@kici-dev/orchestrator 0.10.0 → 0.11.0

package/dist/standalone.js

@@ -1363,7 +1363,7 @@ var logger$147, SOFTWARE_VERSION$1, PeerClient$1;
 var init_peer_client = __esmMin((() => {
 	init_peer_crypto();
 	logger$147 = createLogger({ prefix: "peer-client" });
-	SOFTWARE_VERSION$1 = "0.10.0";
+	SOFTWARE_VERSION$1 = "0.11.0";
 	PeerClient$1 = class {
 		ws = null;
 		_state = "disconnected";
@@ -3377,7 +3377,7 @@ var init_peer_handler = __esmMin((() => {
 	init_peer_crypto();
 	init_join_token();
 	logger$145 = createLogger({ prefix: "peer-handler" });
-	SOFTWARE_VERSION = "0.10.0";
+	SOFTWARE_VERSION = "0.11.0";
 	RATE_LIMIT_MAX = 5;
 	RATE_LIMIT_WINDOW_MS = 6e4;
 }));
@@ -63401,6 +63401,10 @@ var init_variable_store = __esmMin((() => {
 		async listSourceOverrides(orgId, contextId, routingKey) {
 			return this.db.selectFrom("context_source_overrides").selectAll().where("org_id", "=", orgId).where("context_id", "=", contextId).where("routing_key", "=", routingKey).execute();
 		}
+		/** List every source override in a context, across all routing keys. */
+		async listAllSourceOverrides(orgId, contextId) {
+			return this.db.selectFrom("context_source_overrides").selectAll().where("org_id", "=", orgId).where("context_id", "=", contextId).orderBy("routing_key", "asc").orderBy("key", "asc").execute();
+		}
 		/** Upsert a source override. */
 		async setSourceOverride(orgId, contextId, routingKey, key, value) {
 			await this.db.insertInto("context_source_overrides").values({
@@ -63464,6 +63468,12 @@ var init_variable_store = __esmMin((() => {
 *   GET    /api/v1/admin/contexts/:name/variables?orgId=<id>         — list org-level variables
 *   PUT    /api/v1/admin/contexts/:name/variables/:key?orgId=<id>    — upsert variable
 *   DELETE /api/v1/admin/contexts/:name/variables/:key?orgId=<id>    — delete variable
+*   GET    /api/v1/admin/contexts/:name/source-overrides?orgId=<id>[&routingKey=<k>]
+*                                                                    — list per-source overrides
+*   PUT    /api/v1/admin/contexts/:name/source-overrides/:routingKey/:key?orgId=<id>
+*                                                                    — upsert a source override
+*   DELETE /api/v1/admin/contexts/:name/source-overrides/:routingKey/:key?orgId=<id>
+*                                                                    — delete a source override
 *
 * Backs the `kici-admin context` dual-mode CLI. Offline (direct-DB) mode
 * bypasses this router entirely — the CLI calls `*Direct` helpers from
@@ -63793,13 +63803,86 @@ function createAdminContextRoutes(deps) {
 			return handleError$5(c, err);
 		}
 	});
+	registerSourceOverrideRoutes(app, deps, envStore, variableStore);
 	return app;
 }
+/**
+* Per-source variable overrides — the operator path for the dashboard's
+* `contexts.source_overrides.*` writes. The context is addressed by name with
+* `?orgId=`, like the variable routes; the stores key it by id.
+*/
+function registerSourceOverrideRoutes(app, deps, envStore, variableStore) {
+	app.get("/contexts/:name/source-overrides", async (c) => {
+		try {
+			deps.rbac.requirePermission(c.get("role"), "secret.read");
+			const orgId = c.req.query("orgId");
+			const routingKey = c.req.query("routingKey");
+			const name = c.req.param("name");
+			if (!orgId) return c.json({ error: "orgId required" }, 400);
+			const env = await envStore.getByName(orgId, name);
+			if (!env) return c.json({ error: `context not found (org=${orgId}, name=${name})` }, 404);
+			const overrides = routingKey ? await variableStore.listSourceOverrides(orgId, env.id, routingKey) : await variableStore.listAllSourceOverrides(orgId, env.id);
+			return c.json({ overrides: overrides.map((o) => ({
+				routing_key: o.routing_key,
+				key: o.key,
+				value: o.value,
+				updated_at: o.updated_at
+			})) });
+		} catch (err) {
+			return handleError$5(c, err);
+		}
+	});
+	app.put("/contexts/:name/source-overrides/:routingKey/:key", async (c) => {
+		try {
+			deps.rbac.requirePermission(c.get("role"), "secret.write");
+			const body = setSourceOverrideSchema.parse(await c.req.json());
+			const orgId = c.req.query("orgId");
+			const name = c.req.param("name");
+			const routingKey = c.req.param("routingKey");
+			const key = c.req.param("key");
+			if (!orgId) return c.json({ error: "orgId required" }, 400);
+			const env = await envStore.getByName(orgId, name);
+			if (!env) return c.json({ error: `context not found (org=${orgId}, name=${name})` }, 404);
+			await variableStore.setSourceOverride(orgId, env.id, routingKey, key, body.value);
+			logger$53.info("context source override set", {
+				orgId,
+				context: name,
+				routingKey,
+				key
+			});
+			return c.json({ set: true });
+		} catch (err) {
+			return handleError$5(c, err);
+		}
+	});
+	app.delete("/contexts/:name/source-overrides/:routingKey/:key", async (c) => {
+		try {
+			deps.rbac.requirePermission(c.get("role"), "secret.delete");
+			const orgId = c.req.query("orgId");
+			const name = c.req.param("name");
+			const routingKey = c.req.param("routingKey");
+			const key = c.req.param("key");
+			if (!orgId) return c.json({ error: "orgId required" }, 400);
+			const env = await envStore.getByName(orgId, name);
+			if (!env) return c.json({ error: `context not found (org=${orgId}, name=${name})` }, 404);
+			await variableStore.deleteSourceOverride(orgId, env.id, routingKey, key);
+			logger$53.info("context source override deleted", {
+				orgId,
+				context: name,
+				routingKey,
+				key
+			});
+			return c.json({ deleted: true });
+		} catch (err) {
+			return handleError$5(c, err);
+		}
+	});
+}
 function handleError$5(c, err) {
 	logger$53.error("admin-contexts route failed", { error: toErrorMessage(err) });
 	return handleAdminError(c, err, logger$53);
 }
-var logger$53, repoPatternsSchema, createContextSchema, bindSchema, setPolicySchema, createTemplateSchema, setVariableSchema;
+var logger$53, repoPatternsSchema, createContextSchema, bindSchema, setPolicySchema, createTemplateSchema, setVariableSchema, setSourceOverrideSchema;
 var init_admin_contexts = __esmMin((() => {
 	init_context_store();
 	init_binding_store();
@@ -63855,6 +63938,7 @@ var init_admin_contexts = __esmMin((() => {
 		value: z.string(),
 		locked: z.boolean().optional()
 	});
+	setSourceOverrideSchema = z.object({ value: z.string() });
 }));
 //#endregion
 //#region src/routes/admin-queue-execution.ts
@@ -64258,6 +64342,18 @@ function createAdminRoutes(deps) {
 			if (scopeError) return c.json({ error: scopeError }, 400);
 			if (!resolved.store.createScope) return c.json({ error: `Backend '${resolved.backendName}' does not support scope creation` }, 400);
 			await resolved.store.createScope(parsed.orgId, resolved.path);
+			await deps.auditLogger.log({
+				action: "createScope",
+				contextName: parsed.scope,
+				routingKey: null,
+				secretKeys: null,
+				outcome: "allowed",
+				runId: null,
+				jobId: null,
+				userId: c.get("userId"),
+				role: c.get("role"),
+				metadata: { orgId: parsed.orgId }
+			});
 			return c.json({ created: true }, 200);
 		} catch (err) {
 			return handleError$3(c, err);
@@ -64282,6 +64378,21 @@ function createAdminRoutes(deps) {
 			if (scopeError) return c.json({ error: scopeError }, 400);
 			if (!from.store.renameScope) return c.json({ error: `Backend '${from.backendName}' does not support scope rename` }, 400);
 			await from.store.renameScope(parsed.orgId, from.path, to.path);
+			await deps.auditLogger.log({
+				action: "renameScope",
+				contextName: parsed.oldScope,
+				routingKey: null,
+				secretKeys: null,
+				outcome: "allowed",
+				runId: null,
+				jobId: null,
+				userId: c.get("userId"),
+				role: c.get("role"),
+				metadata: {
+					orgId: parsed.orgId,
+					newScope: parsed.newScope
+				}
+			});
 			return c.json({ renamed: true }, 200);
 		} catch (err) {
 			return handleError$3(c, err);
@@ -64297,6 +64408,18 @@ function createAdminRoutes(deps) {
 			const resolved = await routeScope(scope);
 			if (!resolved.store.deleteScope) return c.json({ error: `Backend '${resolved.backendName}' does not support scope deletion` }, 400);
 			await resolved.store.deleteScope(orgId, resolved.path);
+			await deps.auditLogger.log({
+				action: "deleteScope",
+				contextName: scope,
+				routingKey: null,
+				secretKeys: null,
+				outcome: "allowed",
+				runId: null,
+				jobId: null,
+				userId: c.get("userId"),
+				role: c.get("role"),
+				metadata: { orgId }
+			});
 			return c.json({ deleted: true }, 200);
 		} catch (err) {
 			return handleError$3(c, err);
@@ -66731,8 +66854,8 @@ var init_satisfiability = __esmMin((() => {
 /**
 * Admin API routes for workflow registration management.
 *
-* Provides endpoints for listing, inspecting, refreshing, and deleting
-* workflow registrations. All routes are protected by Bearer token
+* Provides endpoints for listing, inspecting, refreshing, disabling and
+* deleting workflow registrations. All routes are protected by Bearer token
 * authentication via the existing admin auth middleware pattern.
 */
 /**
@@ -66865,6 +66988,31 @@ function createAdminRegistrationRoutes(deps) {
 			return handleError$1(c, err);
 		}
 	});
+	app.patch("/api/v1/admin/registrations/:id/disable", async (c) => {
+		try {
+			deps.rbac.requirePermission(c.get("role"), "context.update");
+			const id = c.req.param("id");
+			const parsed = disableSchema.parse(await c.req.json());
+			const existing = await deps.registrationStore.getById(id);
+			if (!existing) return c.json({ error: "Registration not found" }, 404);
+			const denied = enforceRoutingKeyScope(c, existing.routing_key);
+			if (denied) return denied;
+			if (!await deps.registrationStore.setDisabled(id, parsed.disabled)) return c.json({ error: "Registration not found" }, 404);
+			const registryVersion = await deps.registrationStore.bumpVersion();
+			await deps.registrationIndex.refreshIfNeeded(registryVersion);
+			logger$45.info("Registration disabled flag set", {
+				id,
+				disabled: parsed.disabled,
+				registryVersion
+			});
+			return c.json({
+				disabled: parsed.disabled,
+				registryVersion
+			}, 200);
+		} catch (err) {
+			return handleError$1(c, err);
+		}
+	});
 	app.delete("/api/v1/admin/registrations/:id", async (c) => {
 		try {
 			deps.rbac.requirePermission(c.get("role"), "context.delete");
@@ -66893,7 +67041,7 @@ function createAdminRegistrationRoutes(deps) {
 function handleError$1(c, err) {
 	return handleAdminError(c, err, logger$45);
 }
-var logger$45, refreshSchema, registerManualSchema;
+var logger$45, refreshSchema, disableSchema, registerManualSchema;
 var init_admin_registrations = __esmMin((() => {
 	init_context_store();
 	init_satisfiability();
@@ -66905,6 +67053,7 @@ var init_admin_registrations = __esmMin((() => {
 		routingKey: z.string().min(1),
 		repoIdentifier: z.string().min(1)
 	});
+	disableSchema = z.object({ disabled: z.boolean() });
 	registerManualSchema = z.object({
 		lockFileContents: z.string().min(1),
 		repoIdentifier: z.string().min(1),
@@ -69094,14 +69243,14 @@ var init_admin_config = __esmMin((() => {
 function createHealthRoutes$1(deps = {}) {
 	return createHealthRoutes({
 		livenessInfo: () => ({
-			version: "0.10.0",
-			buildDate: "2026-09-25T02:21:19.808Z",
-			buildCommit: "4a01d4919",
-			sdkVersion: "0.10.0",
+			version: "0.11.0",
+			buildDate: "2026-09-25T15:27:17.455Z",
+			buildCommit: "399bc9f6b",
+			sdkVersion: "0.11.0",
 			sdkBundleHash: "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d",
-			sharedVersion: "0.10.0",
+			sharedVersion: "0.11.0",
 			sharedBundleHash: "c43dafa78ecdfdff530b94f7f0629d297ce9d9ed71b06b3cb893db87b00aaea7",
-			engineVersion: "0.10.0",
+			engineVersion: "0.11.0",
 			engineBundleHash: "0253acfa2150e263bde9698a0d8e95950cd1d94d95ae5ac3b94180bd9f139d0a"
 		}),
 		readinessCheck: deps.db ? async () => {
@@ -69137,7 +69286,7 @@ function createCapabilitiesRoutes() {
 	const app = new Hono();
 	app.get("/api/v1/capabilities", (c) => {
 		const manifest = {
-			orchestratorVersion: "0.10.0",
+			orchestratorVersion: "0.11.0",
 			protocolVersion: PROTOCOL_VERSION,
 			minProtocolVersion: MIN_PROTOCOL_VERSION
 		};
@@ -72087,7 +72236,7 @@ var init_app = __esmMin((() => {
 	init_log_chunk_sink();
 	init_agent_metrics_aggregator();
 	logger$32 = createLogger({ prefix: "app" });
-	ORCHESTRATOR_VERSION$2 = "0.10.0";
+	ORCHESTRATOR_VERSION$2 = "0.11.0";
 	SourceLocationStore = class {
 		cache = /* @__PURE__ */ new Map();
 		key(workflowName, jobName) {
@@ -80324,7 +80473,7 @@ var init_audit_logger = __esmMin((() => {
 		* engine's `shouldRecordSecretResolve` helper) since they're written
 		* once per JOB-step secret resolution and dwarf every other action's
 		* volume. Denied resolves and every other action (`setSecret`,
-		* `deleteSecret`, `rotateKey`, `secret-outputs.reveal`) bypass the
+		* `deleteSecret`, the scope writes, `rotateKey`, `secret-outputs.reveal`) bypass the
 		* sampler — they are transactional with the mutation and must always
 		* land.
 		*
@@ -89526,13 +89675,13 @@ var init_worker_core = __esmMin((() => {
 	init_worker_outbox_relay();
 	init_reroute_dispatch();
 	init_app_on_error();
-	ORCHESTRATOR_VERSION$1 = "0.10.0";
-	WORKER_BUILD_COMMIT = "4a01d4919";
-	WORKER_SDK_VERSION = "0.10.0";
+	ORCHESTRATOR_VERSION$1 = "0.11.0";
+	WORKER_BUILD_COMMIT = "399bc9f6b";
+	WORKER_SDK_VERSION = "0.11.0";
 	WORKER_SDK_BUNDLE_HASH = "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d";
-	WORKER_SHARED_VERSION = "0.10.0";
+	WORKER_SHARED_VERSION = "0.11.0";
 	WORKER_SHARED_BUNDLE_HASH = "c43dafa78ecdfdff530b94f7f0629d297ce9d9ed71b06b3cb893db87b00aaea7";
-	WORKER_ENGINE_VERSION = "0.10.0";
+	WORKER_ENGINE_VERSION = "0.11.0";
 	WORKER_ENGINE_BUNDLE_HASH = "0253acfa2150e263bde9698a0d8e95950cd1d94d95ae5ac3b94180bd9f139d0a";
 	logger$2 = createLogger({ prefix: "worker" });
 	DRAIN_TIMEOUT_MS = 3e5;
@@ -89557,13 +89706,13 @@ var init_worker_core = __esmMin((() => {
 * Graceful shutdown:
 * agent WS -> heartbeat -> HTTP -> DB
 */
-const ORCHESTRATOR_VERSION = "0.10.0";
-const BUILD_COMMIT = "4a01d4919";
-const SDK_VERSION = "0.10.0";
+const ORCHESTRATOR_VERSION = "0.11.0";
+const BUILD_COMMIT = "399bc9f6b";
+const SDK_VERSION = "0.11.0";
 const SDK_BUNDLE_HASH = "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d";
-const SHARED_VERSION = "0.10.0";
+const SHARED_VERSION = "0.11.0";
 const SHARED_BUNDLE_HASH = "c43dafa78ecdfdff530b94f7f0629d297ce9d9ed71b06b3cb893db87b00aaea7";
-const ENGINE_VERSION = "0.10.0";
+const ENGINE_VERSION = "0.11.0";
 const ENGINE_BUNDLE_HASH = "0253acfa2150e263bde9698a0d8e95950cd1d94d95ae5ac3b94180bd9f139d0a";
 const otelSdk = initTelemetry({
 	serviceName: "kici-orchestrator",

package/installer-image-digests.json

@@ -1,7 +1,7 @@
 {
-  "version": "0.10.0",
+  "version": "0.11.0",
   "images": {
-    "kici-agent": "sha256:f4b278ff8694016ad46b741b199b7363ce083ccef892f62ad640576e8e7c275e",
-    "kici-orchestrator": "sha256:4bb360a18d6193cd0fed233541bee6ba1fa44c9a1052b4a26c4578426d45c9fa"
+    "kici-agent": "sha256:3a7a387964836acf6f89bdd31a4ee285383349926db21ef90d43905a5bce1dd4",
+    "kici-orchestrator": "sha256:8ee2909b622f813348506589c25b8b7d4ef2333604e1bc919e15016304822a27"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/orchestrator",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
   "keywords": [
     "ci",
@@ -90,8 +90,8 @@
     "ws": "^8.21.3",
     "yaml": "^2.9.1",
     "zod": "^4.6.5",
-    "@kici-dev/engine": "0.10.0",
-    "@kici-dev/shared": "0.10.0"
+    "@kici-dev/engine": "0.11.0",
+    "@kici-dev/shared": "0.11.0"
   },
   "kici": {
     "metrics": {
@@ -106,7 +106,7 @@
     "@types/dockerode": "^4.0.1",
     "@types/ws": "^8.18.1",
     "kysely-ctl": "^0.21.0",
-    "@kici-dev/agent": "0.10.0"
+    "@kici-dev/agent": "0.11.0"
   },
   "scripts": {
     "build": "node ../../scripts/build-service.mjs && tsc --emitDeclarationOnly",