@kici-dev/orchestrator 0.7.0 → 0.9.0

package/dist/webhook/ingest-overflow-replayer.d.ts

@@ -80,7 +80,7 @@ export interface IngestOverflowReplayerDeps {
  * Refusal is per fairness key: a saturated org's rows are skipped for the rest
  * of the pass while other orgs' rows keep draining, mirroring the fair skip the
  * controller's own queue does. Reclaiming is not gated on load at all: a
- * stranded claim is stranded regardless, and the row it frees simply waits in
+ * stranded claim is stranded regardless, and the row it frees waits in
  * `buffered` until a reservation succeeds.
  */
 export declare class IngestOverflowReplayer {

package/dist/webhook/relay-reinject.d.ts

@@ -36,7 +36,7 @@ export declare function parseRelayPayload(body: Buffer, headers: Record<string,
  * would be a second, redundant gate — and a refusal from it would be charged to
  * the delivery as a failed replay attempt, which is the defect this ordering
  * exists to remove. The slot is genuinely held: nothing here bypasses the
- * controller, the decision was simply made one step earlier.
+ * controller, the decision was made one step earlier.
  */
 export declare function buildRelayReinject(seams: RelayReinjectSeams): ReinjectFn;
 //# sourceMappingURL=relay-reinject.d.ts.map

package/dist/worker/in-memory-job-queue.d.ts

@@ -104,6 +104,15 @@ export declare class InMemoryJobQueue {
     getFullJobById(jobId: string): Promise<QueuedJob | null>;
     /** Return all pending jobs. */
     getPendingJobs(): Promise<QueuedJob[]>;
+    /**
+     * Oldest-first listing of pending jobs, capped at `limit` — the worker-side
+     * twin of `JobQueue.listPending`. The dispatcher's capacity-freed re-drive
+     * (`retryPendingScaleRequests`) reads it on every worker whose scaler frees
+     * a slot; `worker-core` wires that hook exactly as the coordinator does.
+     * Insertion order is the enqueue order, which is what `created_at ASC` gives
+     * the DB queue.
+     */
+    listPending(limit: number): Promise<QueuedJob[]>;
     /** Always returns empty array. */
     getDispatchedJobIdsByRunId(_runId: string): Promise<string[]>;
     /** Lookup across pending and dispatched jobs (id / runId / status). */

package/dist/ws/dashboard-global-workflows-handler.d.ts

@@ -3,7 +3,7 @@
  *
  * Responds to `dashboard.global-workflows.*` WS messages from Platform by
  * reading or upserting the `org_settings` row keyed by `customer_id`. The row
- * holds the three per-org repo-pattern lists (allow / deny / elevate); each
+ * holds the per-org repo-pattern lists (allow / deny); each
  * entry is a `{routingKey?, pattern}` object that may optionally pin to one
  * source. The master enable switch is fleet-wide
  * (`cluster_settings.global_workflows_enabled`) and read-only here — projected
@@ -86,7 +86,6 @@ export declare class DashboardGlobalWorkflowsHandler {
 interface NormalizedPatch {
     allowedRepos: RepoPatternEntry[] | null;
     deniedRepos: RepoPatternEntry[] | null;
-    elevatedRepos: RepoPatternEntry[] | null;
 }
 /**
  * Derive the effective storage state from an existing row (may be undefined)
@@ -97,8 +96,8 @@ export declare function buildPatch(existing: OrgSettings | undefined, msg: Globa
 /**
  * Project a row into the public settings shape. `enabled` is the effective
  * fleet-wide master switch, supplied by the caller (read-only here). When the
- * row does not yet exist, the three per-org lists project as null so callers
- * always get a renderable state.
+ * row does not yet exist, the per-org lists project as null so callers always
+ * get a renderable state.
  */
 export declare function rowToSettings(customerId: string, row: OrgSettings | undefined, enabled: boolean): GlobalWorkflowSettings;
 export {};

package/dist/ws/fleet-agent-collector.d.ts

@@ -14,6 +14,13 @@ export declare class FleetAgentCollector {
      */
     request(requestId: string, agentId: string, send: () => void): Promise<Buffer>;
     onChunk(requestId: string, seq: number, dataB64: string, isLast: boolean): void;
+    /**
+     * Whether `requestId` is a collection this orchestrator asked `agentId` for
+     * and is still waiting on. The agent handler consults this before rate
+     * limiting a `fleet.bundle.chunk`: a solicited transfer is exempt, an
+     * unsolicited one is not.
+     */
+    isPendingFor(requestId: string, agentId: string): boolean;
     onError(requestId: string, message: string): void;
     /** Reject every pending request owned by `agentId` (called on its disconnect). */
     rejectAgent(agentId: string, reason: string): void;

