@kici-dev/orchestrator 0.6.0 → 0.7.0

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/orchestrator@0.6.0",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Forchestrator/0.6.0/d1c2a77a-ac51-4154-9106-3f0824968ee8",
+  "name": "@kici-dev/orchestrator@0.7.0",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Forchestrator/0.7.0/79cbb6ed-178e-42f3-baf1-6f9da5e6204c",
   "creationInfo": {
-    "created": "2026-09-01T13:57:33Z",
+    "created": "2026-09-11T07:37:51Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -1018,9 +1018,9 @@
       "homepage": "https://ericsmekens.github.io/jsep/tree/master/packages/regex#readme"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-core-0.6.0",
+      "SPDXID": "SPDXRef-Package--kici-dev-core-0.7.0",
       "name": "@kici-dev/core",
-      "versionInfo": "0.6.0",
+      "versionInfo": "0.7.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1031,16 +1031,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/core@0.6.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/core@0.7.0"
         }
       ],
       "description": "Light shared utilities for the KiCI stack (logging, errors, formatting, crypto, zx init, the TypeScript ESM loader hook). No server-side dependencies.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.6.0",
+      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.7.0",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.6.0",
+      "versionInfo": "0.7.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1051,7 +1051,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.6.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.7.0"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
@@ -1060,7 +1060,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/orchestrator",
-      "versionInfo": "0.6.0",
+      "versionInfo": "0.7.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1071,16 +1071,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/orchestrator@0.6.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/orchestrator@0.7.0"
         }
       ],
       "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "name": "@kici-dev/shared",
-      "versionInfo": "0.6.0",
+      "versionInfo": "0.7.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1091,7 +1091,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.6.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.7.0"
         }
       ],
       "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
@@ -7805,62 +7805,62 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.140.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-jose-6.2.10",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.7",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-safe-regex-2.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-yaml-2.9.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
@@ -7896,12 +7896,12 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.6.0",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.7.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -8010,117 +8010,117 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package--aws-sdk-client-s3-3.1121.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.7.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.7.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-api-1.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-metrics-otlp-http-0.221.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-prometheus-0.221.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-trace-otlp-http-0.221.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-instrumentation-runtime-node-0.34.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-resources-2.10.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-sdk-node-0.221.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-semantic-conventions-1.43.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-archiver-8.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-diff-9.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-hono-4.13.2",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-kysely-0.29.4",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.140.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-pg-8.23.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-yaml-2.9.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.6.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.7.0",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },

package/dist/concurrency/group-tracker.d.ts

@@ -1,51 +0,0 @@
-/**
- * In-memory concurrency group tracker.
- *
- * Tracks active runs per concurrency group, scoped by routing key
- * to prevent cross-repo interference. Supports slot acquisition/release
- * and hydration from DB records on startup.
- */
-/** Record used to hydrate tracker state from DB on startup. */
-export interface HydrateRecord {
-    groupKey: string;
-    routingKey: string;
-    runId: string;
-}
-export declare class ConcurrencyGroupTracker {
-    /**
-     * Scoped state: "routingKey::groupKey" -> ordered list of active run IDs.
-     * Using an array (not Set) to preserve insertion order for getOldestRun().
-     */
-    private readonly groups;
-    private scopeKey;
-    private getOrCreateGroup;
-    /**
-     * Try to acquire a slot in the concurrency group.
-     * Returns true if under max capacity and the run was added, false otherwise.
-     * Idempotent: re-acquiring an already-active run returns true without double-adding.
-     */
-    acquireSlot(groupKey: string, routingKey: string, runId: string, opts: {
-        max: number;
-    }): boolean;
-    /**
-     * Release a slot in the concurrency group.
-     * No-op if the run ID is not active.
-     */
-    releaseSlot(groupKey: string, routingKey: string, runId: string): void;
-    /**
-     * Get all active run IDs in a concurrency group.
-     * Returns a copy of the array.
-     */
-    getActiveRuns(groupKey: string, routingKey: string): string[];
-    /**
-     * Get the oldest active run in a concurrency group.
-     * Used by cancelInProgress mode to determine which run to cancel.
-     */
-    getOldestRun(groupKey: string, routingKey: string): string | null;
-    /**
-     * Hydrate tracker state from DB records.
-     * Called on orchestrator startup to restore active concurrency groups.
-     */
-    hydrate(records: HydrateRecord[]): void;
-}
-//# sourceMappingURL=group-tracker.d.ts.map

