@kici-dev/orchestrator 0.15.0 → 0.16.0

package/dist/index.js

@@ -10,8 +10,9 @@ import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
 import { chmod, mkdir, readFile, unlink, writeFile } from "node:fs/promises";
 import { Kysely, PostgresDialect, sql } from "kysely";
 import pg from "pg";
-import { DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_APPROVAL_EXPIRY_SECONDS, ForkPolicy, HoldScope, HoldType, OrchRole, TriggerSource, approvalExpiryHoursOf, approvalExpirySecondsOf, persistedHoldTypeSpellings } from "@kici-dev/engine";
+import { DEFAULT_APPROVAL_EXPIRY_SECONDS, ForkPolicy, HoldScope, HoldType, OrchRole, TriggerSource } from "@kici-dev/engine";
 import { z } from "zod";
+import { ORCHESTRATOR_DEFAULT_PORT } from "@kici-dev/shared/env";
 import { platform, tmpdir } from "node:os";
 import { createInterface } from "node:readline";
 import { Octokit } from "@octokit/rest";
@@ -702,7 +703,7 @@ function createCacheStorage(config) {
 * defect this layout closes — so serving it would serve the bug. For a v6 lock
 * the fallback is unreachable anyway, since the schema bump moves every hash.
 * Old objects are orphaned. The cache TTL is enforced lazily on access, so
-* nothing here removes them; `kici-admin cache purge-legacy` does.
+* nothing here removes them.
 */
 const logger$4 = createLogger({ prefix: "source-cache" });
 /**
@@ -1105,8 +1106,7 @@ const DEFAULT_USER_CACHE_TTL_MS = 6048e5;
 const TAR_SUFFIX = ".tar.gz";
 /**
 * Stem prefix of an in-flight upload, `.tmp-<uuid>.tar.gz`: the presigned PUT
-* target a save lands on before commit copies it to its final key. Shared with
-* the retired-layout classifier so both agree on what an upload looks like.
+* target a save lands on before commit copies it to its final key.
 */
 const TEMP_UPLOAD_STEM = ".tmp-";
 /** Whether a listed object is an in-flight upload rather than a cache entry. */
@@ -1122,7 +1122,7 @@ const KEY_DISCRIMINATOR_TAIL = new RegExp(`^(.*)-([0-9a-f]{32})$`);
 * is what keeps two other kinds of object out of a restore: an in-flight
 * `.tmp-<uuid>.tar.gz` upload, which is a partial tarball until commit copies
 * it to its final key, and an object under the retired un-discriminated layout,
-* which nothing writes and which `kici-admin cache purge-legacy` removes.
+* which nothing writes.
 */
 function isCommittedEntry(key) {
 	return key.endsWith(TAR_SUFFIX) && KEY_DISCRIMINATOR_TAIL.test(key.slice(0, -7));
@@ -1147,9 +1147,6 @@ function stripKeyDiscriminator(stem) {
 * signature on a pre-signed PUT/GET. Repo identifiers like `.` (the internal
 * provider's repo id) hit exactly this case, so the all-dots guard keeps the
 * object key canonical and the namespace boundary intact.
-*
-* Exported so an operator tool that addresses an org's prefix from a raw org id
-* (`kici-admin cache purge-legacy --org`) lands on the segment the writer used.
 */
 function sanitizeSegment(s) {
 	const cleaned = s.replace(/[^A-Za-z0-9._-]/g, "_");
@@ -1199,10 +1196,8 @@ function finalKey(prefix, key) {
 }
 /**
 * The object key a committed save under `key` lands on for this ref. This is
-* the writer's own path — `beginSave` and `commitSave` address the entry
-* through it — so anything that must recognise a current-layout key (the
-* legacy-layout classifier tests) takes it from here rather than restating
-* the format.
+* the writer's own path: `beginSave` and `commitSave` address the entry
+* through it.
 */
 function userCacheEntryKey(ref, key) {
 	return finalKey(writePrefix(ref), key);
@@ -1451,7 +1446,7 @@ var PeerCredentialStore = class {
 	}
 	/** The most recently revoked credential row for `instanceId`, or null. */
 	async findLatestRevokedByInstanceId(instanceId) {
-		const row = await this.db.selectFrom("peer_credentials").selectAll().where("instance_id", "=", instanceId).where("revoked_at", "is not", null).orderBy("revoked_at", "desc").executeTakeFirst();
