@kici-dev/orchestrator 0.10.0 → 0.11.0

package/dist/contexts/variable-store.d.ts

@@ -20,6 +20,8 @@ export declare class VariableStore {
     deleteVar(orgId: string, contextId: string, key: string): Promise<void>;
     /** List source overrides for a specific source (routing key). */
     listSourceOverrides(orgId: string, contextId: string, routingKey: string): Promise<ContextSourceOverride[]>;
+    /** List every source override in a context, across all routing keys. */
+    listAllSourceOverrides(orgId: string, contextId: string): Promise<ContextSourceOverride[]>;
     /** Upsert a source override. */
     setSourceOverride(orgId: string, contextId: string, routingKey: string, key: string, value: string): Promise<void>;
     /** Delete a source override. */

package/dist/index.js

@@ -2509,6 +2509,32 @@ var AdminApiClient = class {
 		return this.request("DELETE", `/api/v1/admin/secrets/${encodeURIComponent(orgId)}/${encodeURIComponent(scope)}/${encodeURIComponent(key)}`);
 	}
 	/**
+	* Create an empty secret scope. A `<backend>:` qualifier selects the
+	* backend; an unqualified scope targets the PG backend. Creating a scope
+	* that already exists succeeds and changes nothing.
+	*/
+	async createScope(orgId, scope) {
+		return this.request("POST", "/api/v1/admin/secrets/scopes", {
+			orgId,
+			scope
+		});
+	}
+	/**
+	* Rename a secret scope inside its backend. The route refuses a move between
+	* backends and a rename onto a scope that already exists.
+	*/
+	async renameScope(orgId, oldScope, newScope) {
+		return this.request("PUT", "/api/v1/admin/secrets/scopes/rename", {
+			orgId,
+			oldScope,
+			newScope
+		});
+	}
+	/** Delete a secret scope and every secret in it. */
+	async deleteScope(orgId, scope) {
+		return this.request("DELETE", `/api/v1/admin/secrets/scopes/${encodeURIComponent(orgId)}/${encodeURIComponent(scope)}`);
+	}
+	/**
 	* Create (or upsert) a deployment context. `allowLocalExecution` lets
 	* CLI-initiated / local runs resolve secrets through this context.
 	*/

package/dist/routes/admin-contexts.d.ts

@@ -11,6 +11,12 @@
  *   GET    /api/v1/admin/contexts/:name/variables?orgId=<id>         — list org-level variables
  *   PUT    /api/v1/admin/contexts/:name/variables/:key?orgId=<id>    — upsert variable
  *   DELETE /api/v1/admin/contexts/:name/variables/:key?orgId=<id>    — delete variable
+ *   GET    /api/v1/admin/contexts/:name/source-overrides?orgId=<id>[&routingKey=<k>]
+ *                                                                    — list per-source overrides
+ *   PUT    /api/v1/admin/contexts/:name/source-overrides/:routingKey/:key?orgId=<id>
+ *                                                                    — upsert a source override
+ *   DELETE /api/v1/admin/contexts/:name/source-overrides/:routingKey/:key?orgId=<id>
+ *                                                                    — delete a source override
  *
  * Backs the `kici-admin context` dual-mode CLI. Offline (direct-DB) mode
  * bypasses this router entirely — the CLI calls `*Direct` helpers from

package/dist/routes/admin-registrations.d.ts

@@ -1,8 +1,8 @@
 /**
  * Admin API routes for workflow registration management.
  *
- * Provides endpoints for listing, inspecting, refreshing, and deleting
- * workflow registrations. All routes are protected by Bearer token
+ * Provides endpoints for listing, inspecting, refreshing, disabling and
+ * deleting workflow registrations. All routes are protected by Bearer token
  * authentication via the existing admin auth middleware pattern.
  */
 import { Hono } from 'hono';

package/dist/secrets/audit-logger.d.ts

@@ -32,7 +32,7 @@ export declare class AuditLogger {
      * engine's `shouldRecordSecretResolve` helper) since they're written
      * once per JOB-step secret resolution and dwarf every other action's
      * volume. Denied resolves and every other action (`setSecret`,
-     * `deleteSecret`, `rotateKey`, `secret-outputs.reveal`) bypass the
+     * `deleteSecret`, the scope writes, `rotateKey`, `secret-outputs.reveal`) bypass the
      * sampler — they are transactional with the mutation and must always
      * land.
      *

