@kici-dev/orchestrator 0.1.26 → 0.1.27

package/dist/db/migrations/067_environments_to_contexts.d.ts

@@ -0,0 +1,36 @@
+import { type Kysely } from 'kysely';
+/**
+ * Rename the named-policy object from "environment" to "context" across the
+ * orchestrator schema. Data-preserving rename-in-place (never drop/recreate):
+ *
+ * Tables:
+ *  - `environments`               → `contexts`
+ *  - `environment_bindings`       → `context_bindings`
+ *  - `environment_variables`      → `context_variables`
+ *  - `environment_source_overrides` → `context_source_overrides`
+ *
+ * Columns:
+ *  - `context_bindings.environment_id`         → `context_id`
+ *  - `context_variables.environment_id`        → `context_id`
+ *  - `context_source_overrides.environment_id` → `context_id`
+ *  - `held_runs.environment_id`                → `context_id`
+ *  - `execution_runs.environment`              → `context`
+ *  - `execution_runs.environment_id`           → `context_id`
+ *  - `execution_jobs.environments`             → `contexts`
+ *  - `execution_jobs.skipped_environments`     → `skipped_contexts`
+ *
+ * Index:
+ *  - `idx_execution_runs_environment_id` → `idx_execution_runs_context_id`
+ *
+ * Held-run enum values + defaults: `held_runs.queue_type` /
+ * `held_runs.trigger_source` default `'environment'` → `'context'` and existing
+ * `'environment'` rows are migrated to `'context'` (the `HeldRunQueueType` value
+ * rename).
+ *
+ * Foreign keys and remaining constraints/indexes follow the renamed tables and
+ * columns automatically (Postgres references them by identity, not name), so
+ * only the one hand-named index above needs an explicit rename.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=067_environments_to_contexts.d.ts.map

package/dist/db/migrations/068_request_idempotency.d.ts

@@ -0,0 +1,17 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add the `request_idempotency` claim table: a `request_id`-keyed record that
+ * makes run-minting dashboard requests (`run.rerun.request`,
+ * `run.manual_schedule.request`) idempotent on the Platform `requestId`. HA
+ * coordinator siblings share one orchestrator DB, so when the Platform relay
+ * fails over and re-sends the same request to a sibling, the atomic `INSERT …
+ * ON CONFLICT DO NOTHING` on `request_id` lets exactly one coordinator win —
+ * the loser returns the winner's `new_run_id` instead of minting a second run.
+ * Rows are pruned after 1h (far past the ~10s request budget) by the periodic
+ * cleanup tick.
+ *
+ * Idempotent: guarded on table existence.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=068_request_idempotency.d.ts.map

package/dist/db/types.d.ts

@@ -13,11 +13,11 @@ export interface Database {
     execution_steps: ExecutionStepTable;
     raft_state: RaftStateTable;
     secret_audit_log: SecretAuditLogTable;
-    environments: EnvironmentsTable;
+    contexts: ContextsTable;
     scoped_secrets: ScopedSecretsTable;
-    environment_bindings: EnvironmentBindingsTable;
-    environment_variables: EnvironmentVariablesTable;
-    environment_source_overrides: EnvironmentSourceOverridesTable;
+    context_bindings: ContextBindingsTable;
+    context_variables: ContextVariablesTable;
+    context_source_overrides: ContextSourceOverridesTable;
     held_runs: HeldRunsTable;
     held_run_approvals: HeldRunApprovalsTable;
     admin_tokens: AdminTokenTable;
@@ -52,7 +52,26 @@ export interface Database {
     pending_attestations: PendingAttestationsTable;
     remote_sources: RemoteSourcesTable;
     host_roster: HostRosterTable;
+    request_idempotency: RequestIdempotencyTable;
 }
+/**
+ * Request idempotency claim table.
+ * Keyed on the Platform `requestId`; makes run-minting dashboard requests
+ * (`run.rerun.request`, `run.manual_schedule.request`) idempotent across an HA
+ * relay failover so a re-sent request returns the first coordinator's
+ * `new_run_id` instead of creating a second run. Pruned after 1h.
+ */
+export interface RequestIdempotencyTable {
+    /** Platform-minted requestId for the run-minting request (primary key / idempotency key). */
+    request_id: string;
+    /** The run id the winning coordinator created for this requestId. */
+    new_run_id: string;
+    /** When the claim was recorded. */
+    created_at: Generated<Date>;
+}
+export type RequestIdempotency = Selectable<RequestIdempotencyTable>;
+export type NewRequestIdempotency = Insertable<RequestIdempotencyTable>;
+export type RequestIdempotencyUpdate = Updateable<RequestIdempotencyTable>;
 /**
  * Cluster metadata table
  * Key-value store for cluster-wide configuration (e.g. cluster_id).
@@ -288,10 +307,10 @@ export interface ExecutionRunTable {
     cancelled_by: string | null;
     /** Agent provenance label when the run was cancelled through an agent credential (null otherwise). */
     cancelled_by_agent_label: string | null;
-    /** Environment name for this run (null if no environment applies) */
-    environment: string | null;
-    /** Matched environment id for this run (null if no/unresolved environment). */
-    environment_id: string | null;
+    /** Context name for this run (null if no context applies) */
+    context: string | null;
+    /** Matched context id for this run (null if no/unresolved context). */
+    context_id: string | null;
     /** Trust tier of the contributor for PR runs (null for non-PR events) */
     trust_tier: string | null;
     /** Lock file source: 'head' or 'base' (null for non-PR events) */
@@ -397,17 +416,17 @@ export interface ExecutionJobTable {
     /** Aggregated step outputs JSONB (step-keyed map of outputs). Populated on job success. */
     outputs: string | null;
     /**
-     * Ordered bound deployment-environment names for this job, JSON-encoded
+     * Ordered bound deployment-context names for this job, JSON-encoded
      * `string[]` (null when the job binds none). Written at dispatch and
-     * overwritten with the agent-resolved list for dynamic environments.
+     * overwritten with the agent-resolved list for dynamic contexts.
      */
-    environments: string | null;
+    contexts: string | null;
     /**
-     * Bound environments skipped on a test/local run (non-test or unconfigured),
+     * Bound contexts skipped on a test/local run (non-test or unconfigured),
      * JSON-encoded `string[]`. NULL = nothing skipped.
      */
-    skipped_environments: string | null;
-    /** User-visible warning naming the skipped test-run environments. NULL = none. */
+    skipped_contexts: string | null;
+    /** User-visible warning naming the skipped test-run contexts. NULL = none. */
     env_warning: string | null;
     /** Whether all upstream needs edges are satisfied (dispatch gate). */
     needs_satisfied: Generated<boolean>;
@@ -561,20 +580,20 @@ export interface RaftStateTable {
 export type RaftState = Selectable<RaftStateTable>;
 export type RaftStateUpdate = Updateable<RaftStateTable>;
 /**
- * Environments table
- * Named deployment environments with concurrency, branch restrictions, and approval rules.
+ * Contexts table
+ * Named deployment contexts with concurrency, branch restrictions, and approval rules.
  * Scoped to an organization.
  */
-export interface EnvironmentsTable {
+export interface ContextsTable {
     /** UUID primary key */
     id: Generated<string>;
     /** Organization ID */
     org_id: string;
-    /** Environment name (unique within org) */
+    /** Context name (unique within org) */
     name: string;
-    /** Environment type: 'fixed' | 'dynamic' */
+    /** Context type: 'fixed' | 'dynamic' */
     type: Generated<string>;
-    /** Glob pattern for dynamic environments (null for fixed) */
+    /** Glob pattern for dynamic contexts (null for fixed) */
     glob_pattern: string | null;
     /** JSONB array of branch restriction patterns */
     branch_restrictions: Generated<string>;
@@ -596,30 +615,30 @@ export interface EnvironmentsTable {
     hold_expiry_seconds: Generated<number>;
     /** Minimum trust tier required for CI execution (null = no trust requirement) */
     minimum_trust: string | null;
-    /** Whether this environment allows local (no-remote) executions. Default false. */
+    /** Whether this context allows local (no-remote) executions. Default false. */
     allow_local_execution: Generated<boolean>;
-    /** Whether this environment is active */
+    /** Whether this context is active */
     enabled: Generated<boolean>;
-    /** When this environment was created */
+    /** When this context was created */
     created_at: Generated<Date>;
-    /** When this environment was last updated */
+    /** When this context was last updated */
     updated_at: Generated<Date>;
-    /** Who created this environment */
+    /** Who created this context */
     created_by: string | null;
 }
-export type Environment = Selectable<EnvironmentsTable>;
-export type NewEnvironment = Insertable<EnvironmentsTable>;
-export type EnvironmentUpdate = Updateable<EnvironmentsTable>;
+export type Context = Selectable<ContextsTable>;
+export type NewContext = Insertable<ContextsTable>;
+export type ContextUpdate = Updateable<ContextsTable>;
