@kici-dev/orchestrator 0.16.0 → 0.17.0

package/dist/approvals/apply-decision.d.ts

@@ -1,8 +1,19 @@
-import { ApprovalDecision } from '@kici-dev/engine';
+import { AccessLogAction, ApprovalDecision } from '@kici-dev/engine';
 import type { HeldRun } from '../db/types.js';
 import { HoldOutcome } from '../pipeline/security-hold-check.js';
 import type { HeldRunStore, ReleaseSignal } from '../contexts/held-runs.js';
 import { type TeamMembershipLookup } from './approval-resolver.js';
+/**
+ * The access-log action a held-run decision is audited under.
+ *
+ * A `kici run --approve-all` breakglass approval audits as
+ * `held_run.auto_approve`, so the trail shows "auto-approved by the dispatcher"
+ * apart from an interactive approve. The marker only renames the record:
+ * eligibility is enforced the same way for both. It never applies to a reject.
+ * Every approving surface takes its action from here, so the Platform-relayed
+ * and the direct admin-route approvals cannot audit the same act two ways.
+ */
+export declare function heldRunDecisionAction(decision: ApprovalDecision, autoApprove: boolean): AccessLogAction;
 /** Whether a decision's post-commit consequence ran to completion. */
 export interface DecisionConsequenceResult {
     /** True when the whole consequence chain ran; false when a step of it threw. */

package/dist/cli/api-client.d.ts

@@ -469,6 +469,10 @@ export declare class AdminApiClient {
         vmIds: string[];
         timeoutMs?: number;
     }): Promise<ScalerOrphansStopResponse>;
+    /**
+     * @deprecated No KiCI server serves `/api/v1/api-keys`; use `createToken`
+     * (`kici-admin token create`). Removed in v1.0.0.
+     */
     createApiKey(opts: {
         label?: string;
         routingKeys?: string[];
@@ -477,6 +481,10 @@ export declare class AdminApiClient {
         key: string;
         routingKeys: string[];
     }>;
+    /**
+     * @deprecated No KiCI server serves `/api/v1/api-keys`; use `createToken`
+     * with `routingKey` (`kici-admin token create --routing-key`). Removed in v1.0.0.
+     */
     addRoutingKeyPermission(keyId: string, pattern: string): Promise<{
         id: string;
         pattern: string;

package/dist/cli/commands/api-key.d.ts

@@ -1,12 +1,19 @@
 /**
- * Platform API key management commands for kici-admin.
+ * `kici-admin api-key` — deprecated.
  *
- * These commands target the Platform admin API for managing API keys
- * and routing key permissions. Uses the same --url flag (point to Platform URL).
+ * The group targeted `/api/v1/api-keys`, which no KiCI server serves, so it
+ * never worked. Both subcommands stay registered until v1.0.0 and exit with a
+ * message that points at `kici-admin token create`, the per-person
+ * orchestrator token a developer passes to `kici connect`.
  *
  *   api-key create, add-routing-key
  */
 import type { Command } from 'commander';
 import type { AdminApiClient } from '../api-client.js';
-export declare function registerApiKeyCommands(program: Command, getClient: () => AdminApiClient): void;
+export declare const API_KEY_DEPRECATED_MESSAGE: string;
+/**
+ * Register the deprecated `api-key` group. `getClient` is accepted for the
+ * registration signature every command group shares and is never called.
+ */
+export declare function registerApiKeyCommands(program: Command, _getClient: () => AdminApiClient): void;
 //# sourceMappingURL=api-key.d.ts.map

