@kici-dev/orchestrator 0.12.0 → 0.13.0

package/dist/pipeline/global-eval-round.d.ts

@@ -87,8 +87,9 @@ export declare function hasDeferredGenerator(lockEntry: LockWorkflow): boolean;
  * those that must go through an eval round first.
  *
  * A candidate needs the round when it declares a `filter` (only the agent may
- * run the predicate) or carries a needs-free `DynamicJobFn` (only the agent may
- * run the generator, and it depends on nothing the run produces). Everything
+ * run the predicate), carries a needs-free `DynamicJobFn` (only the agent may
+ * run the generator, and it depends on nothing the run produces), or matched
+ * with deferred `paths` (only the agent's clone holds the diff). Everything
  * else — static jobs, and result-aware generators the run evaluates later — is
  * handed to the dispatch pipeline as declared, so routing it through a round
  * would add a job dispatch and an agent round trip for nothing.

package/dist/pipeline/processor.d.ts

@@ -49,6 +49,8 @@ import type { RegistrationIndex } from '../registration/registration-index.js';
 import type { CronScheduler } from '../cron/cron-scheduler.js';
 import type { GlobalWorkflowPolicy } from '../security/global-workflow-policy.js';
 import type { EventLogWriter } from '../webhook/event-log.js';
+/** The one event-log method the pipeline calls; a per-delivery wrapper can stand in for the writer. */
+export type EventLogRecorder = Pick<EventLogWriter, 'record'>;
 import { EventLogSource } from '@kici-dev/engine';
 import type { LockJob } from '@kici-dev/engine';
 import type { ContextStore } from '../contexts/context-store.js';
@@ -203,6 +205,12 @@ export declare function resolveLockFileWithFallback(args: {
     registrationIndex: RegistrationIndex | undefined;
     lockFileCache: LockFileCache;
     deliveryId: string;
+    /**
+     * False when cross-source repo mode already evaluated this delivery's
+     * other-source registrations for the same repository: the fallback would
+     * re-read exactly those registrations. Defaults to true.
+     */
+    allowRegistrationFallback?: boolean;
 }): Promise<{
     lockFile: FullLockFile | null;
     resolvedVia: 'inbound' | 'fallback' | 'miss' | 'corrupt';
@@ -476,7 +484,7 @@ export interface ProcessingDeps {
     /** Global workflow policy for org-level permission enforcement. Optional -- if not set, global workflows are unrestricted. */
     globalWorkflowPolicy?: GlobalWorkflowPolicy;
     /** Inbound webhook delivery log writer. Optional -- if not set, deliveries are not persisted to event_log. */
-    eventLog?: EventLogWriter;
+    eventLog?: EventLogRecorder;
     /** Where this delivery arrived: 'relay' (Platform WS) or 'direct' (HTTP).
      *  Used by the eventLog writer to populate the source column. Defaults to
      *  'direct' when omitted (independent / direct paths). */

package/dist/pipeline/rerun-inputs.d.ts

@@ -1,3 +1,10 @@
+/**
+ * Inputs every re-run path rebuilds from an original run: its stored webhook
+ * payload, the provider binding its row records, the delivery's event name, the
+ * normalized event, and its changed files. Shared by the per-repository re-run,
+ * the evaluation-round re-run and release, and the cross-repository global
+ * re-run, so the paths cannot disagree about how a run's inputs are read back.
+ */
 import type { SimulatedEvent } from '@kici-dev/engine';
 import type { ProviderRegistry } from '../provider-registry.js';
 import type { TrustPolicyOutcome } from '../security/trust-policy-gate.js';
@@ -59,7 +66,9 @@ export declare function loadDeliveryEventName(originalRun: OriginalRunRow, deps:
 /** The verdict an approved security hold stands for. */
 export declare const RELEASED_DECISION: TrustPolicyOutcome;
 /**
- * The normalized form of the delivery the round was deciding.
+ * The normalized form of the delivery the round was deciding, stamped with the
+ * repository's default branch as the delivery stamped it: the jobs a re-run
+ * dispatches carry this event, and an agent derives a new-branch diff from it.
  *
  * Read-only, and it throws — so it runs before the requestId claim, never
  * inside the re-evaluation.
@@ -69,13 +78,13 @@ export declare function normalizeRoundEvent(originalRun: OriginalRunRow, provide
     action: string | null;
 }, payload: Record<string, unknown>, refusal?: RerunRefusal): SimulatedEvent;
 /**
- * Stamp the re-evaluated event with the source repository's changed files.
+ * Stamp the re-evaluated event with the source repository's default branch and
+ * changed files.
  *
- * Unconditional, unlike the delivery path's fetch: that path skips the fetch
- * when no trigger in the source repo's lock file uses path patterns, and a
- * scoped re-evaluation has no such lock file to read. An error carries
- * `unavailable`, which every path filter downstream already treats
- * conservatively.
+ * The resolve is unconditional: the delivery path skips it when no trigger in
+ * the source repo's lock file uses path patterns, and a scoped re-evaluation
+ * has no such lock file to bound it. A bundle with no fetcher, or a fetch
+ * error, carries `unavailable`.
  */
 export declare function withChangedFiles(opts: {
     event: SimulatedEvent;