+		const row = await this.db.selectFrom("peer_credentials").selectAll().where("instance_id", "=", instanceId).where("revoked_at", "is not", null).orderBy("revoked_at", "desc").orderBy("created_at", "desc").executeTakeFirst();
 		return row ? mapRow(row) : null;
 	}
 	/**
@@ -2324,18 +2319,15 @@ var HeldRunStore = class {
 	* incidental: `expireOverdue` is not scope-filtered, so a released-but-not-yet-
 	* resumed row would otherwise be expired out from under its resume.
 	*
-	* The filter matches every persisted spelling of the timer hold type, so a row
-	* an un-upgraded orchestrator wrote as `wait_timer` still resumes rather than
-	* falling through to the expire-and-fail sweep. It deliberately does NOT
-	* filter on `hold_scope`: a job-scoped timer hold used to be excluded here,
-	* which left it with no release path at all — created, never released,
-	* eventually expired, its job never dispatched.
+	* The filter deliberately does NOT filter on `hold_scope`: a job-scoped timer
+	* hold used to be excluded here, which left it with no release path at all —
+	* created, never released, eventually expired, its job never dispatched.
 	*/
 	async releaseDueWaitHolds() {
 		return (await this.db.updateTable("held_runs").set({
 			status: "released",
 			resolved_at: sql`now()`
-		}).where("status", "=", "pending").where("hold_type", "in", persistedHoldTypeSpellings(HoldType.enum.timer)).where("expires_at", "<", sql`now()`).returningAll().execute()).map((row) => ({
+		}).where("status", "=", "pending").where("hold_type", "=", HoldType.enum.timer).where("expires_at", "<", sql`now()`).returningAll().execute()).map((row) => ({
 			holdId: row.id,
 			runId: row.run_id,
 			jobId: row.job_id,
@@ -2353,7 +2345,7 @@ var HeldRunStore = class {
 	* `listQueuedHoldsForContext` fetches the rows it actually releases.
 	*/
 	async listAllQueuedHolds() {
-		return await this.db.selectFrom("held_runs").innerJoin("execution_runs", "execution_runs.run_id", "held_runs.run_id").select(["held_runs.org_id as orgId", "execution_runs.context as concurrencyGroup"]).where("held_runs.status", "=", "pending").where("held_runs.hold_type", "in", persistedHoldTypeSpellings(HoldType.enum.concurrency)).execute();
+		return await this.db.selectFrom("held_runs").innerJoin("execution_runs", "execution_runs.run_id", "held_runs.run_id").select(["held_runs.org_id as orgId", "execution_runs.context as concurrencyGroup"]).where("held_runs.status", "=", "pending").where("held_runs.hold_type", "=", HoldType.enum.concurrency).execute();
 	}
 	/**
 	* List the pending queued (concurrency) holds for one context's concurrency
@@ -2366,7 +2358,7 @@ var HeldRunStore = class {
 	* starve whoever waited longest.
 	*/
 	async listQueuedHoldsForContext(orgId, concurrencyGroup) {
-		return this.db.selectFrom("held_runs").innerJoin("execution_runs", "execution_runs.run_id", "held_runs.run_id").selectAll("held_runs").where("held_runs.org_id", "=", orgId).where("held_runs.status", "=", "pending").where("held_runs.hold_type", "in", persistedHoldTypeSpellings(HoldType.enum.concurrency)).where("execution_runs.context", "=", concurrencyGroup).where("execution_runs.customer_id", "=", orgId).orderBy("held_runs.created_at", "asc").execute();
+		return this.db.selectFrom("held_runs").innerJoin("execution_runs", "execution_runs.run_id", "held_runs.run_id").selectAll("held_runs").where("held_runs.org_id", "=", orgId).where("held_runs.status", "=", "pending").where("held_runs.hold_type", "=", HoldType.enum.concurrency).where("execution_runs.context", "=", concurrencyGroup).where("execution_runs.customer_id", "=", orgId).orderBy("held_runs.created_at", "asc").execute();
 	}
 	/**
 	* Expire overdue pending runs. Called by the stale detector.