package/dist/cli.js

@@ -517,9 +517,17 @@ var AdminApiClient = class {
 	async stopScalerOrphans(body) {
 		return this.request("POST", "/api/v1/admin/scaler/orphans/stop", body);
 	}
+	/**
+	* @deprecated No KiCI server serves `/api/v1/api-keys`; use `createToken`
+	* (`kici-admin token create`). Removed in v1.0.0.
+	*/
 	async createApiKey(opts) {
 		return this.request("POST", "/api/v1/api-keys", opts);
 	}
+	/**
+	* @deprecated No KiCI server serves `/api/v1/api-keys`; use `createToken`
+	* with `routingKey` (`kici-admin token create --routing-key`). Removed in v1.0.0.
+	*/
 	async addRoutingKeyPermission(keyId, pattern) {
 		return this.request("POST", `/api/v1/api-keys/${encodeURIComponent(keyId)}/routing-permissions`, { pattern });
 	}
@@ -1364,26 +1372,19 @@ function registerAgentCommands(program, getClient) {
 }
 //#endregion
 //#region src/cli/commands/api-key.ts
-function registerApiKeyCommands(program, getClient) {
-	const apiKey = program.command("api-key").description("Manage Platform API keys and routing keys");
-	apiKey.command("create").description("Create a new API key with optional routing key permissions").option("--label <label>", "Label for the API key", "unnamed").option("--routing-keys <keys>", "Comma-separated routing key patterns (e.g. github:42,github:99)").action(cliAction(async (opts) => {
-		const routingKeys = opts.routingKeys ? opts.routingKeys.split(",").map((k) => k.trim()) : void 0;
-		const result = await getClient().createApiKey({
-			label: opts.label,
-			routingKeys
-		});
-		console.log(`API key created successfully.`);
-		console.log(`Key ID: ${result.id}`);
-		console.log(`Key:    ${result.key}`);
-		if (result.routingKeys?.length) console.log(`Routing keys: ${result.routingKeys.join(", ")}`);
-		console.log("");
-		console.log("WARNING: Save this key now -- it cannot be recovered after this point.");
+const API_KEY_DEPRECATED_MESSAGE = "kici-admin api-key is deprecated and has no effect: no KiCI server serves /api/v1/api-keys. Mint a per-person orchestrator token instead: kici-admin token create <label> --role admin --subject <who> --expires <duration>. This command is removed in v1.0.0.";
+const DEPRECATED_DESCRIPTION = "Deprecated: use kici-admin token create (removed in v1.0.0)";
+/**
+* Register the deprecated `api-key` group. `getClient` is accepted for the
+* registration signature every command group shares and is never called.
+*/
+function registerApiKeyCommands(program, _getClient) {
+	const apiKey = program.command("api-key").description(DEPRECATED_DESCRIPTION);
+	apiKey.command("create").description(DEPRECATED_DESCRIPTION).option("--label <label>", "Ignored", "unnamed").option("--routing-keys <keys>", "Ignored").action(cliAction(async () => {
+		throw new Error(API_KEY_DEPRECATED_MESSAGE);
 	}));
-	apiKey.command("add-routing-key <id> <pattern>").description("Add a routing key permission pattern to an API key").action(cliAction(async (id, pattern) => {
-		const result = await getClient().addRoutingKeyPermission(id, pattern);
-		console.log(`Routing key permission added.`);
-		console.log(`Permission ID: ${result.id}`);
-		console.log(`Pattern:       ${result.pattern}`);
+	apiKey.command("add-routing-key <id> <pattern>").description(DEPRECATED_DESCRIPTION).action(cliAction(async () => {
+		throw new Error(API_KEY_DEPRECATED_MESSAGE);
 	}));
 }
 //#endregion
@@ -22078,7 +22079,7 @@ var S3CacheStorage = class {
 	client;
 	/** Separate client for pre-signed URL generation (uses externalEndpoint if configured). */
 	presignClient;
-	/** Separate client for the host CLI's pre-signed upload URL (uses uploadEndpoint if configured). */
+	/** Client for the developer upload URL: uploadEndpoint, else the presign client. */
 	uploadPresignClient;
 	bucket;
 	prefix;
@@ -22098,11 +22099,10 @@ var S3CacheStorage = class {
 			endpoint: options.externalEndpoint
 		});
 		else this.presignClient = this.client;
-		if (options.uploadEndpoint) this.uploadPresignClient = createS3Client({
+		this.uploadPresignClient = options.uploadEndpoint ? createS3Client({
 			...options,
 			endpoint: options.uploadEndpoint
-		});
-		else this.uploadPresignClient = this.client;
+		}) : this.presignClient;
 	}
 	/** Build the full S3 object key from a cache key. */
 	objectKey(key) {
@@ -27534,7 +27534,7 @@ init_manifest();
 const ALL_PLATFORMS = AgentPlatform.options;
 /** The orchestrator's own version (single-version invariant) = the packaged agent version. */
 function resolveKiciVersion() {
-	return "0.16.0";
+	return "0.17.0";
 }
 /** Parse the --platform value: default set | single | CSV | `all`. */
 function parsePlatforms(raw) {
@@ -38830,7 +38830,7 @@ function routeRootArgs(root, args) {
 * where no bundler substituted the constant — the same shape `server.ts` and
 * `standalone.ts` use for `ORCHESTRATOR_VERSION`.
 */
-const CLI_VERSION = "0.16.0";
+const CLI_VERSION = "0.17.0";
 /**
 * The kici-admin root command: a Commander `Command` whose own option parsing
 * first routes the argv through {@link routeRootArgs}. A leading `--version`

