@kici-dev/orchestrator 0.14.2 → 0.16.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (176) hide show
  1. package/dist/__test-helpers__/peer-mutual-auth.d.ts +42 -0
  2. package/dist/__test-helpers__/scratch-db.d.ts +16 -0
  3. package/dist/agent/host-roster.d.ts +100 -37
  4. package/dist/agent/registry.d.ts +1 -8
  5. package/dist/app-on-error.d.ts +1 -1
  6. package/dist/app.d.ts +4 -2
  7. package/dist/artifacts/artifact-store.d.ts +0 -2
  8. package/dist/audit/access-log.d.ts +1 -1
  9. package/dist/cache/source-cache.d.ts +1 -1
  10. package/dist/cache/user-cache.d.ts +0 -28
  11. package/dist/cli/api-client.d.ts +27 -1
  12. package/dist/cli/commands/access-log.d.ts +1 -1
  13. package/dist/cli/commands/cold-store-impl.d.ts +7 -84
  14. package/dist/cli/commands/db.d.ts +1 -0
  15. package/dist/cli/commands/host.d.ts +3 -0
  16. package/dist/cli/commands/orchestrator-service/status.d.ts +2 -0
  17. package/dist/cli/commands/org.d.ts +12 -0
  18. package/dist/cli/commands/scaler.d.ts +14 -0
  19. package/dist/cli/commands/secret.d.ts +1 -45
  20. package/dist/cli/commands/service-health.d.ts +21 -13
  21. package/dist/cli/commands/shared/cli-action.d.ts +17 -0
  22. package/dist/cli/commands/shared/db.d.ts +5 -5
  23. package/dist/cli/commands/shared/org-id.d.ts +5 -0
  24. package/dist/cli/commands/shared/service-verbs.d.ts +19 -0
  25. package/dist/cli/commands/shared/table.d.ts +3 -0
  26. package/dist/cli/commands/shared/unbound-context-warning.d.ts +2 -22
  27. package/dist/cli/commands/source-manifest.d.ts +3 -3
  28. package/dist/cli/commands/source.d.ts +23 -0
  29. package/dist/cli/commands/trust-policy.d.ts +7 -31
  30. package/dist/cli/join.d.ts +2 -2
  31. package/dist/cli/kici-admin.d.ts +6 -1
  32. package/dist/cli/local-github-ingress-url.d.ts +6 -0
  33. package/dist/cli/root-option-routing.d.ts +46 -0
  34. package/dist/cli/webhook-url-notes.d.ts +15 -0
  35. package/dist/cli.js +10667 -8461
  36. package/dist/cluster/coordinator-credential.d.ts +21 -0
  37. package/dist/cluster/coordinator.d.ts +2 -2
  38. package/dist/cluster/index.d.ts +4 -4
  39. package/dist/cluster/join-client.d.ts +23 -21
  40. package/dist/cluster/join-handler.d.ts +24 -16
  41. package/dist/cluster/join-protocol-v2.d.ts +84 -0
  42. package/dist/cluster/join-token.d.ts +78 -56
  43. package/dist/cluster/peer-auth-coordinator.d.ts +16 -2
  44. package/dist/cluster/peer-client.d.ts +99 -5
  45. package/dist/cluster/peer-crypto.d.ts +60 -3
  46. package/dist/cluster/peer-discovery.d.ts +67 -0
  47. package/dist/cluster/peer-forget.d.ts +4 -9
  48. package/dist/cluster/peer-handler.d.ts +28 -6
  49. package/dist/cluster/peer-registry.d.ts +15 -1
  50. package/dist/cluster/peer-request-waiters.d.ts +26 -0
  51. package/dist/cluster/scaler-orphans-peer.d.ts +4 -9
  52. package/dist/cluster/scaler-reload-fanout.d.ts +29 -0
  53. package/dist/cluster/scaler-reload-peer.d.ts +16 -0
  54. package/dist/cluster/worker-cluster-settings.d.ts +1 -0
  55. package/dist/cold-store/load-access-log-range.d.ts +3 -3
  56. package/dist/cold-store/tables/access-log.d.ts +4 -12
  57. package/dist/cold-store/tables/event-log.d.ts +8 -19
  58. package/dist/cold-store/tables/execution-jobs.d.ts +7 -24
  59. package/dist/cold-store/tables/execution-runs.d.ts +6 -20
  60. package/dist/cold-store/tables/execution-steps.d.ts +8 -26
  61. package/dist/cold-store/tables/secret-audit-log.d.ts +4 -11
  62. package/dist/config/env-overlay.d.ts +3 -8
  63. package/dist/config/reload.d.ts +9 -2
  64. package/dist/config/schema.d.ts +16 -2