@@ -2406,12 +2398,10 @@ function createHeldRunStoreFromUrl(databaseUrl, opts) {
 const DEFAULT_FORK_POLICY = ForkPolicy.enum.ignore;
 Object.freeze({
 	forkPolicy: DEFAULT_FORK_POLICY,
-	approvalExpiryHours: DEFAULT_APPROVAL_EXPIRY_HOURS,
 	approvalExpirySeconds: DEFAULT_APPROVAL_EXPIRY_SECONDS
 });
 Object.freeze({
 	forkPolicy: ForkPolicy.enum.hold,
-	approvalExpiryHours: DEFAULT_APPROVAL_EXPIRY_HOURS,
 	approvalExpirySeconds: DEFAULT_APPROVAL_EXPIRY_SECONDS
 });
 z.enum([
@@ -2441,34 +2431,9 @@ const TrustPolicySource = z.enum(["platform", "local"]);
 */
 const DEFAULT_TRUST_POLICY = {
 	forkPolicy: DEFAULT_FORK_POLICY,
-	approvalExpiryHours: DEFAULT_APPROVAL_EXPIRY_HOURS,
 	approvalExpirySeconds: DEFAULT_APPROVAL_EXPIRY_SECONDS
 };
 /**
-* Resolve a local patch's approval-expiry window against what is already stored.
-*
-* One value is being set, spelled two ways, so the pair is merged as a unit and
-* always re-derived from the winning seconds value:
-*
-* - a patch naming `approvalExpirySeconds` sets the window, and the hours field
-*   is recomputed from it — a stale hours value left behind would be the coarse
-*   view of a window that is no longer stored;
-* - a patch naming only `approvalExpiryHours` sets the window too, and the
-*   seconds field is recomputed from it — keeping the old seconds value would
-*   let it out-rank the operator's explicit hours and silently discard the
-*   write;
-* - a patch naming both takes the seconds value, because it is the more
-*   specific of the two (`approvalExpirySecondsOf`);
-* - a patch naming neither leaves the stored window untouched.
-*/
-function mergedExpiry(patch, existing) {
-	const seconds = (patch.approvalExpirySeconds != null || patch.approvalExpiryHours != null ? approvalExpirySecondsOf(patch) : null) ?? existing?.approvalExpirySeconds ?? DEFAULT_TRUST_POLICY.approvalExpirySeconds ?? DEFAULT_APPROVAL_EXPIRY_SECONDS;
-	return {
-		approvalExpiryHours: approvalExpiryHoursOf(seconds),
-		approvalExpirySeconds: seconds
-	};
-}
-/**
 * Namespace for the per-org advisory lock taken by `upsertLocal`, so the key
 * cannot collide with another feature's advisory lock in the same database.
 */
@@ -2484,11 +2449,7 @@ var TrustPolicyStore = class {
 		if (!row) return null;
 		return {
 			forkPolicy: row.fork_policy,
-			approvalExpiryHours: Number(row.approval_expiry_hours),
-			approvalExpirySeconds: approvalExpirySecondsOf({
-				approvalExpiryHours: Number(row.approval_expiry_hours),
-				approvalExpirySeconds: row.approval_expiry_seconds == null ? null : Number(row.approval_expiry_seconds)
-			}),
+			approvalExpirySeconds: Number(row.approval_expiry_seconds),
 			source: row.source,
 			updatedAt: row.updated_at
 		};
@@ -2528,7 +2489,7 @@ var TrustPolicyStore = class {
 			const existing = await this.get(orgId, trx);
 			const merged = {
 				forkPolicy: patch.forkPolicy ?? existing?.forkPolicy ?? DEFAULT_TRUST_POLICY.forkPolicy,
-				...mergedExpiry(patch, existing)
+				approvalExpirySeconds: patch.approvalExpirySeconds ?? existing?.approvalExpirySeconds ?? DEFAULT_TRUST_POLICY.approvalExpirySeconds
 			};
 			await this.write(orgId, merged, TrustPolicySource.enum.local, trx);
 			await onWrite?.(trx, merged);
@@ -2536,11 +2497,9 @@ var TrustPolicyStore = class {
 		});
 	}
 	async write(orgId, policy, source, executor = this.db) {
-		const seconds = approvalExpirySecondsOf(policy);
 		const columns = {
 			fork_policy: policy.forkPolicy,
-			approval_expiry_hours: approvalExpiryHoursOf(seconds),
-			approval_expiry_seconds: seconds,
+			approval_expiry_seconds: policy.approvalExpirySeconds,
 			source,
 			updated_at: sql`now()`
 		};
@@ -2629,6 +2588,8 @@ function firstCauseMessage(err) {
 function isTransportFailure(err) {
 	return err instanceof TypeError && err.message === "fetch failed";
 }
+/** The admin API address kici-admin dials when neither --url nor KICI_ADMIN_URL is set. */
+const DEFAULT_ADMIN_URL = `http://localhost:${ORCHESTRATOR_DEFAULT_PORT}`;
 async function fetchAdminApi(url, init, baseUrl) {
 	try {
 		return await fetch(url, init);
@@ -2639,9 +2600,20 @@ async function fetchAdminApi(url, init, baseUrl) {
 		}
 		const detail = firstCauseMessage(err);
 		const cause = detail ? ` (${detail})` : "";
-		throw new Error(`cannot reach the orchestrator admin API at ${baseUrl}${cause}. Set KICI_ADMIN_URL to the orchestrator's HTTP address, or pass --base-url where the subcommand accepts it. Note KICI_ORCHESTRATOR_URL is NOT read by this CLI; if other subcommands appear to work, they are using the --database-url / KICI_DATABASE_URL direct-DB path rather than HTTP.`, { cause: err });
+		const defaultHint = baseUrl === DEFAULT_ADMIN_URL ? ` ${DEFAULT_ADMIN_URL} is kici-admin's built-in default, the orchestrator's default port on this host; an orchestrator on another host, or one whose KICI_PORT sets another port, needs KICI_ADMIN_URL or --url.` : "";
+		throw new Error(`cannot reach the orchestrator admin API at ${baseUrl}${cause}. Set KICI_ADMIN_URL to the orchestrator's HTTP address, or pass --base-url where the subcommand accepts it. Note KICI_ORCHESTRATOR_URL is NOT read by this CLI; if other subcommands appear to work, they are using the --database-url / KICI_DATABASE_URL direct-DB path rather than HTTP.${defaultHint}`, { cause: err });
 	}
 }
+/** Build a `?a=1&b=2` query string, skipping undefined, null and empty-string values. */
+function toQuery(params) {
+	const usp = new URLSearchParams();
+	for (const [k, v] of Object.entries(params)) {
+		if (v === void 0 || v === null || v === "") continue;
+		usp.set(k, String(v));
+	}
+	const qs = usp.toString();
+	return qs ? `?${qs}` : "";
+}
 var AdminApiClient = class {
 	baseUrl;
 	token;
@@ -2841,17 +2813,17 @@ var AdminApiClient = class {
 		return this.request("POST", `/api/v1/admin/generic-sources/${encodeURIComponent(id)}/disable`);
 	}
 	async queryAudit(opts) {
-		const params = new URLSearchParams();
-		if (opts?.contextName) params.set("contextName", opts.contextName);
-		if (opts?.routingKey) params.set("routingKey", opts.routingKey);
-		if (opts?.action) params.set("action", opts.action);
-		if (opts?.from) params.set("from", opts.from);
-		if (opts?.to) params.set("to", opts.to);
-		if (opts?.limit !== void 0) params.set("limit", String(opts.limit));
-		if (opts?.offset !== void 0) params.set("offset", String(opts.offset));
-		if (opts?.includeArchived) params.set("includeArchived", "true");
-		const qs = params.toString();
-		return (await this.request("GET", `/api/v1/admin/audit${qs ? `?${qs}` : ""}`)).entries;
+		const qs = toQuery({
+			contextName: opts?.contextName,
+			routingKey: opts?.routingKey,
+			action: opts?.action,
+			from: opts?.from,
+			to: opts?.to,
+			limit: opts?.limit,
+			offset: opts?.offset,
+			includeArchived: opts?.includeArchived || void 0
+		});
+		return (await this.request("GET", `/api/v1/admin/audit${qs}`)).entries;
 	}
 	async createToken(data) {
 		return this.request("POST", "/api/v1/admin/tokens", data);
@@ -2942,7 +2914,23 @@ var AdminApiClient = class {
 	* other failure throws.
 	*/
 	async forgetPeer(body) {
-		const res = await fetchAdminApi(`${this.baseUrl}/api/v1/admin/peers/forget`, {
+		const { res, json, text } = await this.postForBody("/api/v1/admin/peers/forget", body);
+		if (res.ok) return json;
+		if (res.status === 409 && json.acknowledgementRequired === true) return {
+			instanceId: body.instanceId,
+			results: json.results ?? [],
+			acknowledgementRequired: true,
+			...json.error ? { error: json.error } : {}
+		};
+		throw new Error(`HTTP ${res.status}: ${json.error ?? text}`);
+	}
+	/**
+	* POST `body` and parse the answer whatever its status, for a route that
+	* reports per-instance results on a non-2xx status too. An unparseable body
+	* reads as `{}`.
+	*/
+	async postForBody(path, body) {
+		const res = await fetchAdminApi(`${this.baseUrl}${path}`, {
 			method: "POST",
 			headers: {
 				Authorization: `Bearer ${this.token}`,
@@ -2957,14 +2945,25 @@ var AdminApiClient = class {
 		} catch {
 			parsed = void 0;
 		}
-		const json = parsed ?? {};
-		if (res.ok) return json;
-		if (res.status === 409 && json.acknowledgementRequired === true) return {
-			instanceId: body.instanceId,
-			results: json.results ?? [],
-			acknowledgementRequired: true,
-			...json.error ? { error: json.error } : {}
+		return {
+			res,
+			json: parsed ?? {},
+			text
 		};
+	}
+	/**
+	* Reload the scaler config on this orchestrator and, unless `single`, on every
+	* peer it is connected to. A response where an instance refused its file or
+	* was not reached (422) is returned like a success, so the caller can show
+	* every instance; a 404 means the orchestrator predates the route.
+	*/
+	async scalerReload(body) {
+		const { res, json, text } = await this.postForBody("/api/v1/admin/scaler/reload", body);
+		if ((res.ok || res.status === 422) && Array.isArray(json.results)) return {
+			scope: json.scope ?? (body.single ? "single" : "cluster"),
+			results: json.results
+		};
+		if (res.status === 404) throw new Error("this orchestrator predates kici-admin scaler reload; send SIGHUP to it or upgrade it");
 		throw new Error(`HTTP ${res.status}: ${json.error ?? text}`);
 	}
 	/** List the live Firecracker VMs on this coordinator, or on the `target` peer. */
@@ -3016,15 +3015,15 @@ var AdminApiClient = class {
 	* are returned.
 	*/
 	async listRuns(opts) {
-		const params = new URLSearchParams();
-		if (opts?.status) params.set("status", opts.status);
-		if (opts?.workflowName) params.set("workflowName", opts.workflowName);
-		if (opts?.repo) params.set("repo", opts.repo);
-		if (opts?.since) params.set("since", opts.since);
-		if (opts?.limit) params.set("limit", String(opts.limit));
-		if (opts?.offset) params.set("offset", String(opts.offset));
-		const qs = params.toString();
-		return this.request("GET", `/api/v1/admin/runs${qs ? `?${qs}` : ""}`);
+		const qs = toQuery({
+			status: opts?.status,
+			workflowName: opts?.workflowName,
+			repo: opts?.repo,
+			since: opts?.since,
+			limit: opts?.limit || void 0,
+			offset: opts?.offset || void 0
+		});
+		return this.request("GET", `/api/v1/admin/runs${qs}`);
 	}
 	/**
 	* Count matching runs without returning the row list. Wraps the list
@@ -3077,27 +3076,27 @@ var AdminApiClient = class {
 	* secret_audit_log table.
 	*/
 	async getRunSecretOutputs(runId, opts) {
-		const params = new URLSearchParams();
-		if (opts?.outputKey) params.set("outputKey", opts.outputKey);
-		if (opts?.reveal) params.set("reveal", "true");
-		const qs = params.toString();
-		return this.request("GET", `/api/v1/admin/runs/${encodeURIComponent(runId)}/secret-outputs${qs ? `?${qs}` : ""}`);
+		const qs = toQuery({
+			outputKey: opts?.outputKey,
+			reveal: opts?.reveal || void 0
+		});
+		return this.request("GET", `/api/v1/admin/runs/${encodeURIComponent(runId)}/secret-outputs${qs}`);
 	}
 	async listEventLog(opts) {
-		const params = new URLSearchParams();
-		if (opts?.orgId) params.set("orgId", opts.orgId);
-		if (opts?.routingKey) params.set("routingKey", opts.routingKey);
-		if (opts?.event) params.set("event", opts.event);
-		if (opts?.action) params.set("action", opts.action);
-		if (opts?.status) params.set("status", opts.status);
-		if (opts?.from) params.set("from", opts.from);
-		if (opts?.to) params.set("to", opts.to);
-		if (opts?.deliveryId) params.set("deliveryId", opts.deliveryId);
-		if (opts?.limit !== void 0) params.set("limit", String(opts.limit));
-		if (opts?.offset !== void 0) params.set("offset", String(opts.offset));
-		if (opts?.includeArchived) params.set("includeArchived", "true");
-		const qs = params.toString();
-		return this.request("GET", `/api/v1/admin/event-log${qs ? `?${qs}` : ""}`);
+		const qs = toQuery({
+			orgId: opts?.orgId,
+			routingKey: opts?.routingKey,
+			event: opts?.event,
+			action: opts?.action,
+			status: opts?.status,
+			from: opts?.from,
+			to: opts?.to,
+			deliveryId: opts?.deliveryId,
+			limit: opts?.limit,
+			offset: opts?.offset,
+			includeArchived: opts?.includeArchived || void 0
+		});
+		return this.request("GET", `/api/v1/admin/event-log${qs}`);
 	}
 	async getEventLog(deliveryId, opts) {
 		const params = new URLSearchParams({ orgId: opts.orgId });
@@ -3107,44 +3106,42 @@ var AdminApiClient = class {
 	}
 	/** List internal events, newest first (`GET /api/v1/admin/events`). */
 	async listEvents(opts) {
-		const params = new URLSearchParams();
-		if (opts?.name) params.set("name", opts.name);
-		if (opts?.outcome) params.set("outcome", opts.outcome);
-		if (opts?.since) params.set("since", opts.since);
-		if (opts?.before) params.set("before", opts.before);
-		if (opts?.limit !== void 0) params.set("limit", String(opts.limit));
-		const qs = params.toString();
-		return this.request("GET", `/api/v1/admin/events${qs ? `?${qs}` : ""}`);
+		const qs = toQuery({
+			name: opts?.name,
+			outcome: opts?.outcome,
+			since: opts?.since,
+			before: opts?.before,
+			limit: opts?.limit
+		});
+		return this.request("GET", `/api/v1/admin/events${qs}`);
 	}
 	/** One internal event with its redacted payload and dispatched runs. */
 	async getEvent(id) {
 		return this.request("GET", `/api/v1/admin/events/${encodeURIComponent(id)}`);
 	}
 	async listAccessLog(opts) {
-		const params = new URLSearchParams();
-		if (opts?.orgId) params.set("orgId", opts.orgId);
-		if (opts?.actorType) params.set("actorType", opts.actorType);
-		if (opts?.actorId) params.set("actorId", opts.actorId);
-		if (opts?.action) params.set("action", opts.action);
-		if (opts?.source) params.set("source", opts.source);
-		if (opts?.outcome) params.set("outcome", opts.outcome);
-		if (opts?.targetType) params.set("targetType", opts.targetType);
-		if (opts?.targetId) params.set("targetId", opts.targetId);
-		if (opts?.from) params.set("from", opts.from);
-		if (opts?.to) params.set("to", opts.to);
-		if (opts?.q) params.set("q", opts.q);
-		if (opts?.agentLabel) params.set("agentLabel", opts.agentLabel);
-		if (opts?.agentOnly) params.set("agentOnly", "true");
-		if (opts?.limit !== void 0) params.set("limit", String(opts.limit));
-		if (opts?.cursor) params.set("cursor", opts.cursor);
-		const qs = params.toString();
-		return this.request("GET", `/api/v1/admin/access-log${qs ? `?${qs}` : ""}`);
+		const qs = toQuery({
+			orgId: opts?.orgId,
+			actorType: opts?.actorType,
+			actorId: opts?.actorId,
+			action: opts?.action,
+			source: opts?.source,
+			outcome: opts?.outcome,
+			targetType: opts?.targetType,
+			targetId: opts?.targetId,
+			from: opts?.from,
+			to: opts?.to,
+			q: opts?.q,
+			agentLabel: opts?.agentLabel,
+			agentOnly: opts?.agentOnly || void 0,
+			limit: opts?.limit,
+			cursor: opts?.cursor
+		});
+		return this.request("GET", `/api/v1/admin/access-log${qs}`);
 	}
 	async getAccessLogEntry(id, opts) {
-		const params = new URLSearchParams();
-		if (opts?.orgId) params.set("orgId", opts.orgId);
-		const qs = params.toString();
-		return this.request("GET", `/api/v1/admin/access-log/${encodeURIComponent(id)}${qs ? `?${qs}` : ""}`);
+		const qs = toQuery({ orgId: opts?.orgId });
+		return this.request("GET", `/api/v1/admin/access-log/${encodeURIComponent(id)}${qs}`);
 	}
 	async diagnose() {
 		return this.request("GET", "/admin/diagnose");

package/dist/metrics/prometheus.d.ts

@@ -703,11 +703,6 @@ export declare const wsUnsupportedMessageSentTotal: import("@opentelemetry/api")
  * `received_type`.
  */
 export declare const wsNackReceivedTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
-/**
- * Feature-gated sends the orchestrator SUPPRESSED because the Platform advertised
- * a capability set that lacks the required flag. Labelled by `capability` + `type`.
- */
-export declare const wsPlatformCapabilityGapTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
 /**
  * Register every queued orchestrator observable gauge on the real meter.
  *

package/dist/oidc/id-token-claims.d.ts

@@ -1,7 +1,7 @@
 /**
  * OIDC ID-token claims for orchestrator-side minting — shared by the
  * production orchestrator-owned mint (`orchestrator-mint.ts`) and the local
- * dev-signed identity (`local-mint.ts`). Mirrors the Platform's claim shape so
+ * dev-signed identity (`local-mint.ts`). One claim shape, so
  * every bundle carries the exact same claims the agent's statement builder +
  * the engine verifier expect — the cross-check between the in-toto statement
  * and the token claims is identical across all minters. The dev-signed path

package/dist/oidc/resolve-signer.d.ts

@@ -1,10 +1,8 @@
 /**
  * Bounded wait for the orchestrator's provenance signer.
  *
- * A mint that arrives before any node has generated the key must NOT fall
- * back to a Platform-signed bundle (it would fail verification against the
- * orchestrator trust root), so the resolver waits for the key instead of
- * deferring on the first miss. But the wait exists for ONE condition — a
+ * A mint that arrives before any node has generated the key must not fail,
+ * so the resolver waits for the key instead of deferring on the first miss. But the wait exists for ONE condition — a
  * reconcile that returns `null` because a non-leader is still leaving key
  * creation to the leader. A reconcile that THROWS is a different answer:
  * a signing key sealed under a master key this process does not hold, or `db`

package/dist/orchestrator-core.d.ts

@@ -31,6 +31,7 @@ import { AgentMetricsAggregator } from './metrics/agent-metrics-aggregator.js';
 import { SourceLocationStore } from './app.js';
 import { ExecutionJobStatus, type PeerHeartbeat, type PeerLogsCollectRequest, type PeerToPeerMessage, type InvokeResult } from '@kici-dev/engine';
 import { ScalerManager } from './scaler/index.js';
+import { type ScalerFileReload } from './scaler/file-reload.js';
 import type { ScalerConfig } from './scaler/index.js';
 import type { CacheStorage } from './storage/index.js';
 import { type ProvenanceTrustRoot } from './provenance/trust-root.js';
@@ -90,9 +91,9 @@ export interface OrchestratorSubsystems {
     scalerConfig: ScalerConfig | null;
     cacheStorage: CacheStorage | undefined;
     /**
-     * Provenance trust root used to verify build-provenance bundles at ingest.
-     * The mode-specific hook (server.ts) wires the live issuer onto it from the
-     * Platform `auth.success` message via `onProvenanceIssuer`.
+     * Provenance trust root used to verify build-provenance bundles at ingest:
+     * the orchestrator's own key set, the local dev plane's signer, or the
+     * configured `KICI_PROVENANCE_ISSUER`.
      */
     provenanceTrustRoot: ProvenanceTrustRoot;
     /**
@@ -174,6 +175,12 @@ export interface OrchestratorSubsystems {
      * in setupCluster).
      */
     answerPeerForgetRequest: PeerForgetRequestHandler;
+    /**
+     * Reloads this orchestrator's scaler config (`kici-admin scaler reload`,
+     * SIGHUP). Wired into every outgoing PeerClient to answer a
+     * peer.scaler.reload.request.
+     */
+    scalerFileReload: ScalerFileReload;
     getLocalInventory: () => Omit<PeerHeartbeat, 'type'>;
     broadcastHeartbeatToAllPeers: () => void;
     broadcastAgentTokenRevoke: (tokenId: string) => void;

package/dist/pipeline/global-eval-round.d.ts

@@ -16,7 +16,7 @@
  * This module owns the partition, the grouping, and the dispatch-and-await. The
  * caller decides what to do with the verdicts.
  */
-import type { AgentCapabilities, GlobalEvalCandidateResult, LockJobOrFactory, LockWorkflow, SimulatedEvent, WorkflowDecision } from '@kici-dev/engine';
+import type { GlobalEvalCandidateResult, LockJobOrFactory, LockWorkflow, SimulatedEvent, WorkflowDecision } from '@kici-dev/engine';
 import { type GlobalEvalRoundCache } from '../cache/global-eval-round-cache.js';
 import type { PendingGlobalEvalTracker } from '../cache/pending-global-evals.js';
 import type { ClusterSettingsReader } from '../cluster/cluster-settings-reader.js';
@@ -135,17 +135,12 @@ export interface GlobalEvalAgentRegistry {
         arch: string;
         version?: string | null;
     }>;
-    /**
-     * Every registered agent, busy or idle. Optional so a test double can omit
-     * it; without it the up-front result-aware refusal never fires.
-     */
+    /** Every registered agent, busy or idle. Optional so a test double can omit it. */
     getAllEntries?(): Iterable<{
         labels: ReadonlySet<string>;
         platform: string;
         arch: string;
         version: string | null;
-        /** What the agent advertised on `agent.register`; `null` = supports nothing optional. */
-        capabilities: AgentCapabilities | null;
     }>;
 }
 /**
@@ -226,25 +221,6 @@ export interface GlobalEvalRoundArgs {
  * timeout message that says nothing about agent versions.
  */
 export declare function unsupportedFleetReason(agentRegistry?: GlobalEvalAgentRegistry): string | null;
-/**
- * Why a candidate with a result-aware generator is refused before any round.
- *
- * An agent without the capability runs every generator in the round, a
- * result-aware one included; that generator sees no upstream outputs and
- * returns the wrong jobs.
- */
-export declare const RESULT_AWARE_UNSUPPORTED_REASON: string;
-/**
- * Why no agent can run a round holding a result-aware generator, or `null`
- * when one might.
- *
- * The same bar as {@link unsupportedFleetReason}: refused only on proof. That
- * means init-runners ARE registered, every one reports a readable version, and
- * none advertises the capability. An empty fleet, a busy capable agent, or an
- * agent whose version cannot be read is not refused — the round queues on the
- * agent-feature label, and a scaler or a registering agent can still serve it.
- */
-export declare function resultAwareUnsupportedReason(agentRegistry?: GlobalEvalAgentRegistry): string | null;
 /**
  * Narrow one wire verdict into a value the dispatch path can trust.
  *

package/dist/pipeline/install-secrets-resolver.d.ts

@@ -116,9 +116,6 @@ export declare function validateRegistryUrlScheme(url: string, allowHttp: boolea
  * it set one, otherwise the `HoldType` member its action implies. Column and
  * gate share one vocabulary, so nothing is translated here.
  *
- * Distinct from the engine's `normalizePersistedHoldType`, which maps a value
- * read back OUT of the column onto that same vocabulary.
- *
  * Exported for tests.
  */
 export declare function resolveHoldType(action: 'hold' | 'wait' | 'queue', raw: string | undefined): string;

package/dist/pipeline/manual-schedule.d.ts

@@ -41,13 +41,7 @@ export declare function buildManualJobConfig(workflow: LockWorkflow, mat: Materi
     source: import("@kici-dev/engine").LockSource | undefined;
     workflowName: string;
     steps: readonly import("@kici-dev/engine").LockStepEntry[];
-    needs: readonly (string | {
-        name: string;
-        runOn: ("cancelled" | "cancelling" | "drift_dropped" | "failed" | "pending" | "queued" | "recovering" | "running" | "skipped" | "success" | "timed_out_stale" | "unroutable")[];
-    } | {
-        group: string;
-        runOn: ("cancelled" | "cancelling" | "drift_dropped" | "failed" | "pending" | "queued" | "recovering" | "running" | "skipped" | "success" | "timed_out_stale" | "unroutable")[];
-    })[];
+    needs: readonly (string | import("@kici-dev/engine").LockNeedsEntry | import("@kici-dev/engine").LockNeedsGroupEntry)[];
     rules: readonly import("@kici-dev/engine").LockRule[] | undefined;
     gitCredentials?: Readonly<Record<string, Readonly<Record<string, string>>>> | undefined;
     dispatchInputs?: Record<string, unknown> | undefined;

package/dist/provenance/dispatch-context.d.ts

@@ -31,13 +31,11 @@ import type { Database } from '../db/types.js';
  * `repository` / `ref` / `sha` / `workflowRef` / `runId` / `jobId`, none of
  * which depends on who signs the token. Only the statement's `builder.id`
  * needs an issuer, and an unset one reproduces the `/orchestrator/unknown`
- * builder the local guess has always recorded.
- *
- * Gating on the issuer here dropped the context for every orchestrator still
- * on the deprecated Platform-relay mint, so its agent fell back to the local
- * guess — `repository: 'unknown/unknown'` for a `file://` clone, and a bare
- * workflow name where the claim is `<name>@<sha>` — and the capture check
- * then refused every one of its deferred attestations.
+ * builder the local guess has always recorded. Gating on the issuer would send
+ * an orchestrator without one back to the local guess —
+ * `repository: 'unknown/unknown'` for a `file://` clone, and a bare workflow
+ * name where the claim is `<name>@<sha>` — and the capture check would refuse
+ * every one of its deferred attestations.
  */
 export declare function loadProvenanceContext(db: Kysely<Database>, runId: string, jobId: string, opts: {
     issuer: string | undefined;

package/dist/provenance/pending-attestations-repo.d.ts

@@ -26,7 +26,7 @@ export declare class PendingAttestationsRepo {
     /**
      * List pending rows oldest-first, optionally scoped to a run. Terminally
      * rejected rows (`rejected_at IS NOT NULL`) are excluded — the retrier never
-     * re-picks a row the Platform definitively cannot mint.
+     * re-picks a row the orchestrator definitively cannot mint.
      */
     list(opts?: {
         runId?: string;