package/dist/providers/github/changed-files.d.ts

@@ -28,10 +28,15 @@ export declare function withRateLimitRetry<T>(fn: () => Promise<T>, context: str
 /**
  * GitHub-specific implementation of ChangedFilesFetcher.
  *
- * For PRs: uses paginated pulls.listFiles API (handles up to 3000 files).
- * For pushes: uses repos.compareCommits API (logs warning at 300+ files).
- * For initial pushes (zero SHA): returns empty array.
- * For unknown events: returns empty array.
+ * For PRs: uses the paginated pulls.listFiles API; a result at GitHub's
+ * 3000-file cap is truncated, so it reports `unavailable`.
+ * For pushes: uses the repos.compareCommits API; a result at GitHub's 300-file
+ * cap is truncated, so it reports `unavailable`.
+ * For a new branch (zero `before`): compares the default branch against
+ * `after` (three-dot), the files the branch adds. With no known default
+ * branch, or the default branch itself being created, it reports `unavailable`.
+ * For a deleted branch (zero `after`): `fetched` + [].
+ * For unknown events: reports `unavailable`.
  */
 export declare class GitHubChangedFilesFetcher implements ChangedFilesFetcher {
     private readonly config;
@@ -55,5 +60,10 @@ export declare class GitHubChangedFilesFetcher implements ChangedFilesFetcher {
      * Get changed files for a push event using compareCommits API.
      */
     private getPushChangedFiles;
+    /**
+     * Compare two refs through the compareCommits API. A result at GitHub's
+     * 300-file cap is truncated, so it reports `unavailable`.
+     */
+    private compare;
 }
 //# sourceMappingURL=changed-files.d.ts.map

package/dist/providers/universal-git/changed-files.d.ts

@@ -8,6 +8,10 @@
  * `commits[].{added,modified,removed}` arrays in the push payload, so we
  * extract them via JSONPath from the already-delivered webhook body.
  *
+ * Forges cap `commits[]`. A preset whose forge sends a total commit count
+ * (`commitsTotal`) or has a documented list cap (`commitsCap`) reports a
+ * truncated push as `unavailable` rather than a partial list.
+ *
  * For PR events we report `unavailable`: no per-commit diff is present in the
  * webhook body, so the upstream trigger matcher matches path filters
  * conservatively (the workflow runs) instead of silently never matching. A
@@ -38,6 +42,8 @@ export declare class UniversalGitChangedFilesFetcher implements ChangedFilesFetc
      * @param _credentials    Unused — no REST call is made.
      */
     getChangedFiles(_repoIdentifier: string, eventType: string, payload: unknown, _credentials: unknown): Promise<ChangedFilesResult>;
+    /** Whether the payload lists fewer commits than the push carried. */
+    private isTruncated;
     private classifyEvent;
 }
 //# sourceMappingURL=changed-files.d.ts.map