package/dist/index.js

@@ -43,7 +43,7 @@ var S3CacheStorage = class {
 	client;
 	/** Separate client for pre-signed URL generation (uses externalEndpoint if configured). */
 	presignClient;
-	/** Separate client for the host CLI's pre-signed upload URL (uses uploadEndpoint if configured). */
+	/** Client for the developer upload URL: uploadEndpoint, else the presign client. */
 	uploadPresignClient;
 	bucket;
 	prefix;
@@ -63,11 +63,10 @@ var S3CacheStorage = class {
 			endpoint: options.externalEndpoint
 		});
 		else this.presignClient = this.client;
-		if (options.uploadEndpoint) this.uploadPresignClient = createS3Client({
+		this.uploadPresignClient = options.uploadEndpoint ? createS3Client({
 			...options,
 			endpoint: options.uploadEndpoint
-		});
-		else this.uploadPresignClient = this.client;
+		}) : this.presignClient;
 	}
 	/** Build the full S3 object key from a cache key. */
 	objectKey(key) {
@@ -2978,9 +2977,17 @@ var AdminApiClient = class {
 	async stopScalerOrphans(body) {
 		return this.request("POST", "/api/v1/admin/scaler/orphans/stop", body);
 	}
+	/**
+	* @deprecated No KiCI server serves `/api/v1/api-keys`; use `createToken`
+	* (`kici-admin token create`). Removed in v1.0.0.
+	*/
 	async createApiKey(opts) {
 		return this.request("POST", "/api/v1/api-keys", opts);
 	}
+	/**
+	* @deprecated No KiCI server serves `/api/v1/api-keys`; use `createToken`
+	* with `routingKey` (`kici-admin token create --routing-key`). Removed in v1.0.0.
+	*/
 	async addRoutingKeyPermission(keyId, pattern) {
 		return this.request("POST", `/api/v1/api-keys/${encodeURIComponent(keyId)}/routing-permissions`, { pattern });
 	}

package/dist/pipeline/test-pipeline.d.ts

@@ -60,14 +60,15 @@ export interface TestTriggerInput {
     /** Request trace ID from the HTTP request. */
     requestId: string;
     /**
-     * The principal that initiated this run, relayed by the Platform on
-     * `test.relay.trigger` (where the wire schema has always required it).
+     * The principal that initiated this run: the one the Platform relays on
+     * `test.relay.trigger`, or the admin token's service account on the direct
+     * test-run routes.
      *
-     * Required rather than optional: the relay handler is the only production
-     * caller, so there is no path that legitimately lacks an actor, and an
-     * optional field would let a future caller silently drop attribution — which
-     * is exactly how `execution_runs.triggered_by` stayed NULL for every remote
-     * test run while the column claimed to hold the initiator.
+     * Required rather than optional: the relay handler and the direct test-run
+     * routes are the production callers and both always pass an actor, and an
+     * optional field would let a future caller silently drop attribution, which
+     * leaves `execution_runs.triggered_by` NULL while the column claims to hold
+     * the initiator.
      */
     actor: ActorPrincipal;
     /** JSON-stringified lock file content for local repos with no remote. */

package/dist/queue/terminalize-unroutable.d.ts

@@ -70,6 +70,11 @@ export declare enum UnroutableCause {
      */
     OnlyOtherJobImageAgents = "only-other-job-image-agents"
 }
+/**
+ * The operator-facing reason a job is `unroutable`, naming the exact selectors
+ * that went unmatched. Regex matchers are rendered as their source so the
+ * message stays readable rather than printing `[object Object]`.
+ */
 export declare function unroutableMessage(job: JobRoutingFacts, cause?: UnroutableCause): string;
 /**
  * Split the two reasons a queued job never ran: nothing in the fleet matched