package/dist/server.js

@@ -43533,6 +43533,10 @@ var init_variable_store = __esmMin((() => {
 		async listSourceOverrides(orgId, contextId, routingKey) {
 			return this.db.selectFrom("context_source_overrides").selectAll().where("org_id", "=", orgId).where("context_id", "=", contextId).where("routing_key", "=", routingKey).execute();
 		}
+		/** List every source override in a context, across all routing keys. */
+		async listAllSourceOverrides(orgId, contextId) {
+			return this.db.selectFrom("context_source_overrides").selectAll().where("org_id", "=", orgId).where("context_id", "=", contextId).orderBy("routing_key", "asc").orderBy("key", "asc").execute();
+		}
 		/** Upsert a source override. */
 		async setSourceOverride(orgId, contextId, routingKey, key, value) {
 			await this.db.insertInto("context_source_overrides").values({
@@ -43596,6 +43600,12 @@ var init_variable_store = __esmMin((() => {
 *   GET    /api/v1/admin/contexts/:name/variables?orgId=<id>         — list org-level variables
 *   PUT    /api/v1/admin/contexts/:name/variables/:key?orgId=<id>    — upsert variable
 *   DELETE /api/v1/admin/contexts/:name/variables/:key?orgId=<id>    — delete variable
+*   GET    /api/v1/admin/contexts/:name/source-overrides?orgId=<id>[&routingKey=<k>]
+*                                                                    — list per-source overrides
+*   PUT    /api/v1/admin/contexts/:name/source-overrides/:routingKey/:key?orgId=<id>
+*                                                                    — upsert a source override
+*   DELETE /api/v1/admin/contexts/:name/source-overrides/:routingKey/:key?orgId=<id>
+*                                                                    — delete a source override
 *
 * Backs the `kici-admin context` dual-mode CLI. Offline (direct-DB) mode
 * bypasses this router entirely — the CLI calls `*Direct` helpers from
@@ -43925,13 +43935,86 @@ function createAdminContextRoutes(deps) {
 			return handleError$5(c, err);
 		}
 	});
+	registerSourceOverrideRoutes(app, deps, envStore, variableStore);
 	return app;
 }
+/**
+* Per-source variable overrides — the operator path for the dashboard's
+* `contexts.source_overrides.*` writes. The context is addressed by name with
+* `?orgId=`, like the variable routes; the stores key it by id.
+*/
+function registerSourceOverrideRoutes(app, deps, envStore, variableStore) {
+	app.get("/contexts/:name/source-overrides", async (c) => {
+		try {
+			deps.rbac.requirePermission(c.get("role"), "secret.read");
+			const orgId = c.req.query("orgId");
+			const routingKey = c.req.query("routingKey");
+			const name = c.req.param("name");
+			if (!orgId) return c.json({ error: "orgId required" }, 400);
+			const env = await envStore.getByName(orgId, name);
+			if (!env) return c.json({ error: `context not found (org=${orgId}, name=${name})` }, 404);
+			const overrides = routingKey ? await variableStore.listSourceOverrides(orgId, env.id, routingKey) : await variableStore.listAllSourceOverrides(orgId, env.id);
+			return c.json({ overrides: overrides.map((o) => ({
+				routing_key: o.routing_key,
+				key: o.key,
+				value: o.value,
+				updated_at: o.updated_at
+			})) });
+		} catch (err) {
+			return handleError$5(c, err);
+		}
+	});
+	app.put("/contexts/:name/source-overrides/:routingKey/:key", async (c) => {
+		try {
+			deps.rbac.requirePermission(c.get("role"), "secret.write");
+			const body = setSourceOverrideSchema.parse(await c.req.json());
+			const orgId = c.req.query("orgId");
+			const name = c.req.param("name");
+			const routingKey = c.req.param("routingKey");
+			const key = c.req.param("key");
+			if (!orgId) return c.json({ error: "orgId required" }, 400);
+			const env = await envStore.getByName(orgId, name);
+			if (!env) return c.json({ error: `context not found (org=${orgId}, name=${name})` }, 404);
+			await variableStore.setSourceOverride(orgId, env.id, routingKey, key, body.value);
+			logger$90.info("context source override set", {
+				orgId,
+				context: name,
+				routingKey,
+				key
+			});
+			return c.json({ set: true });
+		} catch (err) {
+			return handleError$5(c, err);
+		}
+	});
+	app.delete("/contexts/:name/source-overrides/:routingKey/:key", async (c) => {
+		try {
+			deps.rbac.requirePermission(c.get("role"), "secret.delete");
+			const orgId = c.req.query("orgId");
+			const name = c.req.param("name");
+			const routingKey = c.req.param("routingKey");
+			const key = c.req.param("key");
+			if (!orgId) return c.json({ error: "orgId required" }, 400);
+			const env = await envStore.getByName(orgId, name);
+			if (!env) return c.json({ error: `context not found (org=${orgId}, name=${name})` }, 404);
+			await variableStore.deleteSourceOverride(orgId, env.id, routingKey, key);
+			logger$90.info("context source override deleted", {
+				orgId,
+				context: name,
+				routingKey,
+				key
+			});
+			return c.json({ deleted: true });
+		} catch (err) {
+			return handleError$5(c, err);
+		}
+	});
+}
 function handleError$5(c, err) {
 	logger$90.error("admin-contexts route failed", { error: toErrorMessage(err) });
 	return handleAdminError(c, err, logger$90);
 }
-var logger$90, repoPatternsSchema, createContextSchema, bindSchema, setPolicySchema, createTemplateSchema, setVariableSchema;
+var logger$90, repoPatternsSchema, createContextSchema, bindSchema, setPolicySchema, createTemplateSchema, setVariableSchema, setSourceOverrideSchema;
 var init_admin_contexts = __esmMin((() => {
 	init_context_store();
 	init_binding_store();
@@ -43987,6 +44070,7 @@ var init_admin_contexts = __esmMin((() => {
 		value: z.string(),
 		locked: z.boolean().optional()
 	});
+	setSourceOverrideSchema = z.object({ value: z.string() });
 }));
 //#endregion
 //#region src/routes/admin-queue-execution.ts
@@ -44424,6 +44508,18 @@ function createAdminRoutes(deps) {
 			if (scopeError) return c.json({ error: scopeError }, 400);
 			if (!resolved.store.createScope) return c.json({ error: `Backend '${resolved.backendName}' does not support scope creation` }, 400);
 			await resolved.store.createScope(parsed.orgId, resolved.path);
+			await deps.auditLogger.log({
+				action: "createScope",
+				contextName: parsed.scope,
+				routingKey: null,
+				secretKeys: null,
+				outcome: "allowed",
+				runId: null,
+				jobId: null,
+				userId: c.get("userId"),
+				role: c.get("role"),
+				metadata: { orgId: parsed.orgId }
+			});
 			return c.json({ created: true }, 200);
 		} catch (err) {
 			return handleError$3(c, err);
@@ -44448,6 +44544,21 @@ function createAdminRoutes(deps) {
 			if (scopeError) return c.json({ error: scopeError }, 400);
 			if (!from.store.renameScope) return c.json({ error: `Backend '${from.backendName}' does not support scope rename` }, 400);
 			await from.store.renameScope(parsed.orgId, from.path, to.path);
+			await deps.auditLogger.log({
+				action: "renameScope",
+				contextName: parsed.oldScope,
+				routingKey: null,
+				secretKeys: null,
+				outcome: "allowed",
+				runId: null,
+				jobId: null,
+				userId: c.get("userId"),
+				role: c.get("role"),
+				metadata: {
+					orgId: parsed.orgId,
+					newScope: parsed.newScope
+				}
+			});
 			return c.json({ renamed: true }, 200);
 		} catch (err) {
 			return handleError$3(c, err);
@@ -44463,6 +44574,18 @@ function createAdminRoutes(deps) {
 			const resolved = await routeScope(scope);
 			if (!resolved.store.deleteScope) return c.json({ error: `Backend '${resolved.backendName}' does not support scope deletion` }, 400);
 			await resolved.store.deleteScope(orgId, resolved.path);
+			await deps.auditLogger.log({
+				action: "deleteScope",
+				contextName: scope,
+				routingKey: null,
+				secretKeys: null,
+				outcome: "allowed",
+				runId: null,
+				jobId: null,
+				userId: c.get("userId"),
+				role: c.get("role"),
+				metadata: { orgId }
+			});
 			return c.json({ deleted: true }, 200);
 		} catch (err) {
 			return handleError$3(c, err);
@@ -46897,8 +47020,8 @@ var init_satisfiability = __esmMin((() => {
 /**
 * Admin API routes for workflow registration management.
 *
-* Provides endpoints for listing, inspecting, refreshing, and deleting
-* workflow registrations. All routes are protected by Bearer token
+* Provides endpoints for listing, inspecting, refreshing, disabling and
+* deleting workflow registrations. All routes are protected by Bearer token
 * authentication via the existing admin auth middleware pattern.
 */
 /**
@@ -47031,6 +47154,31 @@ function createAdminRegistrationRoutes(deps) {
 			return handleError$1(c, err);
 		}
 	});
+	app.patch("/api/v1/admin/registrations/:id/disable", async (c) => {
+		try {
+			deps.rbac.requirePermission(c.get("role"), "context.update");
+			const id = c.req.param("id");
+			const parsed = disableSchema.parse(await c.req.json());
+			const existing = await deps.registrationStore.getById(id);
+			if (!existing) return c.json({ error: "Registration not found" }, 404);
+			const denied = enforceRoutingKeyScope(c, existing.routing_key);
+			if (denied) return denied;
+			if (!await deps.registrationStore.setDisabled(id, parsed.disabled)) return c.json({ error: "Registration not found" }, 404);
+			const registryVersion = await deps.registrationStore.bumpVersion();
+			await deps.registrationIndex.refreshIfNeeded(registryVersion);
+			logger$82.info("Registration disabled flag set", {
+				id,
+				disabled: parsed.disabled,
+				registryVersion
+			});
+			return c.json({
+				disabled: parsed.disabled,
+				registryVersion
+			}, 200);
+		} catch (err) {
+			return handleError$1(c, err);
+		}
+	});
 	app.delete("/api/v1/admin/registrations/:id", async (c) => {
 		try {
 			deps.rbac.requirePermission(c.get("role"), "context.delete");
@@ -47059,7 +47207,7 @@ function createAdminRegistrationRoutes(deps) {
 function handleError$1(c, err) {
 	return handleAdminError(c, err, logger$82);
 }
-var logger$82, refreshSchema, registerManualSchema;
+var logger$82, refreshSchema, disableSchema, registerManualSchema;
 var init_admin_registrations = __esmMin((() => {
 	init_context_store();
 	init_satisfiability();
@@ -47071,6 +47219,7 @@ var init_admin_registrations = __esmMin((() => {
 		routingKey: z.string().min(1),
 		repoIdentifier: z.string().min(1)
 	});
+	disableSchema = z.object({ disabled: z.boolean() });
 	registerManualSchema = z.object({
 		lockFileContents: z.string().min(1),
 		repoIdentifier: z.string().min(1),
@@ -49272,14 +49421,14 @@ var init_admin_config = __esmMin((() => {
 function createHealthRoutes$1(deps = {}) {
 	return createHealthRoutes({
 		livenessInfo: () => ({
-			version: "0.10.0",
-			buildDate: "2026-09-25T02:21:19.808Z",
-			buildCommit: "4a01d4919",
-			sdkVersion: "0.10.0",
+			version: "0.11.0",
+			buildDate: "2026-09-25T15:27:17.455Z",
+			buildCommit: "399bc9f6b",
+			sdkVersion: "0.11.0",
 			sdkBundleHash: "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d",
-			sharedVersion: "0.10.0",
+			sharedVersion: "0.11.0",
 			sharedBundleHash: "c43dafa78ecdfdff530b94f7f0629d297ce9d9ed71b06b3cb893db87b00aaea7",
-			engineVersion: "0.10.0",
+			engineVersion: "0.11.0",
 			engineBundleHash: "0253acfa2150e263bde9698a0d8e95950cd1d94d95ae5ac3b94180bd9f139d0a"
 		}),
 		readinessCheck: deps.db ? async () => {
@@ -49315,7 +49464,7 @@ function createCapabilitiesRoutes() {
 	const app = new Hono();
 	app.get("/api/v1/capabilities", (c) => {
 		const manifest = {
-			orchestratorVersion: "0.10.0",
+			orchestratorVersion: "0.11.0",
 			protocolVersion: PROTOCOL_VERSION,
 			minProtocolVersion: MIN_PROTOCOL_VERSION
 		};
@@ -60311,7 +60460,7 @@ var init_app = __esmMin((() => {
 	init_log_chunk_sink();
 	init_agent_metrics_aggregator();
 	logger$59 = createLogger({ prefix: "app" });
-	ORCHESTRATOR_VERSION$2 = "0.10.0";
+	ORCHESTRATOR_VERSION$2 = "0.11.0";
 	SourceLocationStore = class {
 		cache = /* @__PURE__ */ new Map();
 		key(workflowName, jobName) {
@@ -68650,7 +68799,7 @@ var logger$45, SOFTWARE_VERSION$1, PeerClient$1;
 var init_peer_client = __esmMin((() => {
 	init_peer_crypto();
 	logger$45 = createLogger({ prefix: "peer-client" });
-	SOFTWARE_VERSION$1 = "0.10.0";
+	SOFTWARE_VERSION$1 = "0.11.0";
 	PeerClient$1 = class {
 		ws = null;
 		_state = "disconnected";
@@ -70664,7 +70813,7 @@ var init_peer_handler = __esmMin((() => {
 	init_peer_crypto();
 	init_join_token();
 	logger$43 = createLogger({ prefix: "peer-handler" });
-	SOFTWARE_VERSION = "0.10.0";
+	SOFTWARE_VERSION = "0.11.0";
 	RATE_LIMIT_MAX = 5;
 	RATE_LIMIT_WINDOW_MS = 6e4;
 }));
@@ -73079,7 +73228,7 @@ var init_audit_logger = __esmMin((() => {
 		* engine's `shouldRecordSecretResolve` helper) since they're written
 		* once per JOB-step secret resolution and dwarf every other action's
 		* volume. Denied resolves and every other action (`setSecret`,
-		* `deleteSecret`, `rotateKey`, `secret-outputs.reveal`) bypass the
+		* `deleteSecret`, the scope writes, `rotateKey`, `secret-outputs.reveal`) bypass the
 		* sampler — they are transactional with the mutation and must always
 		* land.
 		*
@@ -99595,13 +99744,13 @@ var init_worker_core = __esmMin((() => {
 	init_worker_outbox_relay();
 	init_reroute_dispatch();
 	init_app_on_error();
-	ORCHESTRATOR_VERSION$1 = "0.10.0";
-	WORKER_BUILD_COMMIT = "4a01d4919";
-	WORKER_SDK_VERSION = "0.10.0";
+	ORCHESTRATOR_VERSION$1 = "0.11.0";
+	WORKER_BUILD_COMMIT = "399bc9f6b";
+	WORKER_SDK_VERSION = "0.11.0";
 	WORKER_SDK_BUNDLE_HASH = "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d";
-	WORKER_SHARED_VERSION = "0.10.0";
+	WORKER_SHARED_VERSION = "0.11.0";
 	WORKER_SHARED_BUNDLE_HASH = "c43dafa78ecdfdff530b94f7f0629d297ce9d9ed71b06b3cb893db87b00aaea7";
-	WORKER_ENGINE_VERSION = "0.10.0";
+	WORKER_ENGINE_VERSION = "0.11.0";
 	WORKER_ENGINE_BUNDLE_HASH = "0253acfa2150e263bde9698a0d8e95950cd1d94d95ae5ac3b94180bd9f139d0a";
 	logger$2 = createLogger({ prefix: "worker" });
 	DRAIN_TIMEOUT_MS = 3e5;
@@ -99629,13 +99778,13 @@ init_processor();
 init_verify_inbound();
 init_ingest_overflow_types();
 init_scope_routing();
-const ORCHESTRATOR_VERSION = "0.10.0";
-const BUILD_COMMIT = "4a01d4919";
-const SDK_VERSION = "0.10.0";
+const ORCHESTRATOR_VERSION = "0.11.0";
+const BUILD_COMMIT = "399bc9f6b";
+const SDK_VERSION = "0.11.0";
 const SDK_BUNDLE_HASH = "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d";
-const SHARED_VERSION = "0.10.0";
+const SHARED_VERSION = "0.11.0";
 const SHARED_BUNDLE_HASH = "c43dafa78ecdfdff530b94f7f0629d297ce9d9ed71b06b3cb893db87b00aaea7";
-const ENGINE_VERSION = "0.10.0";
+const ENGINE_VERSION = "0.11.0";
 const ENGINE_BUNDLE_HASH = "0253acfa2150e263bde9698a0d8e95950cd1d94d95ae5ac3b94180bd9f139d0a";
 const otelSdk = initTelemetry({
 	serviceName: "kici-orchestrator",