@kici-dev/orchestrator 0.15.0 → 0.17.0

package/dist/git/inherited-secret.d.ts

@@ -1,29 +0,0 @@
-/**
- * Read a secret output this job inherited from a `needs` upstream.
- *
- * Backs the reserved `needs:` context in a qualified credential reference. The
- * value was written by `ctx.setSecretOutput`, is encrypted at rest in
- * `run_secret_outputs`, and is deleted when the run completes — so this reads
- * the store that already exists rather than adding a second one.
- */
-import type { ResolvedMasterKeys } from '../secrets/config.js';
-import type { SecretOutputStore } from '../secrets/secret-output-store.js';
-export interface InheritedSecretDeps {
-    secretOutputStore: SecretOutputStore;
-    /** Upstream job ids for a job, in the same shape the run merge path uses. */
-    upstreamJobIds: (runId: string, jobId: string) => Promise<string[]>;
-    /**
-     * The orchestrator's master key, plus the previous generation during a
-     * rotation grace window — a stored output sealed under the old key still
-     * unseals until `rotate-key` has swept the table.
-     */
-    masterKeys: ResolvedMasterKeys;
-}
-/**
- * Build the `secretOutputs` lookup the credential broker takes.
- *
- * Returns null when the key was not published by any upstream — the broker
- * turns that into an actionable error naming `setSecretOutput`.
- */
-export declare function createInheritedSecretReader(deps: InheritedSecretDeps): (runId: string, jobId: string, key: string) => Promise<string | null>;
-//# sourceMappingURL=inherited-secret.d.ts.map

package/dist/scaler/container-spawn.d.ts

@@ -1,28 +0,0 @@
-/**
- * Container-spawn primitives specific to the orchestrator's scaler backends.
- *
- * The runtime-injection half of this module (`pullImageIfMissing`,
- * `ensureRuntimeVolume`, `runtimeInjectBind`, `injectedAgentCommand`,
- * `runtimeVolumeName`, `RUNTIME_MOUNT`) now lives in
- * `@kici-dev/shared/container-runtime`, because the AGENT needs exactly the
- * same behaviour when it nests a job container. What stays here is the piece
- * only a scaler backend does: streaming a host workspace into a container it
- * just created.
- */
-/**
- * Stream a host directory into a container path.
- *
- * Used to populate a container-owned `/workspace` volume, which is a volume
- * rather than a host bind precisely so the host-uid vs container-uid conflict
- * disappears once `CapDrop: ALL` removes CAP_DAC_OVERRIDE — so the tree has to
- * be copied in rather than mounted.
- *
- * A failure is fatal to the spawn: swallowing it starts the job against an
- * empty workspace, which surfaces as a baffling "file not found" later.
- */
-export declare function copyTreeIntoContainer(container: {
-    putArchive(stream: unknown, opts: {
-        path: string;
-    }): Promise<unknown>;
-}, hostDir: string, containerPath: string): Promise<void>;
-//# sourceMappingURL=container-spawn.d.ts.map