package/dist/ws/platform-client.d.ts

@@ -315,12 +315,6 @@ export declare class PlatformClient {
      * `source.register.ack` arrives, or rejected on timeout / disconnect.
      */
     private readonly pendingSourceRegistrations;
-    /**
-     * Generic orchestrator-initiated RPC correlation (e.g. the provenance OIDC
-     * mint). The orchestrator sends a `requestId`-keyed request over the WS and
-     * awaits the Platform's matching `.response`; rejected on timeout or close.
-     */
-    private readonly orchRpc;
     /**
      * Platform capabilities advertised on this connection (Platform → orchestrator
      * `platform.capabilities` frame). `undefined` means nothing advertised yet —
@@ -493,15 +487,6 @@ export declare class PlatformClient {
      * NOT in the OrchestratorToPlatformMessage union (they are in the separate log pull schema).
      */
     sendRaw(data: unknown): void;
-    /**
-     * Send an orchestrator-initiated request over the Platform WS and await its
-     * typed `.response`. The reverse of the Platform's dashboard-RPC pattern: we
-     * hold the pending map and resolve on the echoed requestId. Rejects on timeout
-     * or connection close; protocol-level errors arrive inside the response body.
-     * The request type is a member of the typed orch->Platform union, so it rides
-     * the validated `send()` path.
-     */
-    sendRequestAndAwait<Res>(type: OrchestratorToPlatformMessage['type'], payload: Record<string, unknown>, timeoutMs?: number): Promise<Res>;
     /**
      * Register a new source at runtime (e.g., after config reload adds a new GitHub app).
      * Separate from the post-auth registration which sends all sources at once.

package/dist/ws/test-relay-handlers.d.ts

@@ -67,6 +67,8 @@ export interface TestRunStatusPayload {
         jobName: string;
         status: string;
         errorMessage?: string | null;
+        /** Wall-clock job duration once the job has finished; null while it runs. */
+        durationMs?: number | null;
     }>;
     done: boolean;
 }

package/installer-image-digests.json

@@ -1,7 +1,7 @@
 {
-  "version": "0.7.0",
+  "version": "0.9.0",
   "images": {
-    "kici-agent": "sha256:ad6028feb1eda81eb8c1b53490fad8530a0b9137650d436250a8cfd2ec699eed",
-    "kici-orchestrator": "sha256:f2706520bf3b8b196e2613deb8d0530ce4b50cc376261304b6eecee7f433385f"
+    "kici-agent": "sha256:371b518421c505041bc8b52eae3ce92e888f25b2cc2d4914f32420dbbf11df55",
+    "kici-orchestrator": "sha256:58c36d0222832fcb82b0af33cdb46d474b97654b0051cb6c54fa96fca9a13af2"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/orchestrator",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
   "keywords": [
     "ci",
@@ -30,6 +30,7 @@
   "files": [
     "dist",
     "!dist/**/*.map",
+    "!dist/server-test.js",
     "!dist/server-test.d.ts",
     "!dist/testing",
     "sbom.spdx.json",
@@ -62,23 +63,23 @@
     }
   },
   "dependencies": {
-    "@aws-sdk/client-kms": "^3.1121.0",
-    "@aws-sdk/client-s3": "^3.1121.0",
-    "@aws-sdk/lib-storage": "^3.1121.0",
-    "@aws-sdk/s3-request-presigner": "^3.1121.0",
+    "@aws-sdk/client-kms": "^3.1135.0",
+    "@aws-sdk/client-s3": "^3.1135.0",
+    "@aws-sdk/lib-storage": "^3.1135.0",
+    "@aws-sdk/s3-request-presigner": "^3.1135.0",
     "@hono/node-server": "^2.1.1",
-    "@inquirer/prompts": "^8.7.0",
-    "@octokit/auth-app": "^8.3.0",
+    "@inquirer/prompts": "^8.7.2",
+    "@octokit/auth-app": "^8.3.1",
     "@octokit/rest": "^22.0.1",
     "archiver": "^8.0.0",
     "commander": "^15.0.0",
     "croner": "^10.0.1",
     "dockerode": "^5.0.1",
     "hashi-vault-js": "^0.5.3",
-    "hono": "^4.13.2",
-    "jose": "^6.2.10",
+    "hono": "^4.13.7",
+    "jose": "^6.2.12",
     "jsonpath-plus": "^10.4.0",
-    "jszip": "^3.10.1",
+    "jszip": "^3.10.2",
     "kysely": "^0.29.4",
     "lru-cache": "^11.5.2",
     "nanoid": "^6.0.1",
@@ -87,10 +88,10 @@
     "strip-ansi": "^7.2.0",
     "tar": "^7.5.22",
     "ws": "^8.21.3",
-    "yaml": "^2.9.0",
-    "zod": "^4.4.3",
-    "@kici-dev/shared": "0.7.0",
-    "@kici-dev/engine": "0.7.0"
+    "yaml": "^2.9.1",
+    "zod": "^4.6.5",
+    "@kici-dev/engine": "0.9.0",
+    "@kici-dev/shared": "0.9.0"
   },
   "kici": {
     "metrics": {
@@ -105,11 +106,11 @@
     "@types/dockerode": "^4.0.1",
     "@types/ws": "^8.18.1",
     "kysely-ctl": "^0.21.0",
-    "@kici-dev/agent": "0.7.0"
+    "@kici-dev/agent": "0.9.0"
   },
   "scripts": {
-    "build": "node ../../scripts/build-service.mjs && tsgo --emitDeclarationOnly",
-    "typecheck": "tsgo --noEmit",
+    "build": "node ../../scripts/build-service.mjs && tsc --emitDeclarationOnly",
+    "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "db:migrate": "kysely migrate:latest"
   }