics gauges. Terminally rejected
+     * rows are excluded so the pending gauge reflects only truly-pending rows.
+     */
+    countAndOldest(): Promise<{
+        count: number;
+        oldestCreatedAt: Date | null;
+    }>;
+    /**
+     * Terminally reject a pending row: the Platform definitively cannot mint it
+     * (run/job absent). Stamps rejected_at, records the reason, and bumps the
+     * attempt counter. The row stays for audit but is skipped by list()/counts.
+     */
+    markRejected(id: string, reason: string): Promise<void>;
+    /** Count terminally-rejected rows (feeds the rejected-attestations gauge). */
+    countRejected(): Promise<number>;
+    /**
+     * Re-arm terminally-rejected rows so the next drain re-attempts them (used
+     * after an operator fixes the Platform-side run/job). Scoped to a run when
+     * runId is given, else clears every rejected row. Returns the count re-armed.
+     */
+    clearRejected(opts?: {
+        runId?: string;
+    }): Promise<number>;
+}
+//# sourceMappingURL=pending-attestations-repo.d.ts.map

package/dist/provenance/verify-at-ingest.d.ts

@@ -9,11 +9,18 @@ export interface AttestationVerdict {
 /**
  * Compute the verification verdict for a stored provenance bundle at ingest.
  *
+ * Reads the bundle, selects the signing-key set by the identity token's own
+ * `kid` (so a kid-miss triggers the trust root's single refetch — a token
+ * minted with a freshly-rotated key still verifies against a briefly-stale
+ * cached JWKS), then verifies offline.
+ *
  * Fail-closed: a missing trust root, unfetchable JWKS, missing storage, or an
  * unreadable bundle all yield `unverifiable` (never silently `verified`). A
- * bundle that verifies false yields `failed` with the first failure code. Any
- * thrown error is caught and recorded as `unverifiable` — verification never
- * fails the upload.
+ * signing key that is absent from the published JWKS even after the refetch
+ * yields `unverifiable` (`signing_key_not_published`) — "couldn't verify", not
+ * "proved bad". A bundle that verifies false yields `failed` with the first
+ * failure code. Any thrown error is caught and recorded as `unverifiable` —
+ * verification never fails the upload.
  */
 export declare function computeAttestationVerdict(opts: {
     trustRoot: ProvenanceTrustRoot | undefined;

package/dist/reporting/execution-tracker.d.ts

@@ -40,6 +40,8 @@ export interface ExecutionContext {
     originalRunId?: string | null;
     /** User identity that triggered this re-run (null/undefined for webhook-triggered). */
     triggeredBy?: string | null;
+    /** Agent provenance label when triggered through an agent credential. */
+    triggeredByAgentLabel?: string | null;
     /**
      * Provider login of the person who triggered the run (pusher / PR author).
      * Captured for all event types; forwarded to the Platform run projection and
@@ -221,6 +223,8 @@ export declare class ExecutionTracker {
         waveMaxParallel?: number;
         waveFailFast?: boolean;
         environments?: string[];
+        skippedEnvironments?: string[];
+        envWarning?: string;
     }>, routingKey?: string, 
     /** Secret context names dispatched with jobs (for context-disable job lookup). */
     dispatchedContexts?: string[], 
@@ -248,11 +252,16 @@ export declare class ExecutionTracker {
     /** Provider login of the triggering actor (pusher / PR author). */
     triggerActorUsername?: string | null, 
     /** Immutable provider user id of the triggering actor. */
-    triggerActorUserId?: string | null): Promise<void>;
+    triggerActorUserId?: string | null, 
+    /** Agent provenance label when triggered through an agent credential. */
+    triggeredByAgentLabel?: string | null): Promise<void>;
     /**
-     * Add additional jobs to an already-started execution run.
-     * Used when build jobs are tracked early and regular jobs are dispatched later.
+     * Upsert one execution_jobs row per dispatched job (idempotent on
+     * (run_id, job_id) to tolerate a race with an early `onJobStatus`). The
+     * `routing_key` is denormalized (see migration 006) so cold-store archival
+     * partitions by it without joining execution_runs.
      */
+    private insertTrackedJobRows;
     /**
      * Find the synthetic needs-pending job ID for a given job name in a run.
      * Used by dispatchReadyJob to locate the placeholder entry before replacing it.
@@ -303,6 +312,8 @@ export declare class ExecutionTracker {
         variantKind?: string;
         variantLabel?: string;
         environments?: string[];
+        skippedEnvironments?: string[];
+        envWarning?: string;
     }>, dispatchedContexts?: string[], 
     /** Synthetic job ID to replace (e.g. needs-pending-deploy-{uuid}). */
     replaceSyntheticId?: string): Promise<void>;
@@ -571,6 +582,7 @@ export declare class ExecutionTracker {
         parentRunId?: string | null;
         originalRunId?: string | null;
         triggeredBy?: string | null;
+        triggeredByAgentLabel?: string | null;
         failureReason?: string;
         jobCount: number;
         startedAt: number;

package/dist/reporting/run-aggregator.d.ts

@@ -65,6 +65,8 @@ export interface RunDetailJobRow {
     error_message: string | null;
     runs_on_labels: unknown;
     environments: unknown;
+    skipped_environments: unknown;
+    env_warning: string | null;
     outputs: unknown;
     init_failure: unknown;
 }
@@ -100,7 +102,7 @@ export declare function buildRunDetailJobs(jobs: RunDetailJobRow[], lookups: Run
         errorMessage: string | null;
     }[];
     initFailure?: {
-        scope: "run" | "job";
+        scope: "job" | "run";
         category: "secret_resolution" | "install_secrets" | "lock_resolution" | "build_coordination" | "environment_rules" | "dynamic_eval" | "no_agent" | "matrix_expansion";
         message: string;
         jobName?: string | undefined;
@@ -120,6 +122,8 @@ export declare function buildRunDetailJobs(jobs: RunDetailJobRow[], lookups: Run
     errorMessage: string | null;
     runsOnLabels: string[] | null;
     environments: string[] | null;
+    skippedEnvironments: string[] | null;
+    envWarning: string | null;
     outputs: any;
     secretOutputKeys: string[] | null;
 }[];