  65. package/dist/config/types.d.ts +6 -2
  66. package/dist/config.d.ts +22 -17
  67. package/dist/contexts/held-runs.d.ts +3 -6
  68. package/dist/dashboard/cursor.d.ts +12 -0
  69. package/dist/dashboard/handler.d.ts +5 -12
  70. package/dist/db/deferred-index-build.d.ts +42 -0
  71. package/dist/db/deferred-indexes.d.ts +3 -37
  72. package/dist/db/migrations/100_held_runs_hold_type_vocabulary.d.ts +3 -5
  73. package/dist/db/migrations/157_host_roster_identity_source.d.ts +21 -0
  74. package/dist/db/migrations/158_normalize_legacy_values.d.ts +4 -0
  75. package/dist/db/repos/org-ids-repo.d.ts +87 -0
  76. package/dist/db/schema-snapshot.generated.d.ts +3 -0
  77. package/dist/db/types.d.ts +21 -24
  78. package/dist/fault-injection-types.d.ts +0 -6
  79. package/dist/git/dispatch-git-auth.d.ts +6 -12
  80. package/dist/github-app-name-refresher/github-app-name-refresher.d.ts +25 -13
  81. package/dist/helpers/json.d.ts +3 -0
  82. package/dist/index.d.ts +1 -1
  83. package/dist/index.js +357 -216
  84. package/dist/metrics/prometheus.d.ts +0 -5
  85. package/dist/oidc/id-token-claims.d.ts +1 -1
  86. package/dist/oidc/resolve-signer.d.ts +2 -4
  87. package/dist/orchestrator-core.d.ts +10 -3
  88. package/dist/pipeline/global-eval-round.d.ts +2 -26
  89. package/dist/pipeline/install-secrets-resolver.d.ts +0 -3
  90. package/dist/pipeline/manual-schedule.d.ts +1 -7
  91. package/dist/provenance/dispatch-context.d.ts +5 -7
  92. package/dist/provenance/pending-attestations-repo.d.ts +1 -1
  93. package/dist/provenance/trust-root.d.ts +4 -5
  94. package/dist/provenance/verify-deferred-capture.d.ts +3 -3
  95. package/dist/provider-registry.d.ts +13 -40
  96. package/dist/providers/github/manifest.d.ts +58 -7
  97. package/dist/providers/universal-git/ssh-auth.d.ts +0 -5
  98. package/dist/reporting/check-run-reporter.d.ts +8 -21
  99. package/dist/reporting/check-run-summary.d.ts +2 -2
  100. package/dist/reporting/execution-tracker.d.ts +1 -1
  101. package/dist/reporting/log-chunk-sink.d.ts +1 -1
  102. package/dist/reporting/run-summary-fields.d.ts +25 -0
  103. package/dist/reporting/s3-log-storage.d.ts +2 -2
  104. package/dist/routes/admin-access-log.d.ts +2 -9
  105. package/dist/routes/admin-backends.d.ts +2 -9
  106. package/dist/routes/admin-cluster-name.d.ts +2 -8
  107. package/dist/routes/admin-cluster-settings.d.ts +2 -8
  108. package/dist/routes/admin-config.d.ts +0 -3
  109. package/dist/routes/admin-contexts.d.ts +3 -11
  110. package/dist/routes/admin-db.d.ts +2 -9
  111. package/dist/routes/admin-env.d.ts +33 -0
  112. package/dist/routes/admin-event-dlq.d.ts +2 -9
  113. package/dist/routes/admin-event-inspect.d.ts +2 -9
  114. package/dist/routes/admin-event-log.d.ts +2 -9
  115. package/dist/routes/admin-events.d.ts +3 -13
  116. package/dist/routes/admin-held-runs.d.ts +2 -8
  117. package/dist/routes/admin-list-limit.d.ts +3 -0
  118. package/dist/routes/admin-maintenance.d.ts +2 -9
  119. package/dist/routes/admin-orchestrator-drain.d.ts +2 -9
  120. package/dist/routes/admin-org-settings.d.ts +2 -8
  121. package/dist/routes/admin-orgs.d.ts +27 -0
  122. package/dist/routes/admin-peer-forget.d.ts +2 -9
  123. package/dist/routes/admin-queue-execution.d.ts +3 -10
  124. package/dist/routes/admin-registrations.d.ts +3 -14
  125. package/dist/routes/admin-runs.d.ts +3 -14
  126. package/dist/routes/admin-scaler-orphans.d.ts +2 -9
  127. package/dist/routes/admin-scaler-reload.d.ts +41 -0
  128. package/dist/routes/admin-scheduled-jobs.d.ts +2 -9
