@kici-dev/orchestrator 0.1.5 → 0.1.6

package/dist/app.d.ts

@@ -34,7 +34,7 @@ import type { PendingBuildTracker } from './cache/index.js';
 import type { PendingInitTracker } from './cache/index.js';
 import type { PendingDynamicTracker } from './cache/index.js';
 import type { CacheStorage } from './storage/types.js';
-import { type CommitStatusReporter } from './reporting/commit-status.js';
+import { type CheckRunReporter } from './reporting/check-run-reporter.js';
 import type { ExecutionTracker } from './reporting/execution-tracker.js';
 import type { LogWriter } from './reporting/log-writer.js';
 import type { LogStorage } from './reporting/log-storage.js';
@@ -108,7 +108,7 @@ export interface AppDependencies {
     /** Pending dynamic tracker for DynamicJobFn evaluation coordination. */
     pendingDynamics?: PendingDynamicTracker;
     /** Commit status reporter for setting pending/success/failure/error on commits. Optional. */
-    commitStatusReporter?: CommitStatusReporter;
+    checkRunReporter?: CheckRunReporter;
     /** Execution tracker for DB persistence of execution state. Optional — requires database. */
     executionTracker?: ExecutionTracker;
     /** Log writer for persisting agent log chunks. Optional — requires database. */
@@ -123,6 +123,12 @@ export interface AppDependencies {
     ownershipTracker?: OwnershipTracker;
     /** Admin API route dependencies. Optional -- only mounted when secrets management is configured. */
     adminDeps?: AdminRouteDeps;
+    /**
+     * Resolves the public webhook URL for a newly added source (for
+     * `kici-admin source add` output). Built by the entry point where the
+     * Platform client + config are in scope; passed into the admin source routes.
+     */
+    resolveSourceWebhookUrl?: AdminRouteDeps['resolveSourceWebhookUrl'];
     /** Config admin API route dependencies. Optional -- mounted when config management is available. */
     configRouteDeps?: ConfigRouteDeps;
     /** Event router for internal event delivery. Optional -- if not set, event routing is inactive. */
@@ -202,7 +208,7 @@ export interface AppDependencies {
 /**
  * In-memory cache for step source locations extracted from lock files.
  * Keyed by `workflowName:jobName`, stores source location arrays indexed by step index.
- * Populated during webhook processing, used by CommitStatusReporter for annotations.
+ * Populated during webhook processing, used by CheckRunReporter for annotations.
  */
 export declare class SourceLocationStore {
     private readonly cache;

package/dist/cli.js

@@ -4214,6 +4214,26 @@ createLogger({ prefix: "universal-git:clone-token" });
 *   --stdin                    Read from stdin
 */
 /**
+* Short reason shown in `(unavailable — <reason>)` when no webhook URL could be
+* resolved for an added source.
+*/
+function webhookNoteReason(note) {
+	switch (note) {
+		case "github-ingress-platform-only": return "this orchestrator runs in independent mode";
+		case "platform-no-public-url": return "the Platform has no public webhook URL configured";
+		case "platform-unavailable": return "could not reach the Platform";
+		default: return "webhook URL could not be determined";
+	}
+}
+/** Actionable next-step hint paired with {@link webhookNoteReason}. */
+function webhookNoteHint(note) {
+	switch (note) {
+		case "github-ingress-platform-only": return "GitHub App ingress is served by the KiCI Platform; find the URL in the dashboard under Sources.";
+		case "platform-unavailable": return "Retry once the orchestrator reconnects, or find the URL in the dashboard under Sources.";
+		default: return "Find the webhook URL in the dashboard under Sources.";
+	}
+}
+/**
 * Resolve a secret value from various input modes.
 * Returns undefined if no input mode is specified.
 */
@@ -4357,7 +4377,16 @@ function registerSourceCommands(program, getClient) {
 				webhookSecret: opts.webhookSecret
 			});
 			if (opts.json) console.log(JSON.stringify(result, null, 2));
-			else console.log(`Source added: ${result.routingKey} (${result.name})`);
+			else {
+				console.log(`Source added: ${result.routingKey} (${result.name})`);
+				if (result.webhookUrl) {
+					console.log(`Webhook URL:  ${result.webhookUrl}`);
+					console.log(`  ↳ Paste this into your GitHub App's "Webhook URL" field.`);
+				} else {
+					console.log(`Webhook URL:  (unavailable — ${webhookNoteReason(result.webhookNote)})`);
+					console.log(`  ↳ ${webhookNoteHint(result.webhookNote)}`);
+				}
+			}
 		} catch (err) {
 			console.error(`Error: ${toErrorMessage(err)}`);
 			process.exit(1);

