@kici-dev/orchestrator 0.15.0 → 0.16.0

package/dist/worker/reroute-dispatch.d.ts

@@ -31,5 +31,6 @@ export interface WorkerQueuedJob {
 export declare function buildWorkerDispatchMessage(job: WorkerQueuedJob, ids: {
     messageId: string;
     timestamp: number;
+    concurrencyWaitTimeoutMs: number;
 }): Record<string, unknown>;
 //# sourceMappingURL=reroute-dispatch.d.ts.map

package/dist/worker/reroute-spawn-control.d.ts

@@ -12,7 +12,7 @@
  *
  * Assembled here so `bootstrapWorker` only wires it.
  */
-import { type JobReroute, type PeerScalerEvent, type RerouteSpawnRetry } from '@kici-dev/engine';
+import { type JobReroute, type PeerScalerEvent } from '@kici-dev/engine';
 import type { Dispatcher } from '../agent/dispatcher.js';
 import type { ScalerManager } from '../scaler/manager.js';
 import type { ScaleResult, ScalerEvent } from '../scaler/types.js';
@@ -29,8 +29,6 @@ export interface RerouteSpawnControlDeps {
     jobOwnership: Map<string, string>;
     /** Relay a message to the coordinator that owns the job. */
     sendToOwningCoord: (jobId: string, msg: PeerScalerEvent) => void;
-    /** The worker's configured budget, used when the coordinator sent none. */
-    defaults: RerouteSpawnRetry;
     logger: {
         debug(message: string, meta?: Record<string, unknown>): unknown;
         info(message: string, meta?: Record<string, unknown>): unknown;

package/dist/worker-core.d.ts

@@ -74,12 +74,19 @@ export declare function resolveWorkerAgentTokenTtlMs(pushed: {
 /**
  * Resolve the Firecracker API-socket wait a worker-spawned VM should use: the
  * fleet-wide `firecracker_api_socket_wait_ms` pulled from a coordinator,
- * otherwise the boot-time config default. A snapshot from a coordinator that
- * predates the knob carries no value, and the default applies.
+ * otherwise the boot-time config default.
  */
 export declare function resolveWorkerFirecrackerApiSocketWaitMs(pushed: {
     settings: WorkerClusterSettings;
 } | null, fallback: number): number;
+/**
+ * Resolve the concurrency-slot wait timeout a worker sends on `job.dispatch`:
+ * the fleet-wide `concurrency_wait_timeout_ms` pulled from a coordinator,
+ * otherwise the boot-time config default.
+ */
+export declare function resolveWorkerConcurrencyWaitTimeoutMs(pushed: {
+    settings: WorkerClusterSettings;
+} | null, fallback: number): number;
 /**
  * Bootstrap the orchestrator in worker mode.
  *

package/dist/ws/agent-handler.d.ts

@@ -425,7 +425,7 @@ export declare function isValidLogChunk(raw: unknown): raw is {
     stepIndex: number;
     lines: string[];
     timestamp: number;
-    stream?: LogStream;
+    stream: LogStream;
 };
 /** A log chunk as the handler passes it on. */
 export interface AgentLogChunkInput {
@@ -434,8 +434,8 @@ export interface AgentLogChunkInput {
     stepIndex: number;
     lines: string[];
     timestamp: number;
-    /** Absent when the agent does not report a stream; read as `stdout`. */
-    stream?: LogStream;
+    /** The stream the lines came from. */
+    stream: LogStream;
 }
 /**
  * Release the in-memory waiters of jobs a disconnect triage failed: pending