package/dist/routes/admin-auth.d.ts

@@ -40,6 +40,8 @@ export interface AuthTokenInfo {
     role: Role;
     routingKey: string | null;
     label: string;
+    /** The intended holder recorded at `token create --subject`, when one was. */
+    subject?: string | null;
 }
 /** The slice of TokenManager this middleware needs (keeps tests trivial to fake). */
 export interface AuthTokenValidator {

package/dist/routes/caller-identity.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Caller identity for orchestrator HTTP routes that act on behalf of the
+ * person or tool presenting a credential.
+ *
+ * Today the one credential is an admin token, resolved through the shared
+ * bearer-auth boundary (`resolveBearerAuth`), so the 401 / 503 semantics are
+ * identical to every admin route. The caller is a tagged union so a later
+ * credential kind (a signed command, for one) joins as another variant without
+ * touching the routes that consume it.
+ */
+import type { Context } from 'hono';
+import { type ActorPrincipal } from '@kici-dev/engine';
+import { type BearerAuthDeps } from './admin-auth.js';
+import type { Role } from '../secrets/rbac.js';
+/** A caller authenticated by an admin token. */
+export interface TokenCaller {
+    kind: 'token';
+    tokenId: string;
+    label: string;
+    /** The intended holder recorded at `token create --subject`, or null. */
+    subject: string | null;
+    role: Role;
+    /** The single routing key a scoped token is restricted to, or null. */
+    routingKeyScope: string | null;
+}
+export type CallerOutcome = {
+    ok: true;
+    caller: TokenCaller;
+} | {
+    ok: false;
+    status: 401 | 403 | 503;
+    error: string;
+};
+/**
+ * Resolve the request's caller.
+ *
+ * @param c - The request context (the `Authorization` header is read).
+ * @param deps - The token validator and log scope, as for `resolveBearerAuth`.
+ * @param opts.requireUnscoped - Refuse a routing-key-scoped token with 403.
+ *   Routes whose routing key the server chooses set it: a scoped token has no
+ *   key of its own to compare there, so accepting it would widen its reach.
+ * @returns The caller, or the status and body to answer with.
+ */
+export declare function resolveCaller(c: Context<any>, deps: BearerAuthDeps, opts: {
+    requireUnscoped: boolean;
+}): Promise<CallerOutcome>;
+/**
+ * The principal a caller's actions are attributed to: a `service_account`
+ * bearing the admin token id, the same shape the admin held-run routes use.
+ */
+export declare function callerActor(caller: TokenCaller): ActorPrincipal;
+//# sourceMappingURL=caller-identity.d.ts.map

package/dist/routes/test-direct.d.ts

@@ -0,0 +1,46 @@
+import type { Kysely } from 'kysely';
+import { OrchestratorMode } from '@kici-dev/engine';
+import type { Database } from '../db/types.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
+import { type TestRelayHandlerDeps } from '../ws/test-relay-handlers.js';
+import type { AuthTokenValidator } from './admin-auth.js';
+import { type TokenCaller } from './caller-identity.js';
+type TestDirectEnv = {
+    Variables: {
+        caller: TokenCaller;
+    };
+};
+/** Answer for a Platform-connected orchestrator that has no org yet. */
+export declare const NO_PLATFORM_ORG_MESSAGE = "This orchestrator has not received its organization from the KiCI Platform yet, so it cannot choose where to run the test. Retry when the orchestrator is connected.";
+export interface TestDirectRouteDeps {
+    tokenManager: AuthTokenValidator;
+    rbac: RbacEnforcer;
+    mode: OrchestratorMode;
+    /** The org a connected orchestrator learned from the Platform; read per request. */
+    platformOrgId: () => string | null | undefined;
+    db: Kysely<Database>;
+    /** Builds the relay handlers' deps for one request (minus org, routing key and source). */
+    relayDeps: () => Omit<TestRelayHandlerDeps, 'orgId' | 'routingKey' | 'accessLogSource'>;
+}
+/**
+ * The org a direct test run belongs to: the default org on an independent
+ * orchestrator, the Platform-assigned org otherwise (null until it is known).
+ */
+export declare function directOrgId(mode: OrchestratorMode, platformOrgId: string | null | undefined): string | null;
+/**
+ * Build the route deps, or null when admin auth is not configured: without a
+ * token store there is no credential to authenticate a developer with.
+ */
+export declare function testDirectRouteDeps(input: {
+    adminDeps?: {
+        tokenManager: AuthTokenValidator;
+        rbac: RbacEnforcer;
+    };
+}, rest: Omit<TestDirectRouteDeps, 'tokenManager' | 'rbac'>): TestDirectRouteDeps | null;
+/**
+ * Build the direct test-run router: the routes under `/api/v1/test`, each
+ * behind admin-token authentication that refuses a routing-key-scoped token.
+ */
+export declare function createTestDirectRoutes(deps: TestDirectRouteDeps): import("hono").Hono<TestDirectEnv, import("hono/types").BlankSchema, "/">;
+export {};
+//# sourceMappingURL=test-direct.d.ts.map