package/dist/cluster/coordinator.d.ts

@@ -15,7 +15,7 @@ import type { PeerRegistry } from './peer-registry.js';
 import type { PeerClient } from './peer-client.js';
 import type { Dispatcher } from '../agent/dispatcher.js';
 import type { ExecutionTracker } from '../reporting/execution-tracker.js';
-import type { CommitStatusReporter } from '../reporting/commit-status.js';
+import type { CheckRunReporter } from '../reporting/check-run-reporter.js';
 export interface RunContext {
     runId: string;
     deliveryId: string;
@@ -80,7 +80,7 @@ export interface RunCoordinatorDeps {
     peerRegistry: PeerRegistry;
     dispatcher: Dispatcher;
     executionTracker?: ExecutionTracker;
-    commitStatusReporter?: CommitStatusReporter;
+    checkRunReporter?: CheckRunReporter;
     getPeerClient: (instanceId: string) => PeerClient | undefined;
     /** Fallback: send job.reroute via server-side (incoming) peer connection and wait for ACK. */
     sendAndWaitAckViaHandler?: (targetInstanceId: string, msg: JobReroute, timeoutMs: number) => Promise<boolean>;
@@ -95,7 +95,7 @@ export declare class RunCoordinator {
     private readonly peerRegistry;
     private readonly dispatcher;
     private readonly executionTracker?;
-    private readonly commitStatusReporter?;
+    private readonly checkRunReporter?;
     private readonly getPeerClient;
     private readonly sendAndWaitAckViaHandler?;
     private readonly sendToPeerViaHandler?;

package/dist/config.d.ts

@@ -27,6 +27,7 @@ declare const configSchema: z.ZodObject<{
     platformUrl: z.ZodOptional<z.ZodString>;
     platformToken: z.ZodOptional<z.ZodString>;
     dashboardUrl: z.ZodOptional<z.ZodString>;
+    webhookPublicUrl: z.ZodOptional<z.ZodString>;
     databaseUrl: z.ZodDefault<z.ZodString>;
     lockfileCacheMax: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     lockfileCacheTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -225,6 +226,7 @@ export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
     platformUrl?: string | undefined;
     platformToken?: string | undefined;
     dashboardUrl?: string | undefined;
+    webhookPublicUrl?: string | undefined;
     cacheStorageType?: "s3" | "filesystem" | undefined;
     cacheStoragePath?: string | undefined;
     cacheStorageS3Bucket?: string | undefined;

package/dist/db/types.d.ts

@@ -1294,7 +1294,7 @@ export type ColdStoreChunksUpdate = Updateable<ColdStoreChunksTable>;
  * Check-run tracking table (check_run_tracking).
  *
  * HA-safe persistence for the per-coord state previously held in
- * `CommitStatusReporter`'s six in-memory `Map`s. Replacement coord on a
+ * `CheckRunReporter`'s six in-memory `Map`s. Replacement coord on a
  * Raft leader switch reads this table to recover check-run IDs, build
  * creation state, step-progress entries, in-progress-sent timestamps, and
  * the run-id reverse index used for cleanup. A coord crash mid-check-run

package/dist/orchestrator-core.d.ts

@@ -27,7 +27,7 @@ import { ScalerManager } from './scaler/index.js';
 import type { ScalerConfig } from './scaler/index.js';
 import type { CacheStorage } from './storage/index.js';
 import { SourceCache, BuildCoordinator, DepCache, PendingBuildTracker, PendingInitTracker, PendingDynamicTracker } from './cache/index.js';
-import { CommitStatusReporter } from './reporting/commit-status.js';
+import { CheckRunReporter } from './reporting/check-run-reporter.js';
 import { StepLogBuffer } from './reporting/step-log-buffer.js';
 import { type LogStorage } from './reporting/log-storage.js';
 import { ExecutionTracker, type ExecutionTrackerDeps } from './reporting/execution-tracker.js';
@@ -44,6 +44,7 @@ import { EventRouter } from './events/event-router.js';
 import { EventEmitter } from './events/event-emitter.js';
 import { TrustStore } from './events/trust-store.js';
 import { GenericSourceManager } from './webhook/generic-sources.js';
+import { GenericSourcesChangeListener } from './webhook/generic-sources-listener.js';
 import { RegistrationStore } from './registration/registration-store.js';
 import { RegistrationIndex } from './registration/registration-index.js';
 import { CronScheduler } from './cron/cron-scheduler.js';
@@ -73,7 +74,7 @@ export interface OrchestratorSubsystems {
     pendingBuilds: PendingBuildTracker | undefined;
     pendingInits: PendingInitTracker;
     pendingDynamics: PendingDynamicTracker;
-    commitStatusReporter: CommitStatusReporter;
+    checkRunReporter: CheckRunReporter;
     stepLogBuffer: StepLogBuffer;
     sourceLocationStore: SourceLocationStore;
     logStorage: LogStorage;
@@ -114,6 +115,12 @@ export interface OrchestratorSubsystems {
     localConfigVersion: number;
     sourceStore: SourceStore;
     sourceManager: SourceManager;
+    /**
+     * Generic-webhook-source hot-reload listener. Exposed so the platform-mode
+     * boot can wire its `onChange` to re-push the full source list to the
+     * Platform when a generic source is added/removed at runtime.
+     */
+    genericSourcesChangeListener: GenericSourcesChangeListener;
     /** Inbound webhook delivery log writer (event_log table + object-storage payloads). */
     eventLogWriter: EventLogWriter;
     /** Access log writer (read + mutation attribution for dashboard + admin). */

