@kici-dev/orchestrator 0.7.0 → 0.9.0

package/dist/ws/oidc-token-relay.d.ts

@@ -1,79 +0,0 @@
-/**
- * Provenance ID-token relay (orchestrator side).
- *
- * @deprecated The Platform-rooted identity mint is hard-deprecated in favor of
- * orchestrator-owned signing (`oidc/orchestrator-mint.ts`). This relay is
- * registered ONLY when the orchestrator has NO provenance signer configured
- * (`selectOidcMintRegistration` prefers the orchestrator-owned mint whenever
- * `KICI_ORCHESTRATOR_PROVENANCE_ISSUER` is set). It is kept wire-compatible for
- * the mixed-version rollout window; the `oidc.mint.*` RPC shim is removed at
- * v1.0. Existing Platform-signed bundles keep verifying forever (the Platform
- * JWKS stays published). See docs/user/deprecations.md.
- *
- * Backs the `oidc.token.request` agent.api method: an agent asks for a
- * short-lived OIDC ID token for a job it is running; the orchestrator verifies
- * the agent owns that job, resolves its runId from its own dispatch state, and
- * relays a mint request to the Platform over the authenticated orchestrator↔
- * Platform WebSocket (orchestrator-initiated RPC). The agent never holds
- * Platform credentials and never asserts its own identity claims — the Platform
- * derives every identity claim from its own run/job rows.
- */
-import { type OidcTokenResult, type DeferredMintParams } from '@kici-dev/engine/protocol/messages/oidc-token-relay';
-/** rejected: the run/job is missing on the Platform or the job is terminal. */
-export declare class MintRejectedError extends Error {
-}
-/** unavailable: provenance signing is not configured / the Platform is unavailable. */
-export declare class MintUnavailableError extends Error {
-}
-/** Any other failure (transport or Platform-side). */
-export declare class MintRelayError extends Error {
-}
-/** Minimal surface the relay needs from the Platform WS client. */
-export interface MintPlatformClient {
-    sendRequestAndAwait<Res>(type: 'oidc.mint.request', payload: Record<string, unknown>, timeoutMs?: number): Promise<Res>;
-}
-export interface RequestMintArgs {
-    platformClient: MintPlatformClient;
-    orchestratorId: string;
-    runId: string;
-    jobId: string;
-    audience: string;
-    /**
-     * Deferred *fulfilment* mint: when set, the request knowingly targets a
-     * completed (terminal) job and binds the frozen statement hash + origin so
-     * the Platform relaxes its live-job check and stamps the mint-timing marker.
-     * The live agent path never sets this.
-     */
-    deferred?: DeferredMintParams;
-}
-/**
- * Send a mint request over the WS and map the typed response to either a result
- * or one of the three error classes. The user-facing strings are produced here
- * (client-side) so they stay stable regardless of Platform wording.
- */
-export declare function requestMint(args: RequestMintArgs): Promise<OidcTokenResult>;
-export interface OidcTokenHandlerDeps {
-    dispatcher: {
-        resolveOwnedJob(agentId: string, jobId: string): {
-            runId: string;
-        } | undefined;
-    };
-    platformClient: MintPlatformClient;
-    orchestratorId: string;
-    /**
-     * Test-only fault-injection predicate over the requested OIDC `audience`,
-     * supplied only by the build-time test double. Returning `true` short-circuits
-     * the *initial* mint to a transient defer BEFORE the real Platform relay is
-     * contacted — it can only defer/reject, never forge or weaken a signature.
-     * Undefined (the shipped default) means no fault injection.
-     */
-    initialMintFault?: (audience: string) => boolean;
-}
-/**
- * Build the agent.api handler for `OIDC_TOKEN_REQUEST_METHOD`. Validates the
- * params, verifies the agent owns the named job (resolving its runId from the
- * dispatcher), and relays a mint request to the Platform. A job the agent does
- * not own is rejected without ever contacting the Platform.
- */
-export declare function createOidcTokenHandler(deps: OidcTokenHandlerDeps): (agentId: string, params: Record<string, unknown>) => Promise<OidcTokenResult>;
-//# sourceMappingURL=oidc-token-relay.d.ts.map

package/dist/ws/orch-rpc.d.ts

@@ -1,9 +0,0 @@
-/** Platform->orch message types that resolve a pending orch-initiated request. */
-export declare const ORCH_RPC_RESPONSE_TYPES: ReadonlySet<string>;
-export declare class OrchRpcRegistry {
-    private readonly pending;
-    register(requestId: string, timeoutMs: number): Promise<unknown>;
-    resolve(requestId: string, msg: unknown): void;
-    rejectAll(err: Error): void;
-}
-//# sourceMappingURL=orch-rpc.d.ts.map