package/dist/ws/dashboard-access.d.ts

@@ -0,0 +1,57 @@
+import type { AccessLogAction, AccessLogOutcome, AccessLogTargetType, ActorPrincipal } from '@kici-dev/engine';
+import type { AccessLogWriter } from '../audit/access-log.js';
+import { type DetachedFailureLogger } from '../helpers/run-detached.js';
+/** The org and routing key an access_log row is attributed to. */
+export type AccessScope = {
+    orgId: string | null;
+    routingKey: string | null;
+};
+export type AccessTarget = {
+    type: AccessLogTargetType;
+    id: string;
+} | null;
+/**
+ * Writes access_log rows for one dashboard handler. Best-effort: the write runs
+ * detached and a failure is logged through the handler's own logger.
+ */
+export declare class DashboardAccessRecorder {
+    private readonly accessLog;
+    private readonly scope;
+    private readonly logger;
+    /**
+     * @param scope read at every write, so a handler re-bound to another org or
+     *   routing key attributes its later rows to the new pair.
+     */
+    constructor(accessLog: AccessLogWriter | undefined, scope: () => AccessScope, logger: DetachedFailureLogger);
+    /** Record a row attributed to the handler's bound scope. */
+    record(actor: ActorPrincipal, action: AccessLogAction, target: AccessTarget, requestId: string | null, outcome: AccessLogOutcome, errorMessage?: string | null): void;
+    /** Record a row attributed to an explicit scope (the org that owns the target). */
+    recordIn(scope: AccessScope, actor: ActorPrincipal, action: AccessLogAction, target: AccessTarget, requestId: string | null, outcome: AccessLogOutcome, errorMessage?: string | null): void;
+}
+/** Where an audited request writes its row and its answer. */
+export interface AuditedIo {
+    recorder: DashboardAccessRecorder;
+    send: (msg: Record<string, unknown>) => void;
+    sendError: (type: string, requestId: string, err: unknown) => void;
+}
+/** One request's audit identity: who, what, on which target, answered with which frame. */
+export interface AuditedRequest {
+    msg: {
+        actor: ActorPrincipal;
+        requestId: string;
+    };
+    action: AccessLogAction;
+    target: AccessTarget;
+    responseType: string;
+    /** The policy gate. Returns false after answering a denied request itself. */
+    enforce?: () => Promise<boolean>;
+}
+/**
+ * Run one dashboard request: the optional policy gate, then `body`. On success
+ * it records an `allowed` row and sends `{ type: responseType, requestId,
+ * ...payload }`; on a throw it records an `error` row with the message and hands
+ * the error to `sendError`. A gate that returns false has already answered the
+ * request, so nothing else runs. A gate that throws propagates to the caller.
+ */
+export declare function audited(args: AuditedIo & AuditedRequest, body: () => Promise<Record<string, unknown> | void>): Promise<void>;
+//# sourceMappingURL=dashboard-access.d.ts.map

package/dist/ws/dashboard-backends-handler.d.ts

@@ -28,7 +28,7 @@ export declare class DashboardBackendsHandler {
     private readonly deps;
     private orgId;
     private routingKey;
-    private readonly accessLog;
+    private readonly access;
     constructor(deps: DashboardBackendsHandlerDeps);
     /**
      * Update the bound orgId + routingKey. Called from server.ts after resolving
@@ -45,11 +45,6 @@ export declare class DashboardBackendsHandler {
      * customer yet, so there's nothing to look up.
      */
     private enforcePolicy;
-    /**
-     * Write an access_log row for a handler invocation. Best-effort; the writer
-     * swallows failures.
-     */
-    private recordAccess;
     /**
      * Route a dashboard backends message to the appropriate handler.
      * Returns true if the message was handled, false otherwise.

package/dist/ws/dashboard-context-handler.d.ts

@@ -10,7 +10,7 @@
  * 2. Calls the appropriate store method
  * 3. Returns a response message with requestId and data (or error)
  */
-import { type Kysely } from 'kysely';
+import type { Kysely } from 'kysely';
 import type { HeldRunStore, ReleaseSignal } from '../contexts/held-runs.js';
 import type { TeamMembershipLookup } from '../approvals/approval-resolver.js';
 import { type ApplyDecisionDeps } from '../approvals/apply-decision.js';
@@ -47,13 +47,12 @@ export interface DashboardContextHandlerDeps {
     /** Routing key for access_log rows (null when not run-scoped). */
     routingKey?: string | null;
     /**
-     * Held-run store + resume hook for the approve/reject flow. When present, the
-     * approve/reject handlers route through the shared `applyDecision` applier
-     * (eligibility check, real attribution, multi-clause accumulation, and the
-     * resume-after-approval re-dispatch). When absent (legacy / tests), the
-     * handlers fall back to the direct status flip.
+     * Held-run store + resume hook for the approve/reject flow. The approve/reject
+     * handlers route through the shared `applyDecision` applier (eligibility
+     * check, real attribution, multi-clause accumulation, and the
+     * resume-after-approval re-dispatch).
      */
-    approvals?: ApprovalHandlerDeps;
+    approvals: ApprovalHandlerDeps;
     /**
      * Dashboard-encryption key resolver. Present when KICI_SECRET_KEY is
      * configured. Under the `encrypted` posture the secret/variable set handlers
@@ -100,7 +99,7 @@ export interface ApprovalHandlerDeps {
 export declare class DashboardContextHandler {
     private readonly deps;
     private routingKey;
-    private readonly accessLog;
+    private readonly access;
     constructor(deps: DashboardContextHandlerDeps);
     /** Update the orgId used for all operations (called when resolved from DB). */
     setOrgId(orgId: string): void;
@@ -113,6 +112,8 @@ export declare class DashboardContextHandler {
      * sends a structured `operation_disabled` envelope back to Platform.
      */
     private enforcePolicy;
+    /** Run a single-call request through `audited` with this handler's recorder and response channel. */
+    private audited;
     /**
      * Resolve the plaintext value for a secret/variable set under the write
      * policy. When the client sends a `sealed` envelope, decrypt it with the
@@ -123,12 +124,6 @@ export declare class DashboardContextHandler {
      * structured error code the caller records + sends back.
      */
     private resolveWriteValue;
-    /**
-     * Write an access_log row for a handler invocation. Uses the handler's
-     * bound orgId + routingKey, the msg.actor principal, and the handler-
-     * specified action + target. Best-effort; the writer swallows failures.
-     */
-    private recordAccess;
     /**
      * Route a dashboard message to the appropriate handler.
      * Returns true if the message was handled, false otherwise.
@@ -140,7 +135,7 @@ export declare class DashboardContextHandler {
      * its scope bindings. Joins `context_bindings` → `scoped_secrets` on the
      * scope pattern, excluding the `__empty__` sentinel. Returns key names only —
      * never values. Scoped to the caller-resolved org (the request's target org,
-     * or the connection-level org on the legacy path).
+     * else the connection-level org).
      */
     private loadSecretKeysByEnv;
     private handleEnvGet;

package/dist/ws/dashboard-fleet-write-handler.d.ts

@@ -27,7 +27,7 @@ export declare class DashboardFleetWriteHandler {
     private readonly deps;
     private orgId;
     private routingKey;
-    private readonly accessLog;
+    private readonly access;
     constructor(deps: DashboardFleetWriteHandlerDeps);
     /**
      * Update the bound orgId + routingKey. Called from server.ts after resolving
@@ -43,11 +43,6 @@ export declare class DashboardFleetWriteHandler {
      * Fails open when no org is bound — the orch hasn't resolved a customer yet.
      */
     private enforcePolicy;
-    /**
-     * Write an access_log row for a handler invocation. Best-effort; the writer
-     * swallows failures.
-     */
-    private recordAccess;
     /**
      * Answer a write the roster store refused for the Platform's authority: a
      * `denied` access-log row with `<code>:<detail>`, and the refusal code in the

package/dist/ws/dashboard-global-workflows-handler.d.ts

@@ -41,7 +41,7 @@ export declare function isDashboardGlobalWorkflowsMessage(msg: {
 } | null | undefined): msg is GlobalWorkflowsMessage;
 export declare class DashboardGlobalWorkflowsHandler {
     private readonly deps;
-    private readonly accessLog;
+    private readonly access;
     constructor(deps: DashboardGlobalWorkflowsHandlerDeps);
     /** Update the customer / org id this handler operates on. */
     setOrgId(customerId: string | null): void;
@@ -51,11 +51,6 @@ export declare class DashboardGlobalWorkflowsHandler {
      * envelope and a `denied` access_log row) when policy says no.
      */
     private enforcePolicy;
-    /**
-     * Write an access_log row for a handler invocation. Best-effort; the writer
-     * swallows failures.
-     */
-    private recordAccess;
     handleMessage(msg: GlobalWorkflowsMessage): Promise<boolean>;
     private handleGet;
     private handleUpdate;

package/dist/ws/dashboard-registrations-handler.d.ts

@@ -51,7 +51,7 @@ type RegistrationMessage = RegistrationsListMessage | RegistrationDisableMessage
 export declare class DashboardRegistrationsHandler {
     private readonly deps;
     private routingKey;
-    private readonly accessLog;
+    private readonly access;
     constructor(deps: DashboardRegistrationsHandlerDeps);
     /** Update the orgId used for all operations (called when resolved from DB). */
     setOrgId(orgId: string): void;
@@ -64,12 +64,6 @@ export declare class DashboardRegistrationsHandler {
      * and emits a structured `operation_disabled` envelope on the WS.
      */
     private enforcePolicy;
-    /**
-     * Write an access_log row for a handler invocation. Uses the handler's
-     * bound orgId + routingKey, the msg.actor principal, and the handler-
-     * specified action + target. Best-effort; the writer swallows failures.
-     */
-    private recordAccess;
     handle(msg: RegistrationMessage): Promise<void>;
     private handleDisable;
     private handleDelete;