package/dist/routes/uploads.d.ts

@@ -4,9 +4,9 @@
  * Mints an upload record and a presigned PUT URL + ephemeral X25519 public key
  * for the overlay tarball. The developer encrypts the tarball with the returned
  * public key and PUTs it directly to the object store; a test trigger then
- * references the upload id. This is invoked by the Platform-first
- * `test.relay.uploads.init` relay handler — the developer never reaches the
- * orchestrator's HTTP API directly.
+ * references the upload id. It is invoked by the `test.relay.uploads.init`
+ * relay handler (a run routed through the Platform) and by the direct
+ * test-run routes (`POST /api/v1/test/uploads/init`).
  */
 import type { Kysely } from 'kysely';
 import type { Database } from '../db/types.js';
@@ -19,12 +19,13 @@ export interface InitTestUploadParams {
     compressedSize?: number;
     /** PAT/actor identity that owns this upload, written to `test_uploads.created_by`. */
     createdBy?: string | null;
-    /**
-     * When true, presign with the host-facing internal endpoint. When false (the
-     * Platform-relayed path), presign with the external/dev-reachable endpoint so
-     * a developer on a different network can PUT directly to the object store.
-     */
-    internal?: boolean;
+}
+/**
+ * The orchestrator has no object storage, so it cannot mint an upload URL.
+ * Callers answer it as "service unavailable" with the message as-is.
+ */
+export declare class TestUploadStorageUnavailableError extends Error {
+    constructor(message: string);
 }
 /** Result of {@link initTestUpload}. */
 export interface InitTestUploadResult {
@@ -41,8 +42,8 @@ export interface InitTestUploadDeps {
 /**
  * Mint an upload record and return a presigned PUT URL + ephemeral X25519
  * public key. The encryption keypair is generated per upload; the private key
- * is stored orchestrator-side for post-PUT decryption. The `internal` flag
- * selects the host-facing vs the external/dev-reachable presign endpoint.
+ * is stored orchestrator-side for post-PUT decryption. The URL is the
+ * developer-facing one (`CacheStorage.getInternalUploadUrl`).
  */
 export declare function initTestUpload(deps: InitTestUploadDeps, params: InitTestUploadParams): Promise<InitTestUploadResult>;
 //# sourceMappingURL=uploads.d.ts.map

package/dist/secrets/rbac.d.ts

@@ -23,7 +23,11 @@ export type Permission = 'context.create' | 'context.read' | 'context.update' |
 /** Stop live Firecracker VMs the node's orchestrator does not track. */
  | 'scaler.manage'
 /** Drop a departed peer from the coordinators' live peer registries. */
- | 'peer.manage';
+ | 'peer.manage'
+/** Start or cancel a `kici run remote` test run through the direct test-run routes. */
+ | 'test_run.trigger'
+/** Follow a test run's status and logs through the direct test-run routes. */
+ | 'test_run.read';
 /**
  * Error thrown when a role lacks the required permission.
  */

package/dist/secrets/routing-key-scope.d.ts

@@ -25,6 +25,7 @@
  * they use `requireUnscopedToken` instead.
  */
 import type { Context } from 'hono';
+export declare const UNSCOPED_REQUIRED_MESSAGE = "Access denied: this route requires an unscoped admin token (the calling token is restricted to a single routing key)";
 /**
  * Reject the request with 403 when the calling token has a routing-key
  * scope and the request targets a different routing key.

package/dist/secrets/token-manager.d.ts

@@ -40,6 +40,7 @@ export declare class TokenManager {
         role: Role;
         routingKey: string | null;
         label: string;
+        subject: string | null;
     } | null>;
     /**
      * Revoke a token by ID.