package/dist/scaler/nftables.d.ts

@@ -1,111 +0,0 @@
-/**
- * Programmatic nftables rule management for agent network isolation.
- *
- * Manages RFC1918 + cloud metadata blocking rules per-interface (Firecracker/container)
- * or per-UID (bare-metal). All operations use `nft` CLI via child_process.execFile.
- *
- * Table layout:
- *   table ip kici {
- *     chain forward { type filter hook forward priority 0; policy accept; }
- *     chain output  { type filter hook output priority 0; policy accept; }
- *   }
- */
-import type { NetworkPolicy } from './types.js';
-/**
- * Match mode for nftables isolation rules.
- * - 'iifname': Match on input interface name (Firecracker TAP devices)
- * - 'saddr': Match on source IP address (container backends)
- */
-export type NftMatchMode = 'iifname' | 'saddr';
-/** RFC1918 private address ranges. */
-export declare const RFC1918_RANGES: string[];
-/** Cloud metadata service range (AWS/GCP/Azure link-local). */
-export declare const METADATA_RANGE = "169.254.0.0/16";
-/**
- * Options for nft command execution.
- */
-interface NftOptions {
-    /**
-     * Wrap the `nft` invocation with `sudo -n` so non-root orchestrators (e.g.
-     * Pi user-mode systemd) can manage rules. Operators must have a NOPASSWD
-     * sudoers entry for /usr/sbin/nft. Default false.
-     */
-    requireSudo?: boolean;
-}
-/**
- * Validate that nftables is available and the process has NET_ADMIN capability.
- * Attempts `nft list tables` -- if it fails:
- *   - ENOENT: nft binary not installed
- *   - EPERM: nft binary present but NET_ADMIN capability missing
- * Throws with a clear error message in both cases.
- */
-export declare function validateNftablesAvailability(opts?: NftOptions): Promise<void>;
-/**
- * Ensure the `kici` nftables table and required chains exist.
- * Idempotent -- safe to call multiple times.
- */
-export declare function ensureKiciTable(opts?: NftOptions): Promise<void>;
-/** A single nft rule operation: the verb decides chain placement. */
-export interface NftRuleOp {
-    /** 'insert' prepends to the chain head; 'add' appends to the tail. */
-    verb: 'insert' | 'add';
-    /** Tokens after `nft <verb> rule ip kici forward`. */
-    tokens: string[];
-}
-/**
- * Build the per-identifier isolation rule operations.
- *
- * Placement matters because nftables is first-match-wins and the `kici`
- * forward chain is shared: it accumulates rules for every live agent plus
- * any host-level baseline (e.g. wildcard `iifname "kici-*"` RFC1918 drops
- * installed at host bootstrap). Accepts therefore go in via `insert`
- * (chain head) so they beat any pre-existing drop that also matches the
- * traffic; an appended accept after a wildcard drop is dead code. Drops go
- * in via `add` (tail) — they only need to beat the chain's accept policy.
- *
- * Effective per-identifier order: gateway + allowlist accepts (head),
- * RFC1918 / metadata / denyAll drops (tail).
- */
-export declare function buildIsolationRuleOps(matchClause: string[], gatewayIp: string, networkPolicy?: NetworkPolicy): NftRuleOp[];
-/**
- * Add network isolation rules for a specific network interface.
- * Used by Firecracker and container backends.
- *
- * Rule placement (see buildIsolationRuleOps):
- * 1. Accept gateway traffic (inserted at chain head)
- * 2. Accept allowlisted CIDRs (inserted at chain head)
- * 3. Drop RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
- * 4. Drop cloud metadata (169.254.0.0/16)
- * 5. Drop all remaining traffic (only if denyAll is true)
- *
- * @param identifier - Network interface name or source IP to match (e.g., "veth-abc123" or "172.30.0.5")
- * @param gatewayIp - Gateway IP that must remain accessible (e.g., "10.0.0.1")
- * @param networkPolicy - Optional policy with allowlist and denyAll settings
- * @param matchMode - How to match traffic: 'iifname' for interface name (default), 'saddr' for source IP
- */
-export declare function addIsolationRules(identifier: string, gatewayIp: string, networkPolicy?: NetworkPolicy, matchMode?: NftMatchMode, opts?: NftOptions): Promise<void>;
-/**
- * Remove all isolation rules matching a specific interface from the kici forward chain.
- * Called during agent cleanup/destruction.
- *
- * Lists all rules with handles, finds those matching the interface name, and deletes them.
- * Best-effort: logs errors but does not throw (cleanup should not block destruction).
- *
- * @param interfaceName - Network interface whose rules should be removed
- */
-export declare function removeIsolationRules(interfaceName: string, opts?: NftOptions): Promise<void>;
-/**
- * Re-export NftOptions type for use by callers (Firecracker / container backends)
- * that need to pass the requireSudo flag through to these functions.
- */
-export type { NftOptions };
-/**
- * Parse nft rule listing output and extract handles for rules matching a given identifier.
- * Handles lines like: `  iifname "veth-abc" ip daddr 10.0.0.0/8 drop # handle 42`
- *
- * @param nftOutput - Raw output from `nft -a list chain ip kici <chain>`
- * @param identifier - String to search for in each rule line (interface name or UID)
- * @returns Array of numeric rule handles
- */
-export declare function parseRuleHandles(nftOutput: string, identifier: string): number[];
-//# sourceMappingURL=nftables.d.ts.map