package/dist/routes/admin-access-log.d.ts

@@ -8,7 +8,8 @@
  *
  *   GET /api/v1/admin/access-log
  *     Filters: orgId, actorType, actorId, action, source, outcome,
- *              targetType, targetId, from, to, limit, cursor
+ *              targetType, targetId, from, to, q, agentLabel, agentOnly,
+ *              limit, cursor
  *     Requires: access_log.read
  *
  *   GET /api/v1/admin/access-log/:id

package/dist/routes/admin.d.ts

@@ -113,6 +113,20 @@ export interface AdminRouteDeps {
      * write is best-effort, never gating.
      */
     accessLog?: AccessLogWriter;
+    /**
+     * Optional -- fulfil deferred attestations on demand (mints in the running
+     * orchestrator process, which owns the Platform WS). Backs
+     * `POST /api/v1/admin/attestations/retry` (the `kici-admin attestations retry`
+     * command). Unset on a WS-only / non-coordinator admin.
+     */
+    retryAttestations?: (opts: {
+        runId?: string;
+        includeRejected?: boolean;
+    }) => Promise<{
+        minted: number;
+        stillPending: number;
+        rejected: number;
+    }>;
 }
 /** Hono env type for admin routes with context variables. */
 type AdminEnv = {

package/dist/routes/github-webhook.d.ts

@@ -0,0 +1,37 @@
+import { Hono } from 'hono';
+import type { WebhookInfo } from '../webhook/handler.js';
+import type { SourceStore } from '../sources/source-store.js';
+import { type VerifyInboundDeps } from '../webhook/verify-inbound.js';
+import { WebhookIngestOutcome } from '../pipeline/process-webhook.js';
+/** Dependencies for the direct GitHub webhook ingress route. */
+export interface GithubWebhookRoutesDeps {
+    /** Local source lookup (by UUID). */
+    sourceStore: SourceStore;
+    /** Inbound verification deps (db + secret store + generic source manager). */
+    verifyDeps: VerifyInboundDeps;
+    /** Pipeline entry — owns the atomic dedup claim + dispatch. */
+    onWebhook: (info: WebhookInfo) => Promise<WebhookIngestOutcome>;
+}
+/**
+ * Whether the orchestrator serves the direct GitHub ingress route for a given
+ * operating mode. Hybrid + independent run local source config; platform mode
+ * is relay-only (no local GitHub source to serve).
+ */
+export declare function shouldServeGithubIngress(mode: 'platform' | 'hybrid' | 'independent'): boolean;
+/**
+ * Direct GitHub-App webhook ingress: `POST /webhook/:orgId/github/:sourceId`.
+ *
+ * Bypasses the Platform relay. Handles both operator topologies on one route:
+ *  - App-level repoint: the App's single webhook URL points here, so GitHub
+ *    sends `X-GitHub-Hook-Installation-Target-Type: integration` +
+ *    `-Target-ID: <appId>` — validated against the source's routing key.
+ *  - Classic per-repo webhook: a repo-level hook points here with no App
+ *    target headers — `:sourceId` already identifies the source, so the
+ *    App-header check is skipped.
+ *
+ * Verification is the existing local `verify-inbound.ts` GitHub path (secret
+ * read from the orchestrator secret store; rotation-aware). Dedup + dispatch
+ * are the universal `processWebhook` pipeline via `onWebhook`.
+ */
+export declare function createGithubWebhookRoutes(deps: GithubWebhookRoutesDeps): Hono;
+//# sourceMappingURL=github-webhook.d.ts.map

package/dist/routes/health.d.ts

@@ -3,6 +3,15 @@ import type { Database } from '../db/types.js';
 export interface HealthRoutesDeps {
     /** Optional DB instance for readiness checks */
     db?: Kysely<Database>;
+    /**
+     * Optional warmth latch. Returns `true` only once the orchestrator boot
+     * sequence has finished (all subsystems started, HTTP server serving). When
+     * provided, `/ready` returns `503` until it flips `true`, so a caller can
+     * gate on the orchestrator being ready to serve rather than merely live.
+     * Absent → warm defaults to `true` (callers that don't wire the latch are
+     * unaffected).
+     */
+    isWarm?: () => boolean;
 }
 /**
  * Create orchestrator health routes with database readiness check.

package/dist/routes/webhooks.d.ts

@@ -1,17 +1,15 @@
 import { Hono } from 'hono';
-import type { DedupCache } from '../webhook/dedup.js';
 import type { WebhookInfo } from '../webhook/handler.js';
 import type { GenericSourceManager } from '../webhook/generic-sources.js';
+import { WebhookIngestOutcome } from '../pipeline/process-webhook.js';
 /**
  * Dependencies for generic webhook routes.
  */
 export interface GenericWebhookRoutesDeps {
     /** Generic source manager for source lookup and validation */
     sourceManager: GenericSourceManager;
-    /** Delivery ID deduplication cache */
-    dedup: DedupCache;
     /** Processing callback -- connects to the trigger matching pipeline */
-    onWebhook: (info: WebhookInfo) => Promise<void>;
+    onWebhook: (info: WebhookInfo) => Promise<WebhookIngestOutcome>;
 }
 /**
  * Create generic webhook routes for non-GitHub webhook ingestion.