@kici-dev/orchestrator 0.15.0 → 0.17.0

package/dist/routes/admin-event-log.d.ts

@@ -21,8 +21,9 @@ import { type ColdStore } from '@kici-dev/shared';
 import type { Kysely } from 'kysely';
 import type { Database } from '../db/types.js';
 import type { TokenManager } from '../secrets/token-manager.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
 import type { LogStorage } from '../reporting/log-storage.js';
+import { type AdminEnv } from './admin-env.js';
 export interface AdminEventLogRoutesDeps {
     db: Kysely<Database>;
     logStorage: LogStorage;
@@ -31,13 +32,5 @@ export interface AdminEventLogRoutesDeps {
     /** Optional cold-store for archived event_log rows. */
     coldStore?: ColdStore;
 }
-type AdminEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 export declare function createAdminEventLogRoutes(deps: AdminEventLogRoutesDeps): Hono<AdminEnv>;
-export {};
 //# sourceMappingURL=admin-event-log.d.ts.map

package/dist/routes/admin-events.d.ts

@@ -12,14 +12,12 @@ import type pg from 'pg';
 import type { GenericSourceManager } from '../webhook/generic-sources.js';
 import type { TrustStore } from '../events/trust-store.js';
 import type { TokenManager } from '../secrets/token-manager.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
 import type { AppConfig } from '../config.js';
 import type { ProviderRegistry } from '../provider-registry.js';
 import type { SecretResolver } from '../secrets/secret-resolver.js';
 import type { ClusterSettingsReader } from '../cluster/cluster-settings-reader.js';
-/**
- * Dependencies for admin event routes.
- */
+import { type AdminEnv } from './admin-env.js';
 interface AdminEventRouteDeps {
     sourceManager: GenericSourceManager;
     trustStore: TrustStore;
@@ -61,20 +59,12 @@ interface AdminEventRouteDeps {
      */
     pool?: pg.Pool;
 }
-/** Hono env type for admin event routes with context variables. */
-type AdminEventEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 /**
  * Create admin API routes for generic webhook sources and trust management.
  *
  * @param deps - Admin event route dependencies
  * @returns Hono app with admin event routes mounted at /api/v1/admin/*
  */
-export declare function createAdminEventRoutes(deps: AdminEventRouteDeps): Hono<AdminEventEnv>;
+export declare function createAdminEventRoutes(deps: AdminEventRouteDeps): Hono<AdminEnv>;
 export {};
 //# sourceMappingURL=admin-events.d.ts.map

package/dist/routes/admin-held-runs.d.ts

@@ -45,9 +45,10 @@ import { HeldRunStore, type ReleaseSignal } from '../contexts/held-runs.js';
 import type { TrustDirectoryStore } from '../security/trust-directory-store.js';
 import { adminActorSub, triggererSubjectFor } from '../approvals/triggerer-subject.js';
 import { type ResolveCheckStatusPoster } from '../pipeline/security-hold-check.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
 import type { AccessLogWriter } from '../audit/access-log.js';
 import type { Database, HeldRun } from '../db/types.js';
+import { type AdminEnv } from './admin-env.js';
 /**
  * Wording for the Platform-managed refusal, surfaced verbatim by the CLI.
  *
@@ -126,13 +127,6 @@ export interface HeldRunRouteDeps {
     accessLog: AccessLogWriter;
     release: HeldRunReleaseWiring;
 }
-type AdminEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 /**
  * The approval subject for a decision taken through an admin token.
  *

package/dist/routes/admin-list-limit.d.ts

@@ -0,0 +1,3 @@
+/** Page size from a `?limit=` query: a missing, non-numeric or non-positive value is 50; the cap is 200. */
+export declare function clampLimit(raw: string | undefined): number;
+//# sourceMappingURL=admin-list-limit.d.ts.map

package/dist/routes/admin-maintenance.d.ts

@@ -14,17 +14,10 @@
  */
 import { Hono } from 'hono';
 import type { Kysely } from 'kysely';
-import type { Role } from '../secrets/rbac.js';
+import { type AdminEnv } from './admin-env.js';
 interface MaintenanceRouteDeps {
     db: Kysely<any>;
 }
-type AdminMaintenanceEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
-export declare function createMaintenanceRoutes(deps: MaintenanceRouteDeps): Hono<AdminMaintenanceEnv>;
+export declare function createMaintenanceRoutes(deps: MaintenanceRouteDeps): Hono<AdminEnv>;
 export {};
 //# sourceMappingURL=admin-maintenance.d.ts.map