package/dist/pipeline/processor.d.ts

@@ -26,7 +26,7 @@ import type { DepCache } from '../cache/index.js';
 import type { PendingBuildTracker } from '../cache/index.js';
 import type { PendingInitTracker } from '../cache/pending-inits.js';
 import type { PendingDynamicTracker } from '../cache/pending-dynamics.js';
-import type { CommitStatusReporter } from '../reporting/commit-status.js';
+import type { CheckRunReporter } from '../reporting/check-run-reporter.js';
 import type { ExecutionTracker } from '../reporting/execution-tracker.js';
 import type { AgentRegistry } from '../agent/registry.js';
 import type { RunCoordinator } from '../cluster/coordinator.js';
@@ -237,7 +237,7 @@ export interface ProcessingDeps {
     /** Pending dynamic tracker -- waits for agents to evaluate DynamicJobFn and return generated LockJob[]. */
     pendingDynamics?: PendingDynamicTracker;
     /** Commit status reporter for setting pending/success/failure/error on commits. Optional. */
-    commitStatusReporter?: CommitStatusReporter;
+    checkRunReporter?: CheckRunReporter;
     /** Execution tracker for DB persistence. Optional -- if not set, execution tracking is skipped. */
     executionTracker?: ExecutionTracker;
     /** Agent registry for determining execution target platform/arch. Optional -- if not set, defaults to linux/x64. */

package/dist/pipeline/rerun.d.ts

@@ -18,7 +18,7 @@ import type { Dispatcher } from '../agent/dispatcher.js';
 import type { ExecutionTracker } from '../reporting/execution-tracker.js';
 import type { JobQueue } from '../queue/job-queue.js';
 import type { PlatformClient } from '../ws/platform-client.js';
-import type { CommitStatusReporter } from '../reporting/commit-status.js';
+import type { CheckRunReporter } from '../reporting/check-run-reporter.js';
 import type { RunCoordinator } from '../cluster/coordinator.js';
 import type { SecretResolver } from '../secrets/secret-resolver.js';
 import type { EventRouter } from '../events/event-router.js';
@@ -50,7 +50,7 @@ export interface RerunDeps {
     dispatcher: Dispatcher;
     jobQueue: JobQueue;
     platformClient: PlatformClient | null;
-    commitStatusReporter: CommitStatusReporter | null;
+    checkRunReporter: CheckRunReporter | null;
     coordinator: RunCoordinator | null;
     secretResolver: SecretResolver | null;
     eventRouter: EventRouter | null;

package/dist/pipeline/test-pipeline.d.ts

@@ -16,7 +16,7 @@
  */
 import type { LockFileCache } from '../lockfile-cache.js';
 import type { Dispatcher } from '../agent/dispatcher.js';
-import type { CommitStatusReporter } from '../reporting/commit-status.js';
+import type { CheckRunReporter } from '../reporting/check-run-reporter.js';
 import type { ExecutionTracker } from '../reporting/execution-tracker.js';
 import type { AgentRegistry } from '../agent/registry.js';
 import type { ProviderRegistry } from '../provider-registry.js';
@@ -85,7 +85,7 @@ export interface TestPipelineDeps {
     lockFileCache: LockFileCache;
     dispatcher: Dispatcher;
     executionTracker?: ExecutionTracker;
-    commitStatusReporter?: CommitStatusReporter;
+    checkRunReporter?: CheckRunReporter;
     sourceCache?: SourceCache;
     buildCoordinator?: BuildCoordinator;
     depCache?: DepCache;

