@kici-dev/orchestrator 0.1.24 → 0.1.26

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (61) hide show
  1. package/dist/app.d.ts +24 -0
  2. package/dist/audit/access-log.d.ts +4 -0
  3. package/dist/cancel/cancel-run.d.ts +2 -0
  4. package/dist/cli/api-client.d.ts +2 -0
  5. package/dist/cli/commands/attestations-list.d.ts +49 -0
  6. package/dist/cli/commands/attestations-retry.d.ts +28 -0
  7. package/dist/cli/commands/attestations.d.ts +2 -1
  8. package/dist/cli/commands/cluster.d.ts +3 -0
  9. package/dist/cli/local-github-ingress-url.d.ts +8 -0
  10. package/dist/cli.js +1021 -404
  11. package/dist/cluster/cluster-identity.d.ts +11 -0
  12. package/dist/cluster/reconcile-identity.d.ts +50 -0
  13. package/dist/cold-store/load-access-log-range.d.ts +4 -0
  14. package/dist/config.d.ts +2 -0
  15. package/dist/dashboard/attestation-filters.d.ts +62 -1
  16. package/dist/dashboard/handler.d.ts +24 -4
  17. package/dist/db/migrations/061_execution_runs_environment_id.d.ts +4 -0
  18. package/dist/db/migrations/062_execution_runs_agent_label.d.ts +4 -0
  19. package/dist/db/migrations/063_access_log_agent_label_index.d.ts +10 -0
  20. package/dist/db/migrations/064_execution_jobs_skipped_environments.d.ts +17 -0
  21. package/dist/db/migrations/065_pending_attestations.d.ts +22 -0
  22. package/dist/db/migrations/066_pending_attestations_rejected.d.ts +13 -0
  23. package/dist/db/types.d.ts +58 -0
  24. package/dist/environments/protection/satisfiability.d.ts +14 -9
  25. package/dist/events/circuit-breaker.d.ts +8 -5
  26. package/dist/events/event-router.d.ts +12 -4
  27. package/dist/events/event-store.d.ts +21 -3
  28. package/dist/events/trust-store.d.ts +6 -1
  29. package/dist/events/types.d.ts +6 -1
  30. package/dist/helpers/rate-limiter.d.ts +17 -2
  31. package/dist/index.js +2 -1
  32. package/dist/metrics/prometheus.d.ts +6 -0
  33. package/dist/pipeline/dispatch-matched-workflow.d.ts +6 -0
  34. package/dist/pipeline/manual-schedule.d.ts +1 -1
  35. package/dist/pipeline/process-webhook.d.ts +14 -1
  36. package/dist/pipeline/rerun.d.ts +1 -1
  37. package/dist/pipeline/test-pipeline.d.ts +6 -0
  38. package/dist/provenance/attestation-retrier.d.ts +92 -0
  39. package/dist/provenance/backfill-run.d.ts +41 -0
  40. package/dist/provenance/pending-attestations-repo.d.ts +64 -0
  41. package/dist/provenance/verify-at-ingest.d.ts +10 -3
  42. package/dist/reporting/execution-tracker.d.ts +15 -3
  43. package/dist/reporting/run-aggregator.d.ts +5 -1
  44. package/dist/routes/admin-access-log.d.ts +2 -1
  45. package/dist/routes/admin.d.ts +14 -0
  46. package/dist/routes/github-webhook.d.ts +37 -0
  47. package/dist/routes/health.d.ts +9 -0
  48. package/dist/routes/webhooks.d.ts +2 -4
  49. package/dist/server.js +3462 -1886
  50. package/dist/sources/source-store.d.ts +6 -0
  51. package/dist/stale-detector/workflow-deadline-detector.d.ts +25 -0
  52. package/dist/standalone.js +19335 -18258
  53. package/dist/webhook/dedup.d.ts +14 -0
  54. package/dist/ws/agent-handler.d.ts +23 -0
  55. package/dist/ws/oidc-token-relay.d.ts +31 -21
  56. package/dist/ws/orch-rpc.d.ts +9 -0
  57. package/dist/ws/platform-client.d.ts +18 -1
  58. package/dist/ws/test-relay-handlers.d.ts +2 -0
  59. package/installer-image-digests.json +3 -3
  60. package/package.json +5 -5
  61. package/sbom.spdx.json +55 -50
@@ -58,6 +58,12 @@ export declare class SourceStore {
58
58
  * Get a single source by routing key, or null if not found.
59
59
  */
60
60
  getSource(routingKey: string): Promise<Source | null>;
61
+ /**
62
+ * Get a single source by its UUID primary key, or null if not found. Used by
63
+ * the direct GitHub ingress route, which receives the source id in the URL
64
+ * (`/webhook/:orgId/github/:sourceId`).
65
+ */
66
+ getSourceById(id: string): Promise<Source | null>;
61
67
  /**
62
68
  * Get a source with its decrypted secrets.
63
69
  */
@@ -13,6 +13,15 @@
13
13
  import { type Kysely } from 'kysely';
14
14
  import type { Database } from '../db/types.js';
15
15
  import type { JobQueue } from '../queue/job-queue.js';
16
+ /**
17
+ * Recency window for the deadline-bounded scan: a run stays in scope while its
18
+ * deadline (`started_at + workflow_timeout_ms`) lapsed within this window. 24h is
19
+ * the crash-recovery horizon — a run whose deadline lapsed while the orchestrator
20
+ * was down for less than this is still caught by the immediate `start()` scan; a
21
+ * deadline that lapsed longer ago is out of scope (separate stale-recovery concern).
22
+ * The window bounds the DEADLINE, not `started_at`, so timeouts >= 24h are enforced.
23
+ */
24
+ export declare const DEADLINE_RECENCY_WINDOW_MS: number;
16
25
  export interface WorkflowDeadlineDetectorDeps {
17
26
  db: Kysely<Database>;
18
27
  /**
@@ -44,6 +53,22 @@ export declare class WorkflowDeadlineDetector {
44
53
  * cancel each one.
45
54
  */
46
55
  scan(): Promise<void>;
56
+ /**
57
+ * Build the SELECT for overdue runs. Extracted so a unit test can compile the
58
+ * exact predicate set (Kysely `.compile()`) and assert the deadline-recency
59
+ * bound without a live database.
60
+ *
61
+ * Bound the scan to runs whose DEADLINE lapsed within the recency window:
62
+ * overdue (deadline < now) AND recent (deadline > now - window). Bounding by
63
+ * the deadline (`started_at + workflow_timeout_ms`) rather than `started_at`
64
+ * keeps long-timeout runs (timeout >= the window, e.g. >= 24h) in scope once
65
+ * overdue — a `started_at > (now - window)` guard silently excluded those
66
+ * forever because their deadline only lapses after `started_at` has already
67
+ * aged past the window — while still skipping runs whose deadline passed long
68
+ * ago (already handled), preserving the "don't re-scan ancient history every
69
+ * tick" performance intent.
70
+ */
71
+ private buildOverdueQuery;
47
72
  private cancelOverdueRun;
48
73
  }
49
74
  //# sourceMappingURL=workflow-deadline-detector.d.ts.map