package/dist/routes/admin-orchestrator-drain.d.ts

@@ -14,22 +14,15 @@
 import { Hono } from 'hono';
 import { z } from 'zod';
 import type { DrainController } from '../drain/drain-controller.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
+import { type AdminEnv } from './admin-env.js';
 export declare const DrainActionSchema: z.ZodEnum<{
     drain: "drain";
     resume: "resume";
 }>;
 export type DrainAction = z.infer<typeof DrainActionSchema>;
-type AdminEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 export declare function createOrchestratorDrainRoutes(deps: {
     drainController: DrainController;
     rbac: RbacEnforcer;
 }): Hono<AdminEnv>;
-export {};
 //# sourceMappingURL=admin-orchestrator-drain.d.ts.map

package/dist/routes/admin-org-settings.d.ts

@@ -14,8 +14,9 @@ import { type Kysely } from 'kysely';
 import { type OrchestratorMode } from '@kici-dev/engine';
 import { DashboardWriteOperation } from '@kici-dev/engine/protocol/dashboard-write-operations';
 import type { Database } from '../db/types.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
 import type { AccessLogWriter } from '../audit/access-log.js';
+import { type AdminEnv } from './admin-env.js';
 interface OrgSettingsRouteDeps {
     db: Kysely<Database>;
     rbac: RbacEnforcer;
@@ -40,13 +41,6 @@ interface OrgSettingsRouteDeps {
      */
     accessLog?: AccessLogWriter;
 }
-type AdminEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 export declare function createOrgSettingsRoutes(deps: OrgSettingsRouteDeps): Hono<AdminEnv>;
 export { DashboardWriteOperation };
 //# sourceMappingURL=admin-org-settings.d.ts.map

package/dist/routes/admin-orgs.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Admin API route listing the org ids this orchestrator holds data for.
+ *
+ *   GET /api/v1/admin/org-ids → `OrgListResponse`: every org id the configuration
+ *   and anchor tables name, each with the data that names it, plus the live
+ *   Platform attachment (`attached` / `pending` / `none`).
+ *
+ * Backs `kici-admin org list` and the `Org:` line of `kici-admin orchestrator
+ * status`. The listing spans every org, so the route requires an unscoped token
+ * and `secret.read`, like the other read-only inspection routes.
+ */
+import { Hono } from 'hono';
+import { type HeldOrg } from '../db/repos/org-ids-repo.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
+import { type AdminEnv } from './admin-env.js';
+export interface AdminOrgRoutesDeps {
+    /** The org ids the database holds (`listHeldOrgIds` bound to the orchestrator DB). */
+    listOrgs: () => Promise<HeldOrg[]>;
+    rbac: RbacEnforcer;
+    /**
+     * The org the Platform named on `auth.success`; `undefined` before the first
+     * authentication. Absent when no Platform client runs (independent mode).
+     */
+    getPlatformOrgId?: () => string | undefined;
+}
+export declare function createAdminOrgRoutes(deps: AdminOrgRoutesDeps): Hono<AdminEnv>;
+//# sourceMappingURL=admin-orgs.d.ts.map

package/dist/routes/admin-peer-forget.d.ts

@@ -16,14 +16,8 @@
 import { Hono } from 'hono';
 import type { AccessLogWriter } from '../audit/access-log.js';
 import { type PeerForgetResult } from '../cluster/peer-forget.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
-type AdminEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
+import type { RbacEnforcer } from '../secrets/rbac.js';
+import { type AdminEnv } from './admin-env.js';
 /** What the route needs from the coordinator it runs on. */
 export interface PeerForgetRouteDeps {
     /**
@@ -39,5 +33,4 @@ export declare function createPeerForgetRoutes(deps: {
     rbac: RbacEnforcer;
     accessLog?: AccessLogWriter;
 }): Hono<AdminEnv>;
-export {};
 //# sourceMappingURL=admin-peer-forget.d.ts.map

package/dist/routes/admin-queue-execution.d.ts

@@ -11,18 +11,11 @@
  */
 import { Hono } from 'hono';
 import { type Kysely } from 'kysely';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
+import { type AdminEnv } from './admin-env.js';
 export interface AdminQueueExecutionRoutesDeps {
     db: Kysely<any>;
     rbac: RbacEnforcer;
 }
-type AdminQEEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
-export declare function createAdminQueueExecutionRoutes(deps: AdminQueueExecutionRoutesDeps): Hono<AdminQEEnv>;
-export {};
+export declare function createAdminQueueExecutionRoutes(deps: AdminQueueExecutionRoutesDeps): Hono<AdminEnv>;
 //# sourceMappingURL=admin-queue-execution.d.ts.map