 /**
  * Scoped secrets table
- * Encrypted key-value pairs scoped to org + scope (e.g. environment name, repo pattern).
+ * Encrypted key-value pairs scoped to org + scope (e.g. context name, repo pattern).
  */
 export interface ScopedSecretsTable {
     /** UUID primary key */
     id: Generated<string>;
     /** Organization ID */
     org_id: string;
-    /** Scope identifier (e.g. environment name, repo pattern) */
+    /** Scope identifier (e.g. context name, repo pattern) */
     scope: string;
     /** Secret key name */
     key: string;
@@ -638,16 +657,16 @@ export type ScopedSecret = Selectable<ScopedSecretsTable>;
 export type NewScopedSecret = Insertable<ScopedSecretsTable>;
 export type ScopedSecretUpdate = Updateable<ScopedSecretsTable>;
 /**
- * Environment bindings table
- * Links environments to scope patterns (e.g. workflow names, repo identifiers).
+ * Context bindings table
+ * Links contexts to scope patterns (e.g. workflow names, repo identifiers).
  */
-export interface EnvironmentBindingsTable {
+export interface ContextBindingsTable {
     /** UUID primary key */
     id: Generated<string>;
     /** Organization ID */
     org_id: string;
-    /** Environment ID (FK to environments.id, cascade delete) */
-    environment_id: string;
+    /** Context ID (FK to contexts.id, cascade delete) */
+    context_id: string;
     /** Scope pattern for matching (e.g. workflow name glob, repo pattern) */
     scope_pattern: string;
     /**
@@ -659,19 +678,19 @@ export interface EnvironmentBindingsTable {
     /** When this binding was created */
     created_at: Generated<Date>;
 }
-export type EnvironmentBinding = Selectable<EnvironmentBindingsTable>;
-export type NewEnvironmentBinding = Insertable<EnvironmentBindingsTable>;
+export type ContextBinding = Selectable<ContextBindingsTable>;
+export type NewContextBinding = Insertable<ContextBindingsTable>;
 /**
- * Environment variables table
- * Non-secret key-value pairs attached to an environment.
+ * Context variables table
+ * Non-secret key-value pairs attached to a context.
  */
-export interface EnvironmentVariablesTable {
+export interface ContextVariablesTable {
     /** UUID primary key */
     id: Generated<string>;
     /** Organization ID */
     org_id: string;
-    /** Environment ID (FK to environments.id, cascade delete) */
-    environment_id: string;
+    /** Context ID (FK to contexts.id, cascade delete) */
+    context_id: string;
     /** Variable key name */
     key: string;
     /** Variable value */
@@ -683,20 +702,20 @@ export interface EnvironmentVariablesTable {
     /** When this variable was last updated */
     updated_at: Generated<Date>;
 }
-export type EnvironmentVariable = Selectable<EnvironmentVariablesTable>;
-export type NewEnvironmentVariable = Insertable<EnvironmentVariablesTable>;
-export type EnvironmentVariableUpdate = Updateable<EnvironmentVariablesTable>;
+export type ContextVariable = Selectable<ContextVariablesTable>;
+export type NewContextVariable = Insertable<ContextVariablesTable>;
+export type ContextVariableUpdate = Updateable<ContextVariablesTable>;
 /**
- * Environment source overrides table
- * Per-source (routing key) variable overrides within an environment.
+ * Context source overrides table
+ * Per-source (routing key) variable overrides within a context.
  */
-export interface EnvironmentSourceOverridesTable {
+export interface ContextSourceOverridesTable {
     /** UUID primary key */
     id: Generated<string>;
     /** Organization ID */
     org_id: string;
-    /** Environment ID (FK to environments.id, cascade delete) */
-    environment_id: string;
+    /** Context ID (FK to contexts.id, cascade delete) */
+    context_id: string;
     /** Routing key for the source */
     routing_key: string;
     /** Override key name */
@@ -708,9 +727,9 @@ export interface EnvironmentSourceOverridesTable {
     /** When this override was last updated */
     updated_at: Generated<Date>;
 }
-export type EnvironmentSourceOverride = Selectable<EnvironmentSourceOverridesTable>;
-export type NewEnvironmentSourceOverride = Insertable<EnvironmentSourceOverridesTable>;
-export type EnvironmentSourceOverrideUpdate = Updateable<EnvironmentSourceOverridesTable>;
+export type ContextSourceOverride = Selectable<ContextSourceOverridesTable>;
+export type NewContextSourceOverride = Insertable<ContextSourceOverridesTable>;
+export type ContextSourceOverrideUpdate = Updateable<ContextSourceOverridesTable>;
 /**
  * Held runs table
  * Tracks runs waiting for approval, wait timer, or concurrency slot.
@@ -724,13 +743,13 @@ export interface HeldRunsTable {
     run_id: string;
     /** Job ID within the run */
     job_id: string;
-    /** Environment ID (FK to environments.id); null once the environment is deleted */
-    environment_id: string | null;
+    /** Context ID (FK to contexts.id); null once the context is deleted */
+    context_id: string | null;
     /** Hold type: 'approval' | 'wait_timer' | 'concurrency' */
     hold_type: string;
     /** Hold status: 'pending' | 'approved' | 'rejected' | 'expired' | 'released' */
     status: Generated<string>;
-    /** Queue type: 'environment' | 'security' */
+    /** Queue type: 'context' | 'security' */
     queue_type: Generated<string>;
     /** Reason for hold or resolution */
     reason: string | null;
@@ -744,13 +763,13 @@ export interface HeldRunsTable {
     resolved_at: Date | null;
     /**
      * Hold granularity: 'workflow' | 'job' | 'step' (engine `HoldScope`).
-     * Existing environment holds are job-scoped, hence the 'job' default.
+     * Existing context holds are job-scoped, hence the 'job' default.
      */
     hold_scope: Generated<string>;
     /** Step index within the job for step-scoped holds; null otherwise. */
     step_index: number | null;
     /**
-     * What created the hold: 'environment' (mandatory env policy) | 'explicit'
+     * What created the hold: 'context' (mandatory env policy) | 'explicit'
      * (SDK `approval`). Engine `TriggerSource`.
      */
     trigger_source: Generated<string>;
@@ -1303,7 +1322,7 @@ export interface SourcesTable {
      * is the source of truth for both `name` and `slug` on GitHub-App sources.
      */
     slug: string | null;
-    /** Customer/org identifier for secret and environment scoping */
+    /** Customer/org identifier for secret and context scoping */
     customer_id: Generated<string>;
     /** When this source was created */
     created_at: Generated<Date>;

package/dist/github-app-name-refresher/github-app-name-refresher.d.ts

@@ -25,7 +25,7 @@ export interface RefreshableSourceStore {
     }>>;
     getSourceWithSecrets(routingKey: string): Promise<{
         provider: string;
-        config: string;
+        config: string | Record<string, unknown>;
         privateKey: string;
     } | null>;
     updateSource(routingKey: string, updates: {

package/dist/index.js

@@ -1574,20 +1574,35 @@ var AdminApiClient = class {
 	async deleteSecret(orgId, scope, key) {
 		return this.request("DELETE", `/api/v1/admin/secrets/${encodeURIComponent(orgId)}/${encodeURIComponent(scope)}/${encodeURIComponent(key)}`);
 	}
-	async listVariables(orgId, environment) {
+	/**
+	* Create (or upsert) a deployment context. `allowLocalExecution` lets
+	* CLI-initiated / local runs resolve secrets through this context.
+	*/
+	async createContext(data) {
+		return this.request("POST", `/api/v1/admin/contexts`, data);
+	}
+	/**
+	* Bind a scope pattern to a context so its scoped secrets resolve at dispatch.
+	* `hostPattern` defaults to `**` (every host) server-side.
+	*/
+	async bindContext(data) {
+		const { name, ...body } = data;
+		return this.request("POST", `/api/v1/admin/contexts/${encodeURIComponent(name)}/bind`, body);
+	}
+	async listVariables(orgId, context) {
 		const params = new URLSearchParams({ orgId });
-		return this.request("GET", `/api/v1/admin/environments/${encodeURIComponent(environment)}/variables?${params}`);
+		return this.request("GET", `/api/v1/admin/contexts/${encodeURIComponent(context)}/variables?${params}`);
 	}
-	async setVariable(orgId, environment, key, value, locked) {
+	async setVariable(orgId, context, key, value, locked) {
 		const params = new URLSearchParams({ orgId });
-		return this.request("PUT", `/api/v1/admin/environments/${encodeURIComponent(environment)}/variables/${encodeURIComponent(key)}?${params}`, {
+		return this.request("PUT", `/api/v1/admin/contexts/${encodeURIComponent(context)}/variables/${encodeURIComponent(key)}?${params}`, {
 			value,
 			locked
 		});
 	}
-	async deleteVariable(orgId, environment, key) {
+	async deleteVariable(orgId, context, key) {
 		const params = new URLSearchParams({ orgId });
-		return this.request("DELETE", `/api/v1/admin/environments/${encodeURIComponent(environment)}/variables/${encodeURIComponent(key)}?${params}`);
+		return this.request("DELETE", `/api/v1/admin/contexts/${encodeURIComponent(context)}/variables/${encodeURIComponent(key)}?${params}`);
 	}
 	async rotateKey() {
 		return this.request("POST", "/api/v1/admin/rotate-key");

package/dist/metrics/prometheus.d.ts

@@ -12,6 +12,8 @@ export declare function setPendingAttestations(value: number): void;
 export declare function setPendingAttestationOldestAgeSeconds(value: number): void;
 /** Set the current number of terminally-rejected deferred attestations. */
 export declare function setRejectedAttestations(value: number): void;
+/** Record the collation-drift flag (1 = drift, 0 = clean) for a database. */
+export declare function setDbCollationDrift(database: string, drifted: boolean): void;
 interface ScalerUsageRow {
     scaler: string;
     /** Backend type for this scaler (rollup dimension). `__global__` for the orchestrator-wide row. */

package/dist/oidc/id-token-claims.d.ts

@@ -0,0 +1,63 @@
+/**
+ * OIDC ID-token claims for the local dev-signed identity. Mirrors the Platform's
+ * `oidc/id-token-claims.ts` so a dev-signed bundle carries the exact same claim
+ * shape the agent's statement builder + the engine verifier already expect — the
+ * cross-check between the in-toto statement and the token claims is identical to
+ * the Platform-minted path. The only differences are the local sentinel issuer
+ * (`kici-local`) and the org anchor (`__default__`, the plane's default org).
+ */
+import { AttestationOrigin, SourceOrigin } from '@kici-dev/engine';
+/** The subset of an execution_runs row the claims need. */
+export interface RunClaimSource {
+    run_id: string;
+    org_id: string;
+    repo_identifier: string | null;
+    ref: string | null;
+    sha: string | null;
+    workflow_name: string | null;
+    provider: string | null;
+    /** True when the run executed an uploaded local working tree (`kici run remote`). */
+    local_working_tree: boolean;
+}
+/** The subset of an execution_jobs row the claims need. */
+export interface JobClaimSource {
+    run_id: string;
+    job_id: string;
+    orchestrator_id: string | null;
+    status: string;
+}
+export interface BuildClaimsOpts {
+    issuer: string;
+    audience: string;
+    nowSeconds: number;
+    ttlSeconds: number;
+}
+export interface IdTokenClaims {
+    iss: string;
+    sub: string;
+    aud: string;
+    iat: number;
+    nbf: number;
+    exp: number;
+    jti: string;
+    kici_run_id: string;
+    kici_job_id: string;
+    repository: string | null;
+    ref: string | null;
+    sha: string | null;
+    workflow_ref: string | null;
+    orchestrator_id: string | null;
+    org_id: string;
+    source_origin: SourceOrigin;
+    provider: string | null;
+    statement_hash: string | null;
+    attestation_origin: AttestationOrigin;
+}
+/**
+ * Build the OIDC ID-token claims for a build job from the orchestrator's own
+ * execution_runs/execution_jobs rows. The local dev plane only ever mints for a
+ * live (running) job, so `attestation_origin` is always `live` and
+ * `statement_hash` is null (the statement is cross-checked field-by-field).
+ */
+export declare function buildIdTokenClaims(run: RunClaimSource, job: JobClaimSource, opts: BuildClaimsOpts): IdTokenClaims;
+//# sourceMappingURL=id-token-claims.d.ts.map

package/dist/oidc/jwt.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Compact-JWS assembly for the local dev-signed identity. Mirrors the Platform's
+ * `oidc/jwt.ts`: `jose.SignJWT` wants a local KeyLike, but our `LocalSigner`
+ * returns the JOSE-raw r||s ES256 signature directly, so we base64url-assemble
+ * the compact JWS (`header.payload.signature`) by hand.
+ */
+import type { LocalSigner } from './local-dev-signer.js';
+export interface JwsProtectedHeader {
+    alg: 'ES256';
+    kid: string;
+    typ: 'JWT';
+}
+/** Assemble a compact JWS from a protected header + payload, signed by `signer`. */
+export declare function signCompactJws(signer: LocalSigner, protectedHeader: JwsProtectedHeader, payload: Record<string, unknown>): Promise<string>;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/oidc/local-dev-signer.d.ts

@@ -0,0 +1,31 @@
+import { type JWK } from 'jose';
+/** The fixed, non-prod dev-identity issuer. Never `https://api.kici.dev`. */
+export declare const KICI_LOCAL_ISSUER = "kici-local";
+/** Minimal signing seam mirrored from the Platform's `Signer` idiom. */
+export interface LocalSigner {
+    readonly alg: 'ES256';
+    /** Sign `data`, returning the JOSE-raw (r||s) ES256 signature. */
+    sign(data: Uint8Array): Promise<Uint8Array>;
+    /** The public key as a JWK (kty EC, crv P-256, alg ES256, use sig, kid). */
+    getPublicJwk(): JWK;
+    /** RFC 7638 thumbprint of the public JWK — the token-header `kid`. */
+    getKid(): string;
+}
+/**
+ * In-process ES256 signer over a persisted EC P-256 private JWK. NEVER selected
+ * in a Platform-connected deployment; the local dev plane is its only caller.
+ */
+export declare class LocalDevSigner implements LocalSigner {
+    private readonly privateKey;
+    private readonly publicJwk;
+    readonly alg: "ES256";
+    private constructor();
+    /** Build a signer from an EC P-256 private JWK (`{ kty, crv, x, y, d }`). */
+    static fromPrivateJwk(jwk: JWK): Promise<LocalDevSigner>;
+    /** Read + import the private JWK from `path` (the plane's 0600 key file). */
+    static fromFile(path: string): Promise<LocalDevSigner>;
+    sign(data: Uint8Array): Promise<Uint8Array>;
+    getPublicJwk(): JWK;
+    getKid(): string;
+}
+//# sourceMappingURL=local-dev-signer.d.ts.map

package/dist/oidc/local-mint.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Local dev-signed OIDC mint (independent mode only).
+ *
+ * The Platform-connected orchestrator relays `oidc.token.request` to the hosted
+ * Platform, which reads its own run/job rows and mints (`ws/oidc-token-relay.ts`
+ * → `oidc.mint.request`). The offline local dev plane has no Platform, so this
+ * module mints locally: it reads the orchestrator's OWN execution_runs/
+ * execution_jobs rows and signs claims with the in-process `LocalDevSigner`,
+ * issuer `kici-local`.
+ *
+ * Security: this path is registered ONLY when the orchestrator runs in
+ * `independent` mode with a `LocalDevSigner` present, and app.ts registers the
+ * Platform relay in preference (the local path is registered strictly in the
+ * `else` branch), so a Platform-connected orchestrator can never reach the local
+ * signer — it keeps minting via the Platform exactly as today. The agent never
+ * asserts its own claims; every identity claim is read server-side from the
+ * orchestrator's rows, and the job-ownership check is against dispatch state.
+ */
+import type { Kysely } from 'kysely';
+import { type OidcTokenResult } from '@kici-dev/engine/protocol/messages/oidc-token-relay';
+import type { Database } from '../db/types.js';
+import { type IdTokenClaims } from './id-token-claims.js';
+import { type LocalSigner } from './local-dev-signer.js';
+/** ID-token lifetime (seconds). Matches the Platform's 10-minute cap. */
+export declare const LOCAL_ID_TOKEN_TTL_SECONDS = 600;
+/** The org anchor stamped into a local-plane token (the plane's default org). */
+export declare const LOCAL_ORG_ID = "__default__";
+export declare class LocalMintRunNotFoundError extends Error {
+}
+export declare class LocalMintJobNotFoundError extends Error {
+}
+export declare class LocalMintJobNotActiveError extends Error {
+}
+export interface LocalMintDeps {
+    db: Kysely<Database>;
+    signer: LocalSigner;
+    orchestratorId: string;
+    /** Injectable clock (seconds). Defaults to wall-clock. */
+    nowSeconds?: () => number;
+}
+export interface LocalMintInput {
+    runId: string;
+    jobId: string;
+    audience: string;
+}
+export interface LocalMintResult {
+    token: string;
+    expiresIn: number;
+    jti: string;
+    claims: IdTokenClaims;
+}
+/**
+ * Mint a short-lived dev-signed ES256 ID token for (run, job). Every identity
+ * claim is read from the orchestrator's own run/job rows; the token is never
+ * logged.
+ */
+export declare function mintLocalIdToken(deps: LocalMintDeps, input: LocalMintInput): Promise<LocalMintResult>;
+/** Job-ownership resolver surface (the dispatcher's `resolveOwnedJob`). */
+export interface LocalMintOwnershipResolver {
+    resolveOwnedJob(agentId: string, jobId: string): {
+        runId: string;
+    } | undefined;
+}
+export declare class LocalMintRejectedError extends Error {
+}
+export interface LocalOidcTokenHandlerDeps {
+    dispatcher: LocalMintOwnershipResolver;
+    mint: LocalMintDeps;
+}
+/**
+ * Build the agent.api handler for `OIDC_TOKEN_REQUEST_METHOD` in independent
+ * mode. Verifies the agent owns the named job (resolving its runId from the
+ * dispatcher — never trusting an agent-asserted value), then mints locally. A
+ * job the agent does not own is rejected without minting anything.
+ */
+export declare function createLocalOidcTokenHandler(deps: LocalOidcTokenHandlerDeps): (agentId: string, params: Record<string, unknown>) => Promise<OidcTokenResult>;
+//# sourceMappingURL=local-mint.d.ts.map