package/dist/providers/universal-git/config.d.ts

@@ -73,6 +73,8 @@ export declare const UniversalGitPayloadPathsSchema: z.ZodObject<{
     commitsModified: z.ZodString;
     commitsRemoved: z.ZodString;
     commitMessage: z.ZodOptional<z.ZodString>;
+    commitsTotal: z.ZodOptional<z.ZodString>;
+    commitsCap: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 export type UniversalGitPayloadPaths = z.infer<typeof UniversalGitPayloadPathsSchema>;
 /**
@@ -131,6 +133,8 @@ export declare const UniversalGitConfigSchema: z.ZodObject<{
         commitsModified: z.ZodString;
         commitsRemoved: z.ZodString;
         commitMessage: z.ZodOptional<z.ZodString>;
+        commitsTotal: z.ZodOptional<z.ZodString>;
+        commitsCap: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>;
     eventMapping: z.ZodOptional<z.ZodObject<{
         push: z.ZodArray<z.ZodString>;

package/dist/scaler/container-backend.d.ts

@@ -211,6 +211,8 @@ export declare class ContainerScalerBackend implements ScalerBackend {
      * Returns the count of cleaned containers plus reaped rules.
      */
     cleanupOrphans(): Promise<number>;
+    /** Stop and remove one orphaned agent container; true when it was removed. */
+    private removeOrphan;
     /**
      * Remove containers this backend spawned for one agent id.
      *

package/dist/scaler/container-runtime.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The container runtime behind a configured socket path.
+ *
+ * A path containing `podman` is Podman; any other path is Docker. The container
+ * backend reads a configured `socketPath` this way, and the runtime it picks
+ * only labels the agents' log source and the scaler diagnostics.
+ */
+export declare function containerRuntimeForSocketPath(socketPath: string): 'docker' | 'podman';
+//# sourceMappingURL=container-runtime.d.ts.map

package/dist/scaler/manager.d.ts

@@ -11,6 +11,21 @@ import { ScaleDownReason } from './scaler-events.js';
 import { type ScalerAgentView } from './agent-fit.js';
 import type { ScalerEventEmitterLike } from './event-backend.js';
 import type { ClaimStore, ClaimedCredentials } from './claim-store.js';
+/**
+ * How long a graceful shutdown waits for the scaler backends to stop their
+ * agents. It is the first window inside the coordinator's 30 s shutdown limit,
+ * and every later step (the HTTP stop grace, the database drain) still has to
+ * fit after it.
+ *
+ * A container stop normally takes at most its own 10 s stop timeout, but the
+ * container runtime can take far longer: a Docker daemon that misses a
+ * container's exit waits out the stop timeout and then another 10 s for its
+ * kill, and one such container held the whole step for 29.7 s. Past this
+ * window the orchestrator logs each backend still stopping and continues. The
+ * runtime finishes the stop on its own, and the next start's orphan cleanup
+ * removes any agent container that is still there.
+ */
+export declare const SCALER_SHUTDOWN_GRACE_MS = 15000;
 import type { BackendFailureSummary } from './failure-tracker.js';
 import type { ScalerBackend, ScalerConfig, ScalerEntry, ScaleResult, ScalerEvent, ResourceCap, ValidationResult, ResolvedContainerSpawn } from './types.js';
 import type { ScalerStateStore, ScalerStateRecovery, ReapCandidate } from './scaler-state-store.js';
@@ -948,9 +963,12 @@ export declare class ScalerManager {
      */
     private completeLocalRegistration;
     /**
-     * Called from agent-handler.ts when an agent disconnects.
+     * Called from agent-handler.ts when an agent disconnects. `reason` is what an
+     * event scaler's scale-down carries: `shutdown` for an ordinary disconnect,
+     * `heartbeat-timeout` for an agent the orchestrator dropped without waiting
+     * for its socket.
      */
-    onAgentDisconnected(agentId: string): void;
+    onAgentDisconnected(agentId: string, reason?: ScaleDownReason): void;
     /**
      * Tear down a stranded provision the `EventProvisionReaper` found.
      *
@@ -1145,6 +1163,12 @@ export declare class ScalerManager {
      * Sum of all backends' active count + spawning agents.
      */
     getGlobalActiveCount(): number;
+    /**
+     * Shut every backend down in parallel, waiting at most
+     * {@link SCALER_SHUTDOWN_GRACE_MS} for the slowest. A backend still stopping
+     * when the window closes is logged by name and left to finish on its own.
+     */
+    private shutdownBackendsWithinGrace;
     /**
      * Stop warm pool, shutdown all backends, clear tracking maps.
      */