@kici-dev/orchestrator 0.9.0 → 0.9.1

package/dist/cli.js

@@ -1056,28 +1056,41 @@ async function loadAccessLogRange(args) {
 	const coldToTs = toTs && toTs < warmCutoff ? toTs : warmCutoff;
 	const coldRemaining = limit - hotItems.length;
 	const tenantToScan = filter.orgId ?? "__orchestrator__";
+	const matches = (row) => {
+		if (filter.actorType && row.actor_type !== filter.actorType) return false;
+		if (filter.actorId && row.actor_id !== filter.actorId) return false;
+		if (filter.action && row.action !== filter.action) return false;
+		if (filter.source && row.source !== filter.source) return false;
+		if (filter.outcome && row.outcome !== filter.outcome) return false;
+		if (filter.targetType && row.target_type !== filter.targetType) return false;
+		if (filter.targetId && row.target_id !== filter.targetId) return false;
+		if (filter.agentLabel && row.agent_label !== filter.agentLabel) return false;
+		if (filter.agentOnly && row.agent_label == null) return false;
+		if (filter.q && filter.q.length > 0) {
+			if (!(row.error_message ?? "").toLowerCase().includes(filter.q.toLowerCase())) return false;
+		}
+		return true;
+	};
+	const beforeCursor = (it) => !cursor || cursor.source !== "cold" || it.createdAt < cursor.createdAt || it.createdAt === cursor.createdAt && it.id < cursor.id;
 	const coldItems = [];
+	let stoppedEarly = false;
 	try {
 		for await (const row of coldStore.fetchRange({
 			db: "orchestrator",
 			table: "access_log",
 			tenantId: tenantToScan,
 			fromTs: coldFromTs,
-			toTs: coldToTs
+			toTs: coldToTs,
+			order: "desc"
 		})) {
-			if (filter.actorType && row.actor_type !== filter.actorType) continue;
-			if (filter.actorId && row.actor_id !== filter.actorId) continue;
-			if (filter.action && row.action !== filter.action) continue;
-			if (filter.source && row.source !== filter.source) continue;
-			if (filter.outcome && row.outcome !== filter.outcome) continue;
-			if (filter.targetType && row.target_type !== filter.targetType) continue;
-			if (filter.targetId && row.target_id !== filter.targetId) continue;
-			if (filter.agentLabel && row.agent_label !== filter.agentLabel) continue;
-			if (filter.agentOnly && row.agent_label == null) continue;
-			if (filter.q && filter.q.length > 0) {
-				if (!(row.error_message ?? "").toLowerCase().includes(filter.q.toLowerCase())) continue;
-			}
-			coldItems.push(toAccessLogItem(row));
+			if (!matches(row)) continue;
+			const item = toAccessLogItem(row);
+			if (!beforeCursor(item)) continue;
+			if (coldItems.length >= coldRemaining && item.createdAt < coldItems[coldRemaining - 1].createdAt) {
+				stoppedEarly = true;
+				break;
+			}
+			coldItems.push(item);
 		}
 	} catch (err) {
 		if (cursor?.source === "cold") {
@@ -1096,14 +1109,9 @@ async function loadAccessLogRange(args) {
 			nextCursor: hotHasMore && hotItems.length > 0 ? buildHotCursor(hotItems[hotItems.length - 1]) : null
 		};
 	}
-	coldItems.sort((a, b) => a.createdAt < b.createdAt ? 1 : a.createdAt > b.createdAt ? -1 : 0);
-	let coldStart = 0;
-	if (cursor && cursor.source === "cold") {
-		coldStart = coldItems.findIndex((it) => it.createdAt < cursor.createdAt || it.createdAt === cursor.createdAt && it.id < cursor.id);
-		if (coldStart < 0) coldStart = coldItems.length;
-	}
-	const coldPage = coldItems.slice(coldStart, coldStart + coldRemaining);
-	const coldHasMore = coldStart + coldRemaining < coldItems.length;
+	coldItems.sort((a, b) => a.createdAt < b.createdAt ? 1 : a.createdAt > b.createdAt ? -1 : a.id < b.id ? 1 : a.id > b.id ? -1 : 0);