package/dist/routes/admin-registrations.d.ts

@@ -9,11 +9,9 @@ import { Hono } from 'hono';
 import type { RegistrationStore } from '../registration/registration-store.js';
 import type { RegistrationIndex } from '../registration/registration-index.js';
 import type { TokenManager } from '../secrets/token-manager.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
 import type { ContextStore } from '../contexts/context-store.js';
-/**
- * Dependencies for admin registration routes.
- */
+import { type AdminEnv } from './admin-env.js';
 export interface AdminRegistrationRoutesDeps {
     registrationStore: RegistrationStore;
     registrationIndex: RegistrationIndex;
@@ -27,20 +25,11 @@ export interface AdminRegistrationRoutesDeps {
      */
     contextStore?: Pick<ContextStore, 'matchContext'>;
 }
-/** Hono env type for admin registration routes with context variables. */
-type AdminRegEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 /**
  * Create admin API routes for workflow registration management.
  *
  * @param deps - Admin registration route dependencies
  * @returns Hono app with registration routes mounted at /api/v1/admin/registrations
  */
-export declare function createAdminRegistrationRoutes(deps: AdminRegistrationRoutesDeps): Hono<AdminRegEnv>;
-export {};
+export declare function createAdminRegistrationRoutes(deps: AdminRegistrationRoutesDeps): Hono<AdminEnv>;
 //# sourceMappingURL=admin-registrations.d.ts.map

package/dist/routes/admin-runs.d.ts

@@ -22,10 +22,11 @@ import { Hono } from 'hono';
 import type { Kysely } from 'kysely';
 import type { Database } from '../db/types.js';
 import type { TokenManager } from '../secrets/token-manager.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
 import type { AuditLogger } from '../secrets/audit-logger.js';
 import type { ResolvedMasterKeys } from '../secrets/config.js';
 import type { LogStorage } from '../reporting/log-storage.js';
+import { type AdminEnv } from './admin-env.js';
 /**
  * Statuses accepted by the `?status=` filter.
  *
@@ -35,9 +36,6 @@ import type { LogStorage } from '../reporting/log-storage.js';
  * an empty result into a rejected request.
  */
 export declare const RUN_STATUSES: ReadonlySet<string>;
-/**
- * Dependencies for admin run routes.
- */
 export interface AdminRunRoutesDeps {
     db: Kysely<Database>;
     tokenManager: TokenManager;
@@ -58,20 +56,11 @@ export interface AdminRunRoutesDeps {
      */
     logStorage?: LogStorage;
 }
-/** Hono env type for admin run routes with context variables. */
-type AdminRunEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 /**
  * Create admin API routes for execution run inspection.
  *
  * @param deps - Admin run route dependencies
  * @returns Hono app with run routes mounted at /api/v1/admin/runs
  */
-export declare function createAdminRunRoutes(deps: AdminRunRoutesDeps): Hono<AdminRunEnv>;
-export {};
+export declare function createAdminRunRoutes(deps: AdminRunRoutesDeps): Hono<AdminEnv>;
 //# sourceMappingURL=admin-runs.d.ts.map

package/dist/routes/admin-scaler-orphans.d.ts

@@ -19,16 +19,10 @@
 import { Hono } from 'hono';
 import { type PeerScalerOrphansResponse } from '@kici-dev/engine';
 import type { AccessLogWriter } from '../audit/access-log.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
 import { type ScalerOrphansAnswer, type ScalerOrphansRequest } from '../scaler/orphan-requests.js';
 import { ScalerOrphansForwardFailure } from '../cluster/scaler-orphans-peer.js';
-type AdminEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
+import { type AdminEnv } from './admin-env.js';
 /** What the routes need from the coordinator they run on. */
 export interface ScalerOrphansRouteDeps {
     /** This coordinator's instance id. */
@@ -60,5 +54,4 @@ export declare function createScalerOrphansRoutes(deps: {
     rbac: RbacEnforcer;
     accessLog?: AccessLogWriter;
 }): Hono<AdminEnv>;
-export {};
 //# sourceMappingURL=admin-scaler-orphans.d.ts.map