  129. package/dist/routes/admin-signing-keys.d.ts +2 -9
  130. package/dist/routes/admin-sources.d.ts +28 -32
  131. package/dist/routes/admin-trust-policy.d.ts +2 -8
  132. package/dist/routes/admin.d.ts +29 -30
  133. package/dist/routes/cluster-join.d.ts +13 -0
  134. package/dist/routes/github-webhook.d.ts +13 -11
  135. package/dist/scaler/bare-metal-backend.d.ts +42 -1
  136. package/dist/scaler/config.d.ts +12 -84
  137. package/dist/scaler/file-reload.d.ts +48 -0
  138. package/dist/scaler/manager.d.ts +47 -33
  139. package/dist/scaler/scaler-state-store.d.ts +5 -0
  140. package/dist/scaler/types.d.ts +8 -9
  141. package/dist/secrets/job-secret-gate.d.ts +2 -5
  142. package/dist/secrets/secret-resolver.d.ts +2 -4
  143. package/dist/security/trust-policy-gate.d.ts +0 -4
  144. package/dist/server.d.ts +6 -17
  145. package/dist/server.js +10933 -10836
  146. package/dist/sources/source-manager.d.ts +0 -24
  147. package/dist/sources/webhook-url-resolvers.d.ts +60 -0
  148. package/dist/standalone.js +10457 -10060
  149. package/dist/worker/reroute-dispatch.d.ts +1 -0
  150. package/dist/worker/reroute-spawn-control.d.ts +1 -3
  151. package/dist/worker-core.d.ts +9 -2
  152. package/dist/ws/agent-handler.d.ts +3 -3
  153. package/dist/ws/dashboard-access.d.ts +57 -0
  154. package/dist/ws/dashboard-backends-handler.d.ts +1 -6
  155. package/dist/ws/dashboard-context-handler.d.ts +10 -15
  156. package/dist/ws/dashboard-fleet-handler.d.ts +4 -3
  157. package/dist/ws/dashboard-fleet-write-handler.d.ts +6 -5
  158. package/dist/ws/dashboard-global-workflows-handler.d.ts +1 -6
  159. package/dist/ws/dashboard-registrations-handler.d.ts +1 -7
  160. package/dist/ws/platform-client.d.ts +94 -327
  161. package/installer-image-digests.json +3 -3
  162. package/package.json +4 -4
  163. package/sbom.spdx.json +53 -53
  164. package/dist/cache/legacy-prefixes.d.ts +0 -19
  165. package/dist/cli/commands/agent-service/logs.d.ts +0 -14
  166. package/dist/cli/commands/agent-service/restart.d.ts +0 -12
  167. package/dist/cli/commands/agent-service/start.d.ts +0 -12
  168. package/dist/cli/commands/agent-service/stop.d.ts +0 -12
  169. package/dist/cli/commands/agent-service/uninstall.d.ts +0 -13
  170. package/dist/cli/commands/cache.d.ts +0 -51
  171. package/dist/cli/commands/orchestrator-service/logs.d.ts +0 -14
  172. package/dist/cli/commands/orchestrator-service/restart.d.ts +0 -12
  173. package/dist/cli/commands/orchestrator-service/start.d.ts +0 -12
  174. package/dist/cli/commands/orchestrator-service/stop.d.ts +0 -12
  175. package/dist/cli/commands/orchestrator-service/uninstall.d.ts +0 -13
  176. package/dist/git/inherited-secret.d.ts +0 -29
@@ -11,19 +11,7 @@
11
11
  import type pg from 'pg';
12
12
  import { ProviderRegistry } from '../provider-registry.js';
13
13
  import type { ProviderSource } from '../entry-helpers.js';
14
- import { OrchestratorMode } from '@kici-dev/engine';
15
14
  import type { SourceStore } from './source-store.js';
16
- /**
17
- * Operator-facing error for a GitHub-App source under `observed` mode. Shared
18
- * by the startup assertion and the admin source-create route so both paths give
19
- * the same remediation.
20
- */
21
- export declare const OBSERVED_GITHUB_APP_SOURCE_ERROR: string;
22
- /** Thrown at startup when an observed-mode orchestrator holds GitHub-App sources. */
23
- export declare class ObservedGithubAppSourcesError extends Error {
24
- readonly count: number;
25
- constructor(count: number);
26
- }
27
15
  /**
28
16
  * Options for creating a SourceManager.
29
17
  */
@@ -39,13 +27,6 @@ export interface SourceManagerOptions {
39
27
  }) => void;
40
28
  /** Debounce interval in ms for coalescing rapid changes. Default: 200. */
41
29
  debounceMs?: number;
42
- /**
43
- * Orchestrator operating mode. In `observed` mode the manager refuses to
44
- * start when the `sources` table holds any GitHub-App row — those are
45
- * Platform-relayed by construction and an observed orchestrator never
46
- * accepts a relay. Omitted (undefined) imposes no mode constraint.
47
- */
48
- mode?: OrchestratorMode;
49
30
  }
50
31
  /**
51
32
  * Manages webhook sources from the database with hot reload support.
@@ -84,11 +65,6 @@ export declare class SourceManager {
84
65
  start(): Promise<ProviderRegistry>;
85
66
  /** Stop listening and release the dedicated pg client. */
86
67
  stop(): Promise<void>;
87
- /**
88
- * Fail fast when an observed-mode orchestrator holds GitHub-App sources. The
89
- * `sources` table is GitHub-App-only, so any row is a relay-type source.
90
- */
91
- private assertNoGithubAppSourcesInObservedMode;
92
68
  private scheduleReload;
93
69
  /** Reload sources from DB and rebuild the ProviderRegistry. */
94
70
  reload(): Promise<void>;
@@ -0,0 +1,60 @@
1
+ /**
2
+ * Every webhook-URL decision the orchestrator makes for a GitHub-App source,
3
+ * by operating mode. Pure functions: the entry points (`server.ts`,
4
+ * `standalone.ts`) pass in the mode, the public base, the org and the Platform
5
+ * values, so each rule is unit-tested here once.
6
+ */
7
+ import { z } from 'zod';
8
+ import { OrchestratorMode } from '@kici-dev/engine';
9
+ /** Why a webhook URL could not be resolved. The CLI maps each to a reason and a hint. */
10
+ export declare const WebhookUrlNote: z.ZodEnum<{
11
+ "no-public-url": "no-public-url";
12
+ "org-not-identified": "org-not-identified";
13
+ "platform-no-public-url": "platform-no-public-url";
14
+ "platform-unavailable": "platform-unavailable";
15
+ "platform-url-unknown": "platform-url-unknown";
16
+ "resolve-failed": "resolve-failed";
17
+ "resolver-unavailable": "resolver-unavailable";
18
+ "unsupported-provider": "unsupported-provider";
19
+ }>;
20
+ export type WebhookUrlNote = z.infer<typeof WebhookUrlNote>;
21
+ export interface WebhookUrlResolution {
22
+ webhookUrl: string | null;
23
+ webhookNote?: WebhookUrlNote;
24
+ }
25
+ /** Org segment an orchestrator with no Platform org puts in its URLs. Neither route checks it. */
26
+ export declare const DEFAULT_ORG_SEGMENT = "__default__";
27
+ export interface AddedSourceUrlInput {
28
+ mode: OrchestratorMode;
29
+ webhookPublicUrl: string | undefined;
30
+ /** The Platform org this orchestrator authenticated as, when known. */
31
+ orgId: string | undefined;
32
+ sourceId: string;
33
+ /** Push the full source list to the Platform; resolves the ack's URL for this source. */
34
+ registerAndAwait: () => Promise<string | null>;
35
+ onRegisterError: (err: unknown) => void;
36
+ }
37
+ /** The URL `kici-admin source add github` prints for a freshly added source. */
38
+ export declare function resolveAddedGithubSourceUrl(input: AddedSourceUrlInput): Promise<WebhookUrlResolution>;
39
+ export interface ManifestUrlInput {
40
+ mode: OrchestratorMode;
41
+ webhookPublicUrl: string | undefined;
42
+ orgId: string | undefined;
43
+ /** `auth.success.githubWebhookUrl`; undefined when the Platform did not send it. */
44
+ platformGithubWebhookUrl: string | null | undefined;
45
+ }
46
+ /**
47
+ * The org-scoped URL the manifest flow bakes into a new App, before the App
48
+ * (and so the source id) exists. Platform and hybrid point the App at the
49
+ * hosted Platform; observed and independent at this orchestrator's
50
+ * org-scoped direct route.
51
+ */
52
+ export declare function resolveManifestGithubWebhookUrl(input: ManifestUrlInput): WebhookUrlResolution;
53
+ /** The direct-ingress URL `kici-admin source list` prints for a GitHub source, or null. */
54
+ export declare function resolveListedGithubIngressUrl(input: {
55
+ mode: OrchestratorMode;
56
+ webhookPublicUrl: string | undefined;
57
+ orgId: string | undefined;
58
+ sourceId: string;
59
+ }): string | null;
60
+ //# sourceMappingURL=webhook-url-resolvers.d.ts.map