+	const coldPage = coldItems.slice(0, coldRemaining);
+	const coldHasMore = stoppedEarly || coldItems.length > coldRemaining;
 	return {
 		items: [...hotItems, ...coldPage],
 		nextCursor: coldHasMore && coldPage.length > 0 ? buildColdCursor(coldPage[coldPage.length - 1]) : hotHasMore && hotItems.length > 0 && coldPage.length === 0 ? buildHotCursor(hotItems[hotItems.length - 1]) : null
@@ -1230,11 +1238,13 @@ async function loadSecretAuditLogRange(args) {
 			table: "secret_audit_log",
 			tenantId: tenant,
 			fromTs: coldFromTs,
-			toTs: coldToTs
+			toTs: coldToTs,
+			order: "desc"
 		})) {
 			if (contextName && row.context_name !== contextName) continue;
 			if (action && row.action !== action) continue;
 			coldRows.push(row);
+			if (coldRows.length >= coldOffset + remaining) break;
 		}
 	} catch (err) {
 		if (hotRows.length === 0) {
@@ -1244,7 +1254,6 @@ async function loadSecretAuditLogRange(args) {
 		logger$21.warn("cold-store fetchRange failed; returning hot rows only", { error: toErrorMessage(err) });
 		return hotRows;
 	}
-	coldRows.sort((a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime());
 	const coldSlice = coldRows.slice(coldOffset, coldOffset + remaining);
 	return [...hotRows, ...coldSlice];
 }
@@ -22268,7 +22277,7 @@ init_manifest();
 const ALL_PLATFORMS = AgentPlatform.options;
 /** The orchestrator's own version (single-version invariant) = the packaged agent version. */
 function resolveKiciVersion() {
-	return "0.9.0";
+	return "0.9.1";
 }
 /** Parse the --platform value: default set | single | CSV | `all`. */
 function parsePlatforms(raw) {
@@ -33335,7 +33344,7 @@ Token vocabulary:
 * where no bundler substituted the constant — the same shape `server.ts` and
 * `standalone.ts` use for `ORCHESTRATOR_VERSION`.
 */
-const CLI_VERSION = "0.9.0";
+const CLI_VERSION = "0.9.1";
 /**
 * Build the kici-admin Commander program with every command group registered.
 * Exported so the surface registry can walk the real command tree without

package/dist/server.js

@@ -3,7 +3,7 @@ import { dirname as __cjs_dirname } from "node:path";
 const __filename = __cjs_fileURLToPath(import.meta.url);
 __cjs_dirname(__filename);
 import "node:module";
-import { AgentDeliveryMode, AgentPlatform, BaseColdStore, ChunkRequestWaiter, RingBuffer, addLogsToArchive, chunkBuffer, computeBackoffDelay, computeMigrationsHash, createDb, createHealthRoutes, createLogger, createMeter, createMetricsRoutes, createPool, createS3Client, decrypt, decryptJson, deriveKey, encodeKeySegment, encrypt, enrichRequestContext, formatDuration, getPrometheusExporter, getReconnectDelay, getRequestContext, guardStartup, initTelemetry, isPgUniqueViolation, logger, parseDatabaseUrl, redactConfig, requestContext, serializeError, setServiceName, setupGracefulShutdown, sha256, storeMigrationContentHash, toErrorMessage, validateRequiredTools } from "@kici-dev/shared";
+import { AgentDeliveryMode, AgentPlatform, BaseColdStore, ChunkLru, ChunkRequestWaiter, RingBuffer, addLogsToArchive, applyProxyKeepAliveTimeouts, chunkBuffer, computeBackoffDelay, computeMigrationsHash, createDb, createHealthRoutes, createLogger, createMeter, createMetricsRoutes, createPool, createS3Client, decrypt, decryptJson, deriveKey, encodeKeySegment, encrypt, enrichRequestContext, formatDuration, getPrometheusExporter, getReconnectDelay, getRequestContext, guardStartup, initTelemetry, isPgUniqueViolation, logger, parseDatabaseUrl, redactConfig, requestContext, serializeError, setServiceName, setupGracefulShutdown, sha256, storeMigrationContentHash, toErrorMessage, validateRequiredTools } from "@kici-dev/shared";