package/dist/routes/admin-scaler-reload.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Reload the scaler config, behind `kici-admin scaler reload`.
+ *
+ * Mounted inside `createAdminRoutes` at `/api/v1/admin`, so the Bearer-token
+ * auth middleware has already resolved the caller's role. Needs an unscoped
+ * token and the `scaler.manage` permission (owner, admin).
+ *
+ * - `POST /api/v1/admin/scaler/reload { single?, timeoutMs? }` — re-read the
+ *   scaler config on this orchestrator and, unless `single`, on every peer it
+ *   is connected to. Each orchestrator applies its own file completely or not
+ *   at all. Answers `{ scope, results }` with one result per instance, this
+ *   one first: `200` when no instance refused its file or went unanswered,
+ *   `422` otherwise.
+ *
+ * The route runs the scaler reload only: it does not reload the orchestrator
+ * config, so it never bumps the config version the peers follow, and a
+ * `single` reload stays on this orchestrator.
+ */
+import { Hono } from 'hono';
+import { type ScalerReloadInstanceResult } from '@kici-dev/engine';
+import type { AccessLogWriter } from '../audit/access-log.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
+import { type AdminEnv } from './admin-env.js';
+/** What the route needs from the orchestrator it runs on. */
+export interface ScalerReloadRouteDeps {
+    /** This orchestrator's instance id, the audit row's target. */
+    instanceId: string;
+    /**
+     * Reload here and, unless `single`, on every connected peer, waiting
+     * `timeoutMs` for each peer. The first result is this orchestrator's.
+     */
+    reload: (single: boolean, timeoutMs: number) => Promise<ScalerReloadInstanceResult[]>;
+}
+/** How long the route waits for each peer by default. */
+export declare const DEFAULT_SCALER_RELOAD_TIMEOUT_MS = 60000;
+export declare function createScalerReloadRoutes(deps: {
+    scalerReload: ScalerReloadRouteDeps;
+    rbac: RbacEnforcer;
+    accessLog?: AccessLogWriter;
+}): Hono<AdminEnv>;
+//# sourceMappingURL=admin-scaler-reload.d.ts.map

package/dist/routes/admin-scheduled-jobs.d.ts

@@ -18,19 +18,12 @@ import { Hono } from 'hono';
 import type { Kysely } from 'kysely';
 import type { Database } from '../db/types.js';
 import type { TokenManager } from '../secrets/token-manager.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
+import { type AdminEnv } from './admin-env.js';
 export interface AdminScheduledJobsRoutesDeps {
     db: Kysely<Database>;
     tokenManager: TokenManager;
     rbac: RbacEnforcer;
 }
-type AdminEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 export declare function createAdminScheduledJobsRoutes(deps: AdminScheduledJobsRoutesDeps): Hono<AdminEnv>;
-export {};
 //# sourceMappingURL=admin-scheduled-jobs.d.ts.map

package/dist/routes/admin-signing-keys.d.ts

@@ -16,18 +16,11 @@
 import { Hono } from 'hono';
 import type { Kysely } from 'kysely';
 import type { Database } from '../db/types.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
+import { type AdminEnv } from './admin-env.js';
 export interface AdminSigningKeyRoutesDeps {
     db: Kysely<Database>;
     rbac: RbacEnforcer;
 }
-type AdminEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 export declare function createAdminSigningKeyRoutes(deps: AdminSigningKeyRoutesDeps): Hono<AdminEnv>;
-export {};
 //# sourceMappingURL=admin-signing-keys.d.ts.map

package/dist/routes/admin-sources.d.ts

@@ -11,9 +11,9 @@
 import { Hono } from 'hono';
 import type { SourceStore } from '../sources/source-store.js';
 import { type WebhookUrlResolution } from '../sources/webhook-url-resolvers.js';
-import type { Role } from '../secrets/rbac.js';
 import { type RedeliverWindowResult } from '../providers/github/deliveries.js';
 import { type FetchGithubAppIdentity, type FetchGithubAppInstallations } from '../github-app-name-refresher/github-app-name-refresher.js';
+import { type AdminEnv } from './admin-env.js';
 interface SourceRouteDeps {
     sourceStore: SourceStore;
     /**
@@ -72,13 +72,6 @@ export type RedeliverDeliveries = (app: {
     until: Date;
     dryRun?: boolean;
 }) => Promise<RedeliverWindowResult>;
-type AdminSourcesEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
-export declare function createSourceRoutes(deps: SourceRouteDeps): Hono<AdminSourcesEnv>;
+export declare function createSourceRoutes(deps: SourceRouteDeps): Hono<AdminEnv>;
 export {};
 //# sourceMappingURL=admin-sources.d.ts.map

package/dist/routes/admin-trust-policy.d.ts

@@ -23,8 +23,9 @@ import { Hono } from 'hono';
 import type { OrchestratorMode } from '@kici-dev/engine';
 import type { TrustPolicyStore } from '../security/trust-policy-store.js';
 import type { TrustDirectoryStore } from '../security/trust-directory-store.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
 import type { AccessLogWriter } from '../audit/access-log.js';
+import { type AdminEnv } from './admin-env.js';
 /**
  * Wording for the Platform-managed refusal. Shared with the CLI through the
  * response body — the CLI surfaces this verbatim rather than inventing its own.
@@ -76,13 +77,6 @@ interface TrustPolicyRouteDeps {
      */
     accessLog: AccessLogWriter;
 }
-type AdminEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 export declare function createTrustPolicyRoutes(deps: TrustPolicyRouteDeps): Hono<AdminEnv>;
 export {};
 //# sourceMappingURL=admin-trust-policy.d.ts.map

package/dist/routes/admin.d.ts

@@ -10,7 +10,7 @@
  */
 import { Hono } from 'hono';
 import type { TokenManager } from '../secrets/token-manager.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
 import type { PgSecretStore } from '../secrets/pg-secret-store.js';
 import type { AuditLogger } from '../secrets/audit-logger.js';
 import type { AgentTokenStore } from '../agent/token-store.js';
@@ -21,6 +21,7 @@ import { type HeldRunReleaseWiring } from './admin-held-runs.js';
 import { type ClusterSettingsPropagationSource } from './admin-cluster-settings.js';
 import { type ScalerOrphansRouteDeps } from './admin-scaler-orphans.js';
 import { type PeerForgetRouteDeps } from './admin-peer-forget.js';
+import { type ScalerReloadRouteDeps } from './admin-scaler-reload.js';
 import type { DrainController } from '../drain/drain-controller.js';
 import type { SourceStore } from '../sources/source-store.js';
 import type { JoinTokenManager } from '../cluster/join-token.js';
@@ -31,9 +32,7 @@ import type { Kysely } from 'kysely';
 import type pg from 'pg';
 import type { AccessLogWriter } from '../audit/access-log.js';
 import type { WebhookUrlResolution } from '../sources/webhook-url-resolvers.js';
-/**
- * Dependencies for admin API routes.
- */
+import { type AdminEnv } from './admin-env.js';
 export interface AdminRouteDeps {
     tokenManager: TokenManager;
     /**
@@ -55,6 +54,12 @@ export interface AdminRouteDeps {
      * an independent orchestrator and on a test admin, which have no connection.
      */
     platformConnected?: () => boolean;
+    /**
+     * The org the Platform named on `auth.success`, read per request; `undefined`
+     * before the first authentication. Backs the attachment `GET /org-ids` reports.
+     * Absent on an independent orchestrator and on a test admin.
+     */
+    getPlatformOrgId?: () => string | undefined;
     rbac: RbacEnforcer;
     secretStore: PgSecretStore;
     auditLogger: AuditLogger;
@@ -166,6 +171,12 @@ export interface AdminRouteDeps {
      * Bound by orchestrator-core once the cluster is up.
      */
     scalerOrphans?: ScalerOrphansRouteDeps;
+    /**
+     * Optional -- reload the scaler config here and on every connected peer.
+     * Backs `POST /api/v1/admin/scaler/reload` (`kici-admin scaler reload`).
+     * Bound by orchestrator-core once the cluster is up.
+     */
+    scalerReload?: ScalerReloadRouteDeps;
     /**
      * Optional -- forget a departed peer here and on every connected sibling
      * coordinator. Backs `POST /api/v1/admin/peers/forget` (`kici-admin peer
@@ -202,14 +213,6 @@ export interface AdminRouteDeps {
      */
     heldRunRelease?: HeldRunReleaseWiring;
 }
-/** Hono env type for admin routes with context variables. */
-type AdminEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 /**
  * Create admin API routes with Bearer token authentication and RBAC.
  *
@@ -217,5 +220,4 @@ type AdminEnv = {
  * @returns Hono app with admin routes mounted at /api/v1/admin/*
  */
 export declare function createAdminRoutes(deps: AdminRouteDeps): Hono<AdminEnv>;
-export {};
 //# sourceMappingURL=admin.d.ts.map