package/dist/reporting/{commit-status.d.ts → check-run-reporter.d.ts}

@@ -12,7 +12,7 @@
  * Check run IDs are tracked in-memory after creation so that subsequent
  * updates (job complete, workflow complete) can reference them via checks.update().
  *
- * Enriched output (Phase 14):
+ * Enriched output:
  * - Live step progress with checklist-style updates (debounced at 5s)
  * - Failed check runs include step names, error messages, exit codes, and log context
  * - Check run annotations link failures to step source locations in workflow files (.kici/workflows/*.ts)
@@ -22,7 +22,7 @@
  * Note: The engine-level CheckStatusPoster interface (packages/engine/src/provider/check-status-poster.ts)
  * provides a provider-agnostic API for posting security-related check statuses (holds, approvals,
  * workflow modifications). The GitHub implementation is at packages/orchestrator/src/providers/github/check-status-poster.ts.
- * This CommitStatusReporter handles execution lifecycle checks (queued, in_progress, completed per job/workflow).
+ * This CheckRunReporter handles execution lifecycle checks (queued, in_progress, completed per job/workflow).
  * Future cleanup may unify both under CheckStatusPoster, but they serve different purposes today.
  */
 import { type GitHubAppConfig } from '../providers/github/auth.js';
@@ -32,9 +32,9 @@ import { type SourceLocationData } from './check-run-summary.js';
 import type { CheckRunTrackingStore } from './check-run-tracking-store.js';
 import { ExecutionJobStatus } from '@kici-dev/engine';
 /**
- * Dependencies for the CommitStatusReporter.
+ * Dependencies for the CheckRunReporter.
  */
-interface CommitStatusReporterDeps {
+interface CheckRunReporterDeps {
     /**
      * Provider registry for per-routing-key credential lookup.
      * When provided, the reporter resolves GitHub App credentials by routing key
@@ -206,7 +206,7 @@ interface UpdateStepProgressOptions {
  * All public methods are fire-and-forget: they return void immediately
  * and log errors internally without propagating them.
  */
-export declare class CommitStatusReporter {
+export declare class CheckRunReporter {
     private deps;
     /**
      * L1 cache: composite key → check run ID.
@@ -244,7 +244,7 @@ export declare class CommitStatusReporter {
      * still find every key for a runId at cleanup time.
      */
     private readonly runIdToKeys;
-    constructor(deps: CommitStatusReporterDeps);
+    constructor(deps: CheckRunReporterDeps);
     /**
      * Update the provider registry used for per-routing-key credential lookup.
      * Called after config reload when the provider registry is rebuilt.
@@ -457,4 +457,4 @@ export declare class CommitStatusReporter {
  */
 export declare function buildJobFailureDescription(data: Record<string, unknown>): string;
 export {};
-//# sourceMappingURL=commit-status.d.ts.map
+//# sourceMappingURL=check-run-reporter.d.ts.map

package/dist/reporting/check-run-tracking-store.d.ts

@@ -35,11 +35,11 @@ export interface CheckRunTrackingState {
     updatedAt?: Date;
 }
 /**
- * DB persistence for `CommitStatusReporter` check-run state.
+ * DB persistence for `CheckRunReporter` check-run state.
  *
  * Backed by the `check_run_tracking` table — one row per
  * `(provider, owner, repo, sha, check_name)`. Replaces six in-memory
- * `Map`s previously held inside `CommitStatusReporter`:
+ * `Map`s previously held inside `CheckRunReporter`:
  *
  *   - `checkRunIds`            → `check_run_id` column
  *   - `pendingBuildCreations`  → `build_creation_state` column

package/dist/routes/admin-sources.d.ts

@@ -13,6 +13,21 @@ import type { SourceStore } from '../sources/source-store.js';
 import type { Role } from '../secrets/rbac.js';
 interface SourceRouteDeps {
     sourceStore: SourceStore;
+    /**
+     * Resolve the public webhook URL for a freshly added source so the CLI can
+     * print it. Platform/hybrid mode registers the source with the Platform and
+     * reads the URL from the `source.register.ack`; independent mode returns a
+     * null URL with an explanatory `webhookNote`. Omitted in deployments with no
+     * resolver wired (the route then returns `webhookUrl: null`).
+     */
+    resolveSourceWebhookUrl?: (params: {
+        routingKey: string;
+        provider: string;
+        sourceId: string;
+    }) => Promise<{
+        webhookUrl: string | null;
+        webhookNote?: string;
+    }>;
 }
 type AdminSourcesEnv = {
     Variables: {

package/dist/routes/admin.d.ts

@@ -63,6 +63,20 @@ export interface AdminRouteDeps {
     broadcastAgentTokenRevoke?: (tokenId: string) => void;
     /** Optional -- for source management endpoints. */
     sourceStore?: SourceStore;
+    /**
+     * Optional -- resolves the public webhook URL for a newly added source so
+     * `kici-admin source add` can print it. Wired in platform/hybrid mode to
+     * register-and-await the Platform ack; independent mode returns a null URL
+     * with a note.
+     */
+    resolveSourceWebhookUrl?: (params: {
+        routingKey: string;
+        provider: string;
+        sourceId: string;
+    }) => Promise<{
+        webhookUrl: string | null;
+        webhookNote?: string;
+    }>;
     /** Optional -- for DB migration endpoints. */
     db?: Kysely<any>;
     /** Optional -- for DB migration endpoints. */