 import { ACTOR_AGENT_SUFFIX, ALLOWED_SYSTEM_VARS, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, ActorType, AgentFailureCategory, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CLUSTER_MEMBERSHIP_MAX_WORKERS, CONTAINER_BUILD_RUNTIME_LABEL, CacheRefScope, CheckMode, CheckRunConclusion, CheckStepOutcome, CiTrustLevel, ConcurrencyStrategy, ContextDeleteErrorCode, ContextGateRejectReason, DASHBOARD_REQUEST_TYPE_SET, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_APPROVAL_EXPIRY_SECONDS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentModeSchema, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, ForkPolicy, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, ID_TOKEN_CLAIM_NAMES, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, INSTALL_JOB_ID_PREFIX, InitFailureCategory, InventorySelectorSchema, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, LogStream, MIN_APPROVAL_EXPIRY_SECONDS, MIN_PROTOCOL_VERSION, MinimumTrustSchema, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, OWN_INGRESS_MODES, OrchLogPhase, OrchRole, OrchestratorMode, PLATFORM_CONNECTED_MODES, PLATFORM_TAINT_LABELS, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PayloadOmittedReason, RELAY_INGRESS_MODES, RegisterableTriggerType, RunFailureClass, SCALER_EVENT_NAMES, SCHEMA_VERSION, SECURITY_HOLD_JOB_IDS, SSH_TRANSPORT_CAPABILITY, ScaleDownReason, ScalerBackendType, ScalerEventType, ScalerEventType as ScalerEventType$1, ScalerScaleDownPayload, ScalerScaleUpPayload, SetupStepType, SourceOrigin, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_TYPES, TimeoutReason, TraceCheck, TriggerSource, TrustTierSchema, VariantKind, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_SUPERSEDED_BY_RECONNECT, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogWarmSqlCase, agentAuthRequestSchema, agentLabelOf, agentToOrchestratorMessageSchema, agentTypeLabel, appendChecks, approvalExpiryHoursOf, approvalExpirySecondsOf, approvalTimeoutSecondsSchema, artifactInvalidNameError, assertValidScopeName, assertValidSecretKey, attestationVerifyStatusSchema, buildEventClaims, buildIdTokenSubject, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, canonicalizeCapability, canonicalizeLabel, canonicalizeLabelSet, canonicalizeLabels, canonicalizeMatcher, checkArtifactName, coerceDispatchInputs, collectDiscriminatorTypes, createContentRequirementsTraceEntry, createDispatchFailureTraceEntry, createGlobalFilterTraceEntry, createWorkflowDecision, dashboardArtifactsListResponseSchema, dashboardAttestationGetResponseSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListResponseSchema, dashboardRunDetailApiResponseSchema, dashboardStepLogsApiResponseSchema, deriveOsArchLabels, derivePlatformTaints, fanoutEnvelopeFields, flattenActor, getAccessLogColdDays, getRepoGlobMatcher, getSecretAuditLogColdDays, githubIngressPath, githubWebhookPath, globalEvalRoundResultSchema, hasPlatformCapability, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, installGateJobId, isFailureStatus, isKnownCapability, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, isPullRequestFamilyTriggerEvent, isSecurityHoldJobId, isSelfReportedLabel, joinRequestSchema, logPullPlatformToOrchSchema, matchAllWorkflows, matchScopePattern, matchWorkflowsForEvent, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, mergeOrderedMaps, minAccessLogWarmDays, minSecretAuditLogWarmDays, normalizePersistedHoldType, partitionMatchers, peerAuthRequestSchema, peerFromPeerMessageSchema, peerHelloResponseSchema, peerHelloSchema, persistedHoldTypeSpellings, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, reservedEventNamePrefix, resolveRoleLabels, resolveScheduleInputs, resolveSecretsWithProvenance, scalerAgentLabels, scalerLabel, scalerPlatformSchema, scheduleTriggerKey, secretAuditLogWarmSqlCase, shouldRecordAccess, shouldRecordSecretResolve, stateReplaySchema, stringifyActor, truncateDecisionsToByteBudget, trustPolicyUpdateSchema, trustedContributorHoldReason, validateScopeName, validateSecretKey, wrapUntrusted } from "@kici-dev/engine";
 import * as fs$1 from "node:fs";
 import { chmodSync, closeSync, createReadStream, createWriteStream, fsyncSync, mkdirSync, mkdtempSync, openSync, promises, readFileSync, renameSync, rmSync, statSync, unwatchFile, watchFile, writeFileSync, writeSync } from "node:fs";
@@ -10345,28 +10345,41 @@ async function loadAccessLogRange(args) {
 	const coldToTs = toTs && toTs < warmCutoff ? toTs : warmCutoff;
 	const coldRemaining = limit - hotItems.length;
 	const tenantToScan = filter.orgId ?? "__orchestrator__";
+	const matches = (row) => {
+		if (filter.actorType && row.actor_type !== filter.actorType) return false;
+		if (filter.actorId && row.actor_id !== filter.actorId) return false;
+		if (filter.action && row.action !== filter.action) return false;
+		if (filter.source && row.source !== filter.source) return false;
+		if (filter.outcome && row.outcome !== filter.outcome) return false;
+		if (filter.targetType && row.target_type !== filter.targetType) return false;
+		if (filter.targetId && row.target_id !== filter.targetId) return false;
+		if (filter.agentLabel && row.agent_label !== filter.agentLabel) return false;
+		if (filter.agentOnly && row.agent_label == null) return false;
+		if (filter.q && filter.q.length > 0) {
+			if (!(row.error_message ?? "").toLowerCase().includes(filter.q.toLowerCase())) return false;
+		}
+		return true;
+	};
+	const beforeCursor = (it) => !cursor || cursor.source !== "cold" || it.createdAt < cursor.createdAt || it.createdAt === cursor.createdAt && it.id < cursor.id;
 	const coldItems = [];
+	let stoppedEarly = false;
 	try {
 		for await (const row of coldStore.fetchRange({
 			db: "orchestrator",
 			table: "access_log",
 			tenantId: tenantToScan,
 			fromTs: coldFromTs,
-			toTs: coldToTs
+			toTs: coldToTs,
+			order: "desc"
 		})) {
-			if (filter.actorType && row.actor_type !== filter.actorType) continue;
-			if (filter.actorId && row.actor_id !== filter.actorId) continue;
-			if (filter.action && row.action !== filter.action) continue;
-			if (filter.source && row.source !== filter.source) continue;
-			if (filter.outcome && row.outcome !== filter.outcome) continue;
-			if (filter.targetType && row.target_type !== filter.targetType) continue;
-			if (filter.targetId && row.target_id !== filter.targetId) continue;
-			if (filter.agentLabel && row.agent_label !== filter.agentLabel) continue;
-			if (filter.agentOnly && row.agent_label == null) continue;
-			if (filter.q && filter.q.length > 0) {
-				if (!(row.error_message ?? "").toLowerCase().includes(filter.q.toLowerCase())) continue;
-			}
-			coldItems.push(toAccessLogItem(row));
+			if (!matches(row)) continue;
+			const item = toAccessLogItem(row);
+			if (!beforeCursor(item)) continue;
+			if (coldItems.length >= coldRemaining && item.createdAt < coldItems[coldRemaining - 1].createdAt) {
+				stoppedEarly = true;
+				break;
+			}
+			coldItems.push(item);
 		}
 	} catch (err) {
 		if (cursor?.source === "cold") {
@@ -10385,14 +10398,9 @@ async function loadAccessLogRange(args) {
 			nextCursor: hotHasMore && hotItems.length > 0 ? buildHotCursor(hotItems[hotItems.length - 1]) : null
 		};
 	}
-	coldItems.sort((a, b) => a.createdAt < b.createdAt ? 1 : a.createdAt > b.createdAt ? -1 : 0);
-	let coldStart = 0;
-	if (cursor && cursor.source === "cold") {
-		coldStart = coldItems.findIndex((it) => it.createdAt < cursor.createdAt || it.createdAt === cursor.createdAt && it.id < cursor.id);
-		if (coldStart < 0) coldStart = coldItems.length;
-	}
-	const coldPage = coldItems.slice(coldStart, coldStart + coldRemaining);
-	const coldHasMore = coldStart + coldRemaining < coldItems.length;
+	coldItems.sort((a, b) => a.createdAt < b.createdAt ? 1 : a.createdAt > b.createdAt ? -1 : a.id < b.id ? 1 : a.id > b.id ? -1 : 0);
+	const coldPage = coldItems.slice(0, coldRemaining);
+	const coldHasMore = stoppedEarly || coldItems.length > coldRemaining;
 	return {
 		items: [...hotItems, ...coldPage],
 		nextCursor: coldHasMore && coldPage.length > 0 ? buildColdCursor(coldPage[coldPage.length - 1]) : hotHasMore && hotItems.length > 0 && coldPage.length === 0 ? buildHotCursor(hotItems[hotItems.length - 1]) : null
@@ -45074,7 +45082,8 @@ async function loadEventLogRange(args) {
 			table: "event_log",
 			tenantId: routingKey,
 			fromTs: coldFromTs,
-			toTs: coldToTs
+			toTs: coldToTs,
+			order: "desc"
 		})) {
 			if (orgId !== void 0 && row.org_id !== orgId) continue;
 			if (event !== void 0 && row.event !== event) continue;
@@ -45082,6 +45091,7 @@ async function loadEventLogRange(args) {
 			if (status !== void 0 && row.status !== status) continue;
 			if (deliveryId !== void 0 && !row.delivery_id.includes(deliveryId)) continue;
 			coldRows.push(row);
+			if (coldRows.length >= coldOffset + remaining) break;
 		}
 	} catch (err) {
 		if (hotRows.length === 0) {
@@ -45097,10 +45107,6 @@ async function loadEventLogRange(args) {
 		});
 		return hotRows;
 	}
-	coldRows.sort((a, b) => {
-		const at = a.received_at instanceof Date ? a.received_at.getTime() : new Date(a.received_at).getTime();
-		return (b.received_at instanceof Date ? b.received_at.getTime() : new Date(b.received_at).getTime()) - at;
-	});
 	return [...hotRows, ...coldRows.slice(coldOffset, coldOffset + remaining)];
 }
 /**
@@ -46273,14 +46279,14 @@ var init_admin_config = __esmMin((() => {
 function createHealthRoutes$1(deps = {}) {
 	return createHealthRoutes({
 		livenessInfo: () => ({
-			version: "0.9.0",
-			buildDate: "2026-09-21T08:00:42.105Z",
-			buildCommit: "69765a7ee",
-			sdkVersion: "0.9.0",
+			version: "0.9.1",
+			buildDate: "2026-09-22T01:37:00.466Z",
+			buildCommit: "38c8c0e0b",
+			sdkVersion: "0.9.1",
 			sdkBundleHash: "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d",
-			sharedVersion: "0.9.0",
-			sharedBundleHash: "c1c70e41a1ec14fd7cf3a6047251e9aa11258a21e3694ea89a50e8bf14b99f9d",
-			engineVersion: "0.9.0",
+			sharedVersion: "0.9.1",
+			sharedBundleHash: "500b8ea553b9686ed8e5f6dda956dbcf2d429fed6153c46aefdc687643c2dfc5",
+			engineVersion: "0.9.1",
 			engineBundleHash: "c5e0e34d8d7f56f747bba71076a5fbccac4c932be855ef71c596b4211ca8698c"
 		}),
 		readinessCheck: deps.db ? async () => {
@@ -46316,7 +46322,7 @@ function createCapabilitiesRoutes() {
 	const app = new Hono();
 	app.get("/api/v1/capabilities", (c) => {
 		const manifest = {
-			orchestratorVersion: "0.9.0",
+			orchestratorVersion: "0.9.1",
 			protocolVersion: PROTOCOL_VERSION,
 			minProtocolVersion: MIN_PROTOCOL_VERSION
 		};
@@ -49609,7 +49615,7 @@ var init_app = __esmMin((() => {
 	init_log_chunk_sink();
 	init_agent_metrics_aggregator();
 	logger$63 = createLogger({ prefix: "app" });
-	ORCHESTRATOR_VERSION$2 = "0.9.0";
+	ORCHESTRATOR_VERSION$2 = "0.9.1";
 	SourceLocationStore = class {
 		cache = /* @__PURE__ */ new Map();
 		key(workflowName, jobName) {
@@ -63411,7 +63417,7 @@ var logger$45, SOFTWARE_VERSION$1, PeerClient$1;
 var init_peer_client = __esmMin((() => {
 	init_peer_crypto();
 	logger$45 = createLogger({ prefix: "peer-client" });
-	SOFTWARE_VERSION$1 = "0.9.0";
+	SOFTWARE_VERSION$1 = "0.9.1";
 	PeerClient$1 = class {
 		ws = null;
 		_state = "disconnected";
@@ -65425,7 +65431,7 @@ var init_peer_handler = __esmMin((() => {
 	init_peer_crypto();
 	init_join_token();
 	logger$43 = createLogger({ prefix: "peer-handler" });
-	SOFTWARE_VERSION = "0.9.0";
+	SOFTWARE_VERSION = "0.9.1";
 	RATE_LIMIT_MAX = 5;
 	RATE_LIMIT_WINDOW_MS = 6e4;
 }));
@@ -67788,11 +67794,13 @@ async function loadSecretAuditLogRange(args) {
 			table: "secret_audit_log",
 			tenantId: tenant,
 			fromTs: coldFromTs,
-			toTs: coldToTs
+			toTs: coldToTs,
+			order: "desc"
 		})) {
 			if (contextName && row.context_name !== contextName) continue;
 			if (action && row.action !== action) continue;
 			coldRows.push(row);
+			if (coldRows.length >= coldOffset + remaining) break;
 		}
 	} catch (err) {
 		if (hotRows.length === 0) {
@@ -67802,7 +67810,6 @@ async function loadSecretAuditLogRange(args) {
 		logger$37.warn("cold-store fetchRange failed; returning hot rows only", { error: toErrorMessage(err) });
 		return hotRows;
 	}
-	coldRows.sort((a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime());
 	const coldSlice = coldRows.slice(coldOffset, coldOffset + remaining);
 	return [...hotRows, ...coldSlice];
 }
@@ -73937,6 +73944,10 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 			config: csConfig,
 			instanceId: config.instanceId,
 			kdb: db,
+			chunkCache: new ChunkLru({
+				maxBytes: COLD_STORE_CHUNK_CACHE_BYTES,
+				sizeOf: (v) => v.byteLength
+			}),
 			log: (level, msg, extra) => {
 				if (level === "info") logger$25.info(msg, extra);
 				else if (level === "warn") logger$25.warn(msg, extra);
@@ -74805,7 +74816,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 	markProcessingDepsReady();
 	tryDispatchNextQueuedRef = tryDispatchNextQueued;
 	ingestOverflowReplayer.setReinjectDirect(reinjectDirect);
-	const server = serve({
+	const server = applyProxyKeepAliveTimeouts(serve({
 		fetch: app.fetch,
 		port: config.port,
 		hostname: config.host,
@@ -74817,7 +74828,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 			mode: config.mode,
 			environment: config.nodeEnv
 		});
-	});
+	}));
 	const heartbeatMonitor = new AgentHeartbeatMonitor({
 		registry: agentRegistry,
 		dispatcher
@@ -75146,7 +75157,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 		]
 	});
 }
-var logger$25;
+var logger$25, COLD_STORE_CHUNK_CACHE_BYTES;
 var init_orchestrator_core = __esmMin((() => {
 	init_data_dir();
 	init_reload();
@@ -75269,6 +75280,7 @@ var init_orchestrator_core = __esmMin((() => {
 	init_disk_guard();
 	init_types$1();
 	logger$25 = createLogger({ prefix: "core" });
+	COLD_STORE_CHUNK_CACHE_BYTES = 134217728;
 }));
 //#endregion
 //#region src/contexts/protection/aggregate.ts
@@ -95227,7 +95239,7 @@ async function bootstrapWorker(config, _opts) {
 		onConcurrencyReport: void 0
 	});
 	app.get("/ws", upgradeWebSocket(() => agentWsHandler));
-	const server = serve({
+	const server = applyProxyKeepAliveTimeouts(serve({
 		fetch: app.fetch,
 		port: config.port,
 		hostname: config.host,
@@ -95240,7 +95252,7 @@ async function bootstrapWorker(config, _opts) {
 			coordinatorUrls: coordUrls,
 			instanceId: config.cluster.instanceId
 		});
-	});
+	}));
 	const heartbeatMonitor = new AgentHeartbeatMonitor({
 		registry: agentRegistry,
 		dispatcher
@@ -95353,13 +95365,13 @@ var init_worker_core = __esmMin((() => {
 	init_peer_outbox();
 	init_worker_outbox_relay();
 	init_app_on_error();
-	ORCHESTRATOR_VERSION$1 = "0.9.0";
-	WORKER_BUILD_COMMIT = "69765a7ee";
-	WORKER_SDK_VERSION = "0.9.0";
+	ORCHESTRATOR_VERSION$1 = "0.9.1";
+	WORKER_BUILD_COMMIT = "38c8c0e0b";
+	WORKER_SDK_VERSION = "0.9.1";
 	WORKER_SDK_BUNDLE_HASH = "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d";
-	WORKER_SHARED_VERSION = "0.9.0";
-	WORKER_SHARED_BUNDLE_HASH = "c1c70e41a1ec14fd7cf3a6047251e9aa11258a21e3694ea89a50e8bf14b99f9d";
-	WORKER_ENGINE_VERSION = "0.9.0";
+	WORKER_SHARED_VERSION = "0.9.1";
+	WORKER_SHARED_BUNDLE_HASH = "500b8ea553b9686ed8e5f6dda956dbcf2d429fed6153c46aefdc687643c2dfc5";
+	WORKER_ENGINE_VERSION = "0.9.1";
 	WORKER_ENGINE_BUNDLE_HASH = "c5e0e34d8d7f56f747bba71076a5fbccac4c932be855ef71c596b4211ca8698c";
 	logger$2 = createLogger({ prefix: "worker" });
 	DRAIN_TIMEOUT_MS = 3e5;
@@ -95387,13 +95399,13 @@ init_processor();
 init_verify_inbound();
 init_ingest_overflow_types();
 init_scope_routing();
-const ORCHESTRATOR_VERSION = "0.9.0";
-const BUILD_COMMIT = "69765a7ee";
-const SDK_VERSION = "0.9.0";
+const ORCHESTRATOR_VERSION = "0.9.1";
+const BUILD_COMMIT = "38c8c0e0b";
+const SDK_VERSION = "0.9.1";
 const SDK_BUNDLE_HASH = "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d";
-const SHARED_VERSION = "0.9.0";
-const SHARED_BUNDLE_HASH = "c1c70e41a1ec14fd7cf3a6047251e9aa11258a21e3694ea89a50e8bf14b99f9d";
-const ENGINE_VERSION = "0.9.0";
+const SHARED_VERSION = "0.9.1";
+const SHARED_BUNDLE_HASH = "500b8ea553b9686ed8e5f6dda956dbcf2d429fed6153c46aefdc687643c2dfc5";
+const ENGINE_VERSION = "0.9.1";
 const ENGINE_BUNDLE_HASH = "c5e0e34d8d7f56f747bba71076a5fbccac4c932be855ef71c596b4211ca8698c";
 const otelSdk = initTelemetry({
 	serviceName: "kici-orchestrator",

package/dist/standalone.js

@@ -3,7 +3,7 @@ import { dirname as __cjs_dirname } from "node:path";
 const __filename = __cjs_fileURLToPath(import.meta.url);
 __cjs_dirname(__filename);
 import "node:module";
-import { AgentDeliveryMode, AgentPlatform, BaseColdStore, ChunkRequestWaiter, addLogsToArchive, chunkBuffer, computeBackoffDelay, computeMigrationsHash, createDb, createHealthRoutes, createLogger, createMeter, createMetricsRoutes, createPool, createS3Client, decrypt, deriveKey, encodeKeySegment, encrypt, enrichRequestContext, formatDuration, getPrometheusExporter, getReconnectDelay, getRequestContext, guardStartup, initTelemetry, isPgUniqueViolation, logger, parseDatabaseUrl, redactConfig, requestContext, serializeError, setServiceName, setupGracefulShutdown, sha256, storeMigrationContentHash, toErrorMessage, validateRequiredTools } from "@kici-dev/shared";
+import { AgentDeliveryMode, AgentPlatform, BaseColdStore, ChunkLru, ChunkRequestWaiter, addLogsToArchive, applyProxyKeepAliveTimeouts, chunkBuffer, computeBackoffDelay, computeMigrationsHash, createDb, createHealthRoutes, createLogger, createMeter, createMetricsRoutes, createPool, createS3Client, decrypt, deriveKey, encodeKeySegment, encrypt, enrichRequestContext, formatDuration, getPrometheusExporter, getReconnectDelay, getRequestContext, guardStartup, initTelemetry, isPgUniqueViolation, logger, parseDatabaseUrl, redactConfig, requestContext, serializeError, setServiceName, setupGracefulShutdown, sha256, storeMigrationContentHash, toErrorMessage, validateRequiredTools } from "@kici-dev/shared";
 import { ACTOR_AGENT_SUFFIX, ALLOWED_SYSTEM_VARS, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, ActorType, AgentFailureCategory, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CONTAINER_BUILD_RUNTIME_LABEL, CacheRefScope, CheckMode, CheckRunConclusion, CheckStepOutcome, CiTrustLevel, ConcurrencyStrategy, ContextDeleteErrorCode, ContextGateRejectReason, DASHBOARD_REQUEST_TYPE_SET, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_APPROVAL_EXPIRY_SECONDS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, ForkPolicy, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, ID_TOKEN_CLAIM_NAMES, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, INSTALL_JOB_ID_PREFIX, InitFailureCategory, InventorySelectorSchema, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, LogStream, MIN_APPROVAL_EXPIRY_SECONDS, MIN_PROTOCOL_VERSION, MinimumTrustSchema, ORCH_AGENT_CAPABILITIES, OWN_INGRESS_MODES, OrchLogPhase, OrchestratorMode, PLATFORM_CONNECTED_MODES, PLATFORM_TAINT_LABELS, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, RunFailureClass, SCALER_EVENT_NAMES, SCHEMA_VERSION, SECURITY_HOLD_JOB_IDS, SSH_TRANSPORT_CAPABILITY, ScaleDownReason, ScalerBackendType, ScalerEventType, ScalerEventType as ScalerEventType$1, ScalerScaleDownPayload, ScalerScaleUpPayload, SetupStepType, SourceOrigin, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_TYPES, TimeoutReason, TraceCheck, TriggerSource, TrustTierSchema, VariantKind, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_SUPERSEDED_BY_RECONNECT, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogWarmSqlCase, agentAuthRequestSchema, agentLabelOf, agentToOrchestratorMessageSchema, agentTypeLabel, appendChecks, approvalExpiryHoursOf, approvalExpirySecondsOf, approvalTimeoutSecondsSchema, artifactInvalidNameError, assertValidSecretKey, attestationVerifyStatusSchema, buildEventClaims, buildIdTokenSubject, buildTrustedPassthroughEnv, canonicalizeCapability, canonicalizeLabel, canonicalizeLabelSet, canonicalizeLabels, canonicalizeMatcher, checkArtifactName, collectDiscriminatorTypes, createContentRequirementsTraceEntry, createDispatchFailureTraceEntry, createGlobalFilterTraceEntry, deriveOsArchLabels, derivePlatformTaints, fanoutEnvelopeFields, flattenActor, getAccessLogColdDays, getSecretAuditLogColdDays, githubIngressPath, globalEvalRoundResultSchema, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, installGateJobId, isFailureStatus, isKnownCapability, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, isPullRequestFamilyTriggerEvent, isSecurityHoldJobId, isSelfReportedLabel, joinRequestSchema, logPullPlatformToOrchSchema, matchAllWorkflows, matchScopePattern, matchWorkflowsForEvent, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, mergeOrderedMaps, minAccessLogWarmDays, minSecretAuditLogWarmDays, normalizePersistedHoldType, partitionMatchers, peerAuthRequestSchema, peerFromPeerