@kici-dev/orchestrator 0.1.26 → 0.2.0

package/dist/config/schema.d.ts

@@ -21,17 +21,18 @@ export declare const localConfigSchema: z.ZodObject<{
     instance: z.ZodOptional<z.ZodObject<{
         id: z.ZodOptional<z.ZodString>;
         mode: z.ZodOptional<z.ZodEnum<{
-            platform: "platform";
             hybrid: "hybrid";
             independent: "independent";
+            observed: "observed";
+            platform: "platform";
         }>>;
     }, z.core.$strip>>;
     server: z.ZodOptional<z.ZodObject<{
         port: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
         basePath: z.ZodOptional<z.ZodString>;
         logLevel: z.ZodOptional<z.ZodEnum<{
-            error: "error";
             debug: "debug";
+            error: "error";
             info: "info";
             warn: "warn";
         }>>;
@@ -65,8 +66,8 @@ export declare const sharedConfigSchema: z.ZodObject<{
         logBucket: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     agentAuth: z.ZodOptional<z.ZodEnum<{
-        token: "token";
         none: "none";
+        token: "token";
     }>>;
     agentTokenTtlMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
     rosterGraceMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
@@ -129,9 +130,10 @@ export type SharedConfigSchemaType = z.infer<typeof sharedConfigSchema>;
 export declare const appConfigSchema: z.ZodObject<{
     instanceId: z.ZodDefault<z.ZodString>;
     mode: z.ZodDefault<z.ZodEnum<{
-        platform: "platform";
         hybrid: "hybrid";
         independent: "independent";
+        observed: "observed";
+        platform: "platform";
     }>>;
     databaseUrl: z.ZodDefault<z.ZodString>;
     port: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -154,8 +156,8 @@ export declare const appConfigSchema: z.ZodObject<{
         logBucket: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     agentAuth: z.ZodDefault<z.ZodEnum<{
-        token: "token";
         none: "none";
+        token: "token";
     }>>;
     agentTokenTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     rosterGraceMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -203,8 +205,8 @@ export declare const appConfigSchema: z.ZodObject<{
     eventRouterCleanupIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     eventLogMaxPayloadBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     logLevel: z.ZodDefault<z.ZodEnum<{
-        error: "error";
         debug: "debug";
+        error: "error";
         info: "info";
         warn: "warn";
     }>>;

package/dist/config/types.d.ts

@@ -6,6 +6,7 @@
  * - SharedConfig: shared settings stored in PostgreSQL config_versions table
  * - AppConfig: merged result type used throughout the codebase
  */
+import type { OrchestratorMode } from '@kici-dev/engine';
 /**
  * Per-orchestrator settings loaded from YAML file.
  * These are instance-specific and never shared across orchestrators.
@@ -16,7 +17,7 @@ export interface LocalConfig {
     };
     instance?: {
         id?: string;
-        mode?: 'platform' | 'hybrid' | 'independent';
+        mode?: OrchestratorMode;
     };
     server?: {
         port?: number;
@@ -107,7 +108,7 @@ export interface AppConfig {
     /** Unique identifier for this orchestrator instance */
     instanceId: string;
     /** Operating mode */
-    mode: 'platform' | 'hybrid' | 'independent';
+    mode: OrchestratorMode;
     /** PostgreSQL connection URL */
     databaseUrl: string;
     /** HTTP server port */

package/dist/config.d.ts

@@ -15,11 +15,23 @@
  * and PgSecretStore, not through config. See SourceStore and SourceManager.
  */
 import { z } from 'zod';
+/**
+ * Validation scope for orchestrator config: a running orchestrator (`runtime`)
+ * vs a build-artifact (agent packaging) operation (`packaging`). Packaging only
+ * needs the object-storage config, so it skips the runtime coordinator/platform
+ * cross-field requirements.
+ */
+export declare const ConfigScope: z.ZodEnum<{
+    packaging: "packaging";
+    runtime: "runtime";
+}>;
+export type ConfigScope = z.infer<typeof ConfigScope>;
 declare const configSchema: z.ZodObject<{
     mode: z.ZodDefault<z.ZodEnum<{
-        platform: "platform";
         hybrid: "hybrid";
         independent: "independent";
+        observed: "observed";
+        platform: "platform";
     }>>;
     port: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     basePath: z.ZodDefault<z.ZodString>;
@@ -28,19 +40,56 @@ declare const configSchema: z.ZodObject<{
     platformToken: z.ZodOptional<z.ZodString>;
     dashboardUrl: z.ZodOptional<z.ZodString>;
     provenanceIssuer: z.ZodOptional<z.ZodString>;
+    provenanceSigningIssuer: z.ZodOptional<z.ZodString>;
+    provenanceSignerKind: z.ZodOptional<z.ZodString>;
+    provenanceKmsKeyArn: z.ZodOptional<z.ZodString>;
+    provenanceKmsRegion: z.ZodOptional<z.ZodString>;
+    provenanceKmsAccessKeyId: z.ZodOptional<z.ZodString>;
+    provenanceKmsSecretAccessKey: z.ZodOptional<z.ZodString>;
+    provenanceSignerCommand: z.ZodOptional<z.ZodString>;
     webhookPublicUrl: z.ZodOptional<z.ZodString>;
+    orchestratorUrl: z.ZodOptional<z.ZodString>;
     databaseUrl: z.ZodDefault<z.ZodString>;
+    dbPoolMax: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    dbPoolAcquireTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    dbStatementTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     lockfileCacheMax: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     lockfileCacheTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    lockfileCacheMaxBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     queueMaxDepth: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     queueTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     queueBackpressureThreshold: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     workerConcurrency: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     concurrencyWaitTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     dispatchAckTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ownershipDbCheckTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestMaxConcurrency: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestMaxQueueDepth: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestCodelTargetMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestCodelIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestQueueMaxWaitMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestLoopLagShedMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestLoopLagResumeMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestLoopLagSampleMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestOrgMaxConcurrency: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestOverflowEnabled: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        false: "false";
+        true: "true";
+    }>>, z.ZodTransform<boolean, "false" | "true">>;
+    ingestOverflowMax: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestOverflowReplayIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestOverflowReplayBatch: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestOverflowMaxAttempts: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    rerouteSpawnWindowMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    rerouteAckTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    rerouteMaxHops: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    rerouteFlapGraceMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    scalerSpawnTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    backupStalenessWarnHours: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    scalerPendingSweepIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     cacheStorageType: z.ZodOptional<z.ZodEnum<{
-        s3: "s3";
         filesystem: "filesystem";
+        s3: "s3";
     }>>;
     cacheStoragePath: z.ZodOptional<z.ZodString>;
     cacheStorageS3Bucket: z.ZodOptional<z.ZodString>;
@@ -50,17 +99,28 @@ declare const configSchema: z.ZodObject<{
     cacheStorageS3ExternalEndpoint: z.ZodOptional<z.ZodString>;
     cacheStorageS3UploadEndpoint: z.ZodOptional<z.ZodString>;
     cacheStorageS3ForcePathStyle: z.ZodOptional<z.ZodPipe<z.ZodEnum<{
-        true: "true";
         false: "false";
-    }>, z.ZodTransform<boolean, "true" | "false">>>;
+        true: "true";
+    }>, z.ZodTransform<boolean, "false" | "true">>>;
+    agentBinarySource: z.ZodOptional<z.ZodString>;
     cacheStorageFsPath: z.ZodOptional<z.ZodString>;
     cacheStorageFsBaseUrl: z.ZodOptional<z.ZodString>;
     logStorageS3Bucket: z.ZodOptional<z.ZodString>;