package/dist/oidc/oidc-mint-registration.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Selects which OIDC-mint handler backs `OIDC_TOKEN_REQUEST_METHOD` — the
+ * anti-forgery choke point for dev-signed identity.
+ *
+ * The rule (enforced here, unit-tested in `oidc-mint-registration.test.ts`):
+ *
+ *  1. **Platform-connected** (platformUrl + token + client) → the **relay**
+ *     handler, minting via the hosted Platform exactly as today.
+ *  2. **Offline local dev plane** (independent identity + a local signer, AND
+ *     NOT Platform-connected) → the **local** dev-signed handler (`kici-local`).
+ *  3. Neither → **no** registration (the method returns "unknown method").
+ *
+ * Case 1 is checked FIRST, so the local signer is UNREACHABLE whenever a
+ * Platform connection exists — even if `KICI_INDEPENDENT_IDENTITY` is somehow
+ * also set. This guarantees no new forgeable mint path appears on a
+ * Platform-connected orchestrator.
+ */
+import type { Kysely } from 'kysely';
+import type { OidcTokenResult } from '@kici-dev/engine/protocol/messages/oidc-token-relay';
+import type { Database } from '../db/types.js';
+import { type MintPlatformClient } from '../ws/oidc-token-relay.js';
+import { type LocalMintOwnershipResolver } from './local-mint.js';
+import type { LocalSigner } from './local-dev-signer.js';
+export type OidcMintHandler = (agentId: string, params: Record<string, unknown>) => Promise<OidcTokenResult>;
+export interface OidcMintRegistration {
+    /** `relay` = Platform-minted; `local` = offline dev-signed (`kici-local`). */
+    kind: 'relay' | 'local';
+    handler: OidcMintHandler;
+}
+export interface OidcMintRegistrationInput {
+    platformUrl?: string;
+    platformToken?: string;
+    platformClient?: MintPlatformClient;
+    independentIdentity: boolean;
+    localOidcSigner?: LocalSigner;
+    dispatcher: LocalMintOwnershipResolver & {
+        resolveOwnedJob(agentId: string, jobId: string): {
+            runId: string;
+        } | undefined;
+    };
+    db: Kysely<Database>;
+    orchestratorId: string;
+    testMode: boolean;
+    testMintDeferAudience?: string;
+    testMintRejectAudience?: string;
+}
+/** Decide which mint handler (if any) backs `OIDC_TOKEN_REQUEST_METHOD`. */
+export declare function selectOidcMintRegistration(input: OidcMintRegistrationInput): OidcMintRegistration | undefined;
+//# sourceMappingURL=oidc-mint-registration.d.ts.map