package/dist/routes/caller-identity.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Caller identity for orchestrator HTTP routes that act on behalf of the
+ * person or tool presenting a credential.
+ *
+ * Today the one credential is an admin token, resolved through the shared
+ * bearer-auth boundary (`resolveBearerAuth`), so the 401 / 503 semantics are
+ * identical to every admin route. The caller is a tagged union so a later
+ * credential kind (a signed command, for one) joins as another variant without
+ * touching the routes that consume it.
+ */
+import type { Context } from 'hono';
+import { type ActorPrincipal } from '@kici-dev/engine';
+import { type BearerAuthDeps } from './admin-auth.js';
+import type { Role } from '../secrets/rbac.js';
+/** A caller authenticated by an admin token. */
+export interface TokenCaller {
+    kind: 'token';
+    tokenId: string;
+    label: string;
+    /** The intended holder recorded at `token create --subject`, or null. */
+    subject: string | null;
+    role: Role;
+    /** The single routing key a scoped token is restricted to, or null. */
+    routingKeyScope: string | null;
+}
+export type CallerOutcome = {
+    ok: true;
+    caller: TokenCaller;
+} | {
+    ok: false;
+    status: 401 | 403 | 503;
+    error: string;
+};
+/**
+ * Resolve the request's caller.
+ *
+ * @param c - The request context (the `Authorization` header is read).
+ * @param deps - The token validator and log scope, as for `resolveBearerAuth`.
+ * @param opts.requireUnscoped - Refuse a routing-key-scoped token with 403.
+ *   Routes whose routing key the server chooses set it: a scoped token has no
+ *   key of its own to compare there, so accepting it would widen its reach.
+ * @returns The caller, or the status and body to answer with.
+ */
+export declare function resolveCaller(c: Context<any>, deps: BearerAuthDeps, opts: {
+    requireUnscoped: boolean;
+}): Promise<CallerOutcome>;
+/**
+ * The principal a caller's actions are attributed to: a `service_account`
+ * bearing the admin token id, the same shape the admin held-run routes use.
+ */
+export declare function callerActor(caller: TokenCaller): ActorPrincipal;
+//# sourceMappingURL=caller-identity.d.ts.map

package/dist/routes/test-direct.d.ts

@@ -0,0 +1,46 @@
+import type { Kysely } from 'kysely';
+import { OrchestratorMode } from '@kici-dev/engine';
+import type { Database } from '../db/types.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
+import { type TestRelayHandlerDeps } from '../ws/test-relay-handlers.js';
+import type { AuthTokenValidator } from './admin-auth.js';
+import { type TokenCaller } from './caller-identity.js';
+type TestDirectEnv = {
+    Variables: {
+        caller: TokenCaller;
+    };
+};
+/** Answer for a Platform-connected orchestrator that has no org yet. */
+export declare const NO_PLATFORM_ORG_MESSAGE = "This orchestrator has not received its organization from the KiCI Platform yet, so it cannot choose where to run the test. Retry when the orchestrator is connected.";
+export interface TestDirectRouteDeps {
+    tokenManager: AuthTokenValidator;
+    rbac: RbacEnforcer;
+    mode: OrchestratorMode;
+    /** The org a connected orchestrator learned from the Platform; read per request. */
+    platformOrgId: () => string | null | undefined;
+    db: Kysely<Database>;
+    /** Builds the relay handlers' deps for one request (minus org, routing key and source). */
+    relayDeps: () => Omit<TestRelayHandlerDeps, 'orgId' | 'routingKey' | 'accessLogSource'>;
+}
+/**
+ * The org a direct test run belongs to: the default org on an independent
+ * orchestrator, the Platform-assigned org otherwise (null until it is known).
+ */
+export declare function directOrgId(mode: OrchestratorMode, platformOrgId: string | null | undefined): string | null;
+/**
+ * Build the route deps, or null when admin auth is not configured: without a
+ * token store there is no credential to authenticate a developer with.
+ */
+export declare function testDirectRouteDeps(input: {
+    adminDeps?: {
+        tokenManager: AuthTokenValidator;
+        rbac: RbacEnforcer;
+    };
+}, rest: Omit<TestDirectRouteDeps, 'tokenManager' | 'rbac'>): TestDirectRouteDeps | null;
+/**
+ * Build the direct test-run router: the routes under `/api/v1/test`, each
+ * behind admin-token authentication that refuses a routing-key-scoped token.
+ */
+export declare function createTestDirectRoutes(deps: TestDirectRouteDeps): import("hono").Hono<TestDirectEnv, import("hono/types").BlankSchema, "/">;
+export {};
+//# sourceMappingURL=test-direct.d.ts.map