+    logSegmentFlushBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    logSegmentFlushMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     cacheTtlDays: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    dispatchQueueTtlDays: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    stepLogTtlDays: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    checkRunTrackingTtlDays: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    reconnectReplayWindowHours: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     cacheBuildTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     cacheMaxTarballBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     userCacheQuotaBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     userCacheTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    artifactQuotaBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    artifactTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    artifactMaxBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    artifactMaxPerRun: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     webhookPayloadDir: z.ZodOptional<z.ZodString>;
     dataDir: z.ZodOptional<z.ZodString>;
     scalerConfigPath: z.ZodOptional<z.ZodString>;
@@ -75,13 +135,22 @@ declare const configSchema: z.ZodObject<{
     secretKeyOld: z.ZodOptional<z.ZodString>;
     secretKeyFileOld: z.ZodOptional<z.ZodString>;
     bootstrapAdminToken: z.ZodOptional<z.ZodString>;
-    pgCustomerSecrets: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+    independentSecrets: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        false: "false";
+        true: "true";
+    }>>, z.ZodTransform<boolean, "false" | "true">>;
+    independentIdentity: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        false: "false";
         true: "true";
+    }>>, z.ZodTransform<boolean, "false" | "true">>;
+    devIdentityKeyFile: z.ZodOptional<z.ZodString>;
+    pgCustomerSecrets: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
         false: "false";
-    }>>, z.ZodTransform<boolean, "true" | "false">>;
+        true: "true";
+    }>>, z.ZodTransform<boolean, "false" | "true">>;
     agentAuth: z.ZodDefault<z.ZodEnum<{
-        token: "token";
         none: "none";
+        token: "token";
     }>>;
     agentTokenTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     rosterGraceMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -101,10 +170,211 @@ declare const configSchema: z.ZodObject<{
     testMode: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<boolean, string>>;
     testEventFailFirstN: z.ZodOptional<z.ZodString>;
     testMintDeferAudience: z.ZodOptional<z.ZodString>;
+    testMintRejectAudience: z.ZodOptional<z.ZodString>;
+    testRerunDelayMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    testOmitDashboardRequestTypes: z.ZodOptional<z.ZodString>;
     eventLogMaxPayloadBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    maxGithubPayloadBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    lockFileMaxBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    webhookDedupTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    contributorCacheTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    clusterSettingsCacheTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     logLevel: z.ZodDefault<z.ZodEnum<{
+        debug: "debug";
         error: "error";
+        info: "info";
+        warn: "warn";
+    }>>;
+    nodeEnv: z.ZodDefault<z.ZodEnum<{
+        development: "development";
+        production: "production";
+        test: "test";
+    }>>;
+    autoMigrate: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<boolean, string>>;
+    agentMaxReconnectDelayMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    skipS3SentinelValidation: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<boolean, string>>;
+    otelExporterOtlpEndpoint: z.ZodOptional<z.ZodString>;
+    clusterName: z.ZodOptional<z.ZodString>;
+    cluster: z.ZodPrefault<z.ZodObject<{
+        instanceId: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        address: z.ZodOptional<z.ZodString>;
+        joinToken: z.ZodOptional<z.ZodString>;
+        credentialFile: z.ZodDefault<z.ZodString>;
+        autoRotateCredentials: z.ZodDefault<z.ZodBoolean>;
+        peers: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string[], string | undefined>>;
+        raftElectionTimeoutMinMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+        raftElectionTimeoutMaxMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+        raftHeartbeatMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+        peerHeartbeatIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+        peerMaxReconnectDelayMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+        role: z.ZodDefault<z.ZodEnum<{
+            coordinator: "coordinator";
+            worker: "worker";
+        }>>;
+        coordinatorUrl: z.ZodOptional<z.ZodString>;
+        coordinatorUrls: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string[], string | undefined>>;
+        peerStaleTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+        electionGracePeriodMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+        singleNode: z.ZodPipe<z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>, z.ZodTransform<boolean, string | boolean>>;
+        trustedProxies: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<string[], string>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const packagingConfigSchema: z.ZodObject<{
+    mode: z.ZodDefault<z.ZodEnum<{
+        hybrid: "hybrid";
+        independent: "independent";
+        observed: "observed";
+        platform: "platform";
+    }>>;
+    port: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    basePath: z.ZodDefault<z.ZodString>;
+    tlsCertPath: z.ZodOptional<z.ZodString>;
+    platformUrl: z.ZodOptional<z.ZodString>;
+    platformToken: z.ZodOptional<z.ZodString>;
+    dashboardUrl: z.ZodOptional<z.ZodString>;
+    provenanceIssuer: z.ZodOptional<z.ZodString>;
+    provenanceSigningIssuer: z.ZodOptional<z.ZodString>;
+    provenanceSignerKind: z.ZodOptional<z.ZodString>;
+    provenanceKmsKeyArn: z.ZodOptional<z.ZodString>;
+    provenanceKmsRegion: z.ZodOptional<z.ZodString>;
+    provenanceKmsAccessKeyId: z.ZodOptional<z.ZodString>;
+    provenanceKmsSecretAccessKey: z.ZodOptional<z.ZodString>;
+    provenanceSignerCommand: z.ZodOptional<z.ZodString>;
+    webhookPublicUrl: z.ZodOptional<z.ZodString>;
+    orchestratorUrl: z.ZodOptional<z.ZodString>;
+    databaseUrl: z.ZodDefault<z.ZodString>;
+    dbPoolMax: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    dbPoolAcquireTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    dbStatementTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    lockfileCacheMax: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    lockfileCacheTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    lockfileCacheMaxBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    queueMaxDepth: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    queueTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    queueBackpressureThreshold: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    workerConcurrency: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    concurrencyWaitTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    dispatchAckTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ownershipDbCheckTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestMaxConcurrency: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestMaxQueueDepth: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestCodelTargetMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestCodelIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestQueueMaxWaitMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestLoopLagShedMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestLoopLagResumeMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestLoopLagSampleMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestOrgMaxConcurrency: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestOverflowEnabled: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        false: "false";
+        true: "true";
+    }>>, z.ZodTransform<boolean, "false" | "true">>;
+    ingestOverflowMax: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestOverflowReplayIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestOverflowReplayBatch: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ingestOverflowMaxAttempts: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    rerouteSpawnWindowMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    rerouteAckTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    rerouteMaxHops: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    rerouteFlapGraceMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    scalerSpawnTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    backupStalenessWarnHours: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    scalerPendingSweepIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    cacheStorageType: z.ZodOptional<z.ZodEnum<{
+        filesystem: "filesystem";
+        s3: "s3";
+    }>>;
+    cacheStoragePath: z.ZodOptional<z.ZodString>;
+    cacheStorageS3Bucket: z.ZodOptional<z.ZodString>;
+    cacheStorageS3Prefix: z.ZodDefault<z.ZodString>;
+    cacheStorageS3Region: z.ZodOptional<z.ZodString>;
+    cacheStorageS3Endpoint: z.ZodOptional<z.ZodString>;
+    cacheStorageS3ExternalEndpoint: z.ZodOptional<z.ZodString>;
+    cacheStorageS3UploadEndpoint: z.ZodOptional<z.ZodString>;
+    cacheStorageS3ForcePathStyle: z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        false: "false";
+        true: "true";
+    }>, z.ZodTransform<boolean, "false" | "true">>>;
+    agentBinarySource: z.ZodOptional<z.ZodString>;
+    cacheStorageFsPath: z.ZodOptional<z.ZodString>;
+    cacheStorageFsBaseUrl: z.ZodOptional<z.ZodString>;
+    logStorageS3Bucket: z.ZodOptional<z.ZodString>;
+    logSegmentFlushBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    logSegmentFlushMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    cacheTtlDays: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    dispatchQueueTtlDays: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    stepLogTtlDays: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    checkRunTrackingTtlDays: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    reconnectReplayWindowHours: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    cacheBuildTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    cacheMaxTarballBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    userCacheQuotaBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    userCacheTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    artifactQuotaBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    artifactTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    artifactMaxBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    artifactMaxPerRun: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    webhookPayloadDir: z.ZodOptional<z.ZodString>;
+    dataDir: z.ZodOptional<z.ZodString>;
+    scalerConfigPath: z.ZodOptional<z.ZodString>;
+    scalerConfigDir: z.ZodOptional<z.ZodString>;
+    machineLedgerDir: z.ZodOptional<z.ZodString>;
+    staleDetectorScanIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    staleDetectorThresholdMultiplier: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    jobHeartbeatIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    githubAppNameRefreshIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    secretKey: z.ZodOptional<z.ZodString>;
+    secretKeyFile: z.ZodOptional<z.ZodString>;
+    secretKeyOld: z.ZodOptional<z.ZodString>;
+    secretKeyFileOld: z.ZodOptional<z.ZodString>;
+    bootstrapAdminToken: z.ZodOptional<z.ZodString>;
+    independentSecrets: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        false: "false";
+        true: "true";
+    }>>, z.ZodTransform<boolean, "false" | "true">>;
+    independentIdentity: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        false: "false";
+        true: "true";
+    }>>, z.ZodTransform<boolean, "false" | "true">>;
+    devIdentityKeyFile: z.ZodOptional<z.ZodString>;
+    pgCustomerSecrets: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        false: "false";
+        true: "true";
+    }>>, z.ZodTransform<boolean, "false" | "true">>;
+    agentAuth: z.ZodDefault<z.ZodEnum<{
+        none: "none";
+        token: "token";
+    }>>;
+    agentTokenTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    rosterGraceMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    rosterTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    hostRebootDeadlineMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    orchestratorHostAgentId: z.ZodOptional<z.ZodString>;
+    maxFanoutHosts: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    eventRouterMaxChainDepth: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    eventRouterRateLimitPerWorkflowPerMinute: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    eventRouterEventTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    eventRouterCleanupIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    eventRouterMaxDispatchAttempts: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    eventRouterLeaseDurationMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    eventRouterRetryBaseBackoffMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    eventRouterRetryMaxBackoffMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    eventRouterRetryScanIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    testMode: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<boolean, string>>;
+    testEventFailFirstN: z.ZodOptional<z.ZodString>;
+    testMintDeferAudience: z.ZodOptional<z.ZodString>;
+    testMintRejectAudience: z.ZodOptional<z.ZodString>;
+    testRerunDelayMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    testOmitDashboardRequestTypes: z.ZodOptional<z.ZodString>;
+    eventLogMaxPayloadBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    maxGithubPayloadBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    lockFileMaxBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    webhookDedupTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    contributorCacheTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    clusterSettingsCacheTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    logLevel: z.ZodDefault<z.ZodEnum<{
         debug: "debug";
+        error: "error";
         info: "info";
         warn: "warn";
     }>>;
@@ -181,34 +451,110 @@ export type AppConfig = z.infer<typeof configSchema> & {
  * so cross-field rules still fire.
  */
 export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
-    mode: "platform" | "hybrid" | "independent";
+    mode: "hybrid" | "independent" | "observed" | "platform";
     port: number;
     basePath: string;
+    tlsCertPath?: string | undefined;
+    platformUrl?: string | undefined;
+    platformToken?: string | undefined;
+    dashboardUrl?: string | undefined;
+    provenanceIssuer?: string | undefined;
+    provenanceSigningIssuer?: string | undefined;
+    provenanceSignerKind?: string | undefined;
+    provenanceKmsKeyArn?: string | undefined;
+    provenanceKmsRegion?: string | undefined;
+    provenanceKmsAccessKeyId?: string | undefined;
+    provenanceKmsSecretAccessKey?: string | undefined;
+    provenanceSignerCommand?: string | undefined;
+    webhookPublicUrl?: string | undefined;
+    orchestratorUrl?: string | undefined;
     databaseUrl: string;
+    dbPoolMax: number;
+    dbPoolAcquireTimeoutMs: number;
+    dbStatementTimeoutMs: number;
     lockfileCacheMax: number;
     lockfileCacheTtlMs: number;
+    lockfileCacheMaxBytes: number;
     queueMaxDepth: number;
     queueTimeoutMs: number;
     queueBackpressureThreshold: number;
     workerConcurrency: number;
     concurrencyWaitTimeoutMs: number;
     dispatchAckTimeoutMs: number;
+    ownershipDbCheckTimeoutMs: number;
+    ingestMaxConcurrency: number;
+    ingestMaxQueueDepth: number;
+    ingestCodelTargetMs: number;
+    ingestCodelIntervalMs: number;
+    ingestQueueMaxWaitMs: number;
+    ingestLoopLagShedMs: number;
+    ingestLoopLagResumeMs: number;
+    ingestLoopLagSampleMs: number;
+    ingestOrgMaxConcurrency: number;
+    ingestOverflowEnabled: boolean;
+    ingestOverflowMax: number;
+    ingestOverflowReplayIntervalMs: number;
+    ingestOverflowReplayBatch: number;
+    ingestOverflowMaxAttempts: number;
+    rerouteSpawnWindowMs: number;
+    rerouteAckTimeoutMs: number;
+    rerouteMaxHops: number;
+    rerouteFlapGraceMs: number;
+    scalerSpawnTimeoutMs: number;
+    backupStalenessWarnHours: number;
+    scalerPendingSweepIntervalMs: number;
+    cacheStorageType?: "filesystem" | "s3" | undefined;
+    cacheStoragePath?: string | undefined;
+    cacheStorageS3Bucket?: string | undefined;
     cacheStorageS3Prefix: string;
+    cacheStorageS3Region?: string | undefined;
+    cacheStorageS3Endpoint?: string | undefined;
+    cacheStorageS3ExternalEndpoint?: string | undefined;
+    cacheStorageS3UploadEndpoint?: string | undefined;
+    cacheStorageS3ForcePathStyle?: boolean | undefined;
+    agentBinarySource?: string | undefined;
+    cacheStorageFsPath?: string | undefined;
+    cacheStorageFsBaseUrl?: string | undefined;
+    logStorageS3Bucket?: string | undefined;
+    logSegmentFlushBytes: number;
+    logSegmentFlushMs: number;
     cacheTtlDays: number;
+    dispatchQueueTtlDays: number;
+    stepLogTtlDays: number;
+    checkRunTrackingTtlDays: number;
+    reconnectReplayWindowHours: number;
     cacheBuildTimeoutMs: number;
     cacheMaxTarballBytes: number;
     userCacheQuotaBytes: number;
     userCacheTtlMs: number;
+    artifactQuotaBytes: number;
+    artifactTtlMs: number;
+    artifactMaxBytes: number;
+    artifactMaxPerRun: number;
+    webhookPayloadDir?: string | undefined;
+    dataDir?: string | undefined;
+    scalerConfigPath?: string | undefined;
+    scalerConfigDir?: string | undefined;
+    machineLedgerDir?: string | undefined;
     staleDetectorScanIntervalMs: number;
     staleDetectorThresholdMultiplier: number;
     jobHeartbeatIntervalMs: number;
     githubAppNameRefreshIntervalMs: number;
+    secretKey?: string | undefined;
+    secretKeyFile?: string | undefined;
+    secretKeyOld?: string | undefined;
+    secretKeyFileOld?: string | undefined;
+    bootstrapAdminToken?: string | undefined;
+    independentSecrets: boolean;
+    independentIdentity: boolean;
+    devIdentityKeyFile?: string | undefined;
     pgCustomerSecrets: boolean;
-    agentAuth: "token" | "none";
+    agentAuth: "none" | "token";
     agentTokenTtlMs: number;
     rosterGraceMs: number;
     rosterTtlMs: number;
     hostRebootDeadlineMs: number;
+    orchestratorHostAgentId?: string | undefined;
     maxFanoutHosts: number;
     eventRouterMaxChainDepth: number;
     eventRouterRateLimitPerWorkflowPerMinute: number;
@@ -220,14 +566,28 @@ export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
     eventRouterRetryMaxBackoffMs: number;
     eventRouterRetryScanIntervalMs: number;
     testMode: boolean;
+    testEventFailFirstN?: string | undefined;
+    testMintDeferAudience?: string | undefined;
+    testMintRejectAudience?: string | undefined;
+    testRerunDelayMs?: number | undefined;
+    testOmitDashboardRequestTypes?: string | undefined;
     eventLogMaxPayloadBytes: number;
-    logLevel: "error" | "debug" | "info" | "warn";
+    maxGithubPayloadBytes: number;
+    lockFileMaxBytes: number;
+    webhookDedupTtlMs: number;
+    contributorCacheTtlMs: number;
+    clusterSettingsCacheTtlMs: number;
+    logLevel: "debug" | "error" | "info" | "warn";
     nodeEnv: "development" | "production" | "test";
     autoMigrate: boolean;
     agentMaxReconnectDelayMs: number;
     skipS3SentinelValidation: boolean;
+    otelExporterOtlpEndpoint?: string | undefined;
+    clusterName?: string | undefined;
     cluster: {
         instanceId: string;
+        address?: string | undefined;
+        joinToken?: string | undefined;
         credentialFile: string;
         autoRotateCredentials: boolean;
         peers: string[];
@@ -237,48 +597,14 @@ export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
         peerHeartbeatIntervalMs: number;
         peerMaxReconnectDelayMs: number;
         role: "coordinator" | "worker";
+        coordinatorUrl?: string | undefined;
         coordinatorUrls: string[];
         peerStaleTimeoutMs: number;
         electionGracePeriodMs: number;
         singleNode: boolean;
         trustedProxies: string[];
-        address?: string | undefined;
-        joinToken?: string | undefined;
-        coordinatorUrl?: string | undefined;
     };
-    tlsCertPath?: string | undefined;
-    platformUrl?: string | undefined;
-    platformToken?: string | undefined;
-    dashboardUrl?: string | undefined;
-    provenanceIssuer?: string | undefined;
-    webhookPublicUrl?: string | undefined;
-    cacheStorageType?: "s3" | "filesystem" | undefined;
-    cacheStoragePath?: string | undefined;
-    cacheStorageS3Bucket?: string | undefined;
-    cacheStorageS3Region?: string | undefined;
-    cacheStorageS3Endpoint?: string | undefined;
-    cacheStorageS3ExternalEndpoint?: string | undefined;
-    cacheStorageS3UploadEndpoint?: string | undefined;
-    cacheStorageS3ForcePathStyle?: boolean | undefined;
-    cacheStorageFsPath?: string | undefined;
-    cacheStorageFsBaseUrl?: string | undefined;
-    logStorageS3Bucket?: string | undefined;
-    webhookPayloadDir?: string | undefined;
-    dataDir?: string | undefined;
-    scalerConfigPath?: string | undefined;
-    scalerConfigDir?: string | undefined;
-    machineLedgerDir?: string | undefined;
-    secretKey?: string | undefined;
-    secretKeyFile?: string | undefined;
-    secretKeyOld?: string | undefined;
-    secretKeyFileOld?: string | undefined;
-    bootstrapAdminToken?: string | undefined;
-    orchestratorHostAgentId?: string | undefined;
-    testEventFailFirstN?: string | undefined;
-    testMintDeferAudience?: string | undefined;
-    otelExporterOtlpEndpoint?: string | undefined;
-    clusterName?: string | undefined;
 }>;
-export declare function loadConfig(): AppConfig;
+export declare function loadConfig(scope?: ConfigScope): AppConfig;
 export {};
 //# sourceMappingURL=config.d.ts.map

package/dist/contexts/binding-store.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Binding store -- scope-to-context binding CRUD.
+ *
+ * Bindings map scope patterns (e.g. 'aws/prod/**') to contexts,
+ * controlling which scoped secrets are available in each context.
+ */
+import type { Kysely } from 'kysely';
+import type { Database, ContextBinding } from '../db/types.js';
+/**
+ * A scope→context binding with its host selector. `hostPattern` defaults to
+ * `'**'` (all hosts) when omitted.
+ */
+export interface BindingInput {
+    scopePattern: string;
+    hostPattern?: string;
+}
+/**
+ * Data access layer for context bindings.
+ */
+export declare class BindingStore {
+    private readonly db;
+    constructor(db: Kysely<Database>);
+    /** List all bindings for an context. */
+    list(orgId: string, contextId: string): Promise<ContextBinding[]>;
+    /**
+     * Replace all bindings for an context in a transaction.
+     *
+     * Deletes existing bindings and inserts the new set atomically. Each binding
+     * carries a `scopePattern` and an optional `hostPattern` (defaulting to
+     * `'**'`). Pass an empty array to clear all bindings.
+     */
+    set(orgId: string, contextId: string, bindings: BindingInput[]): Promise<void>;
+    /** Find bindings for an context (alias for list, used by secret resolver). */
+    findBindingsForContext(orgId: string, contextId: string): Promise<ContextBinding[]>;
+}
+//# sourceMappingURL=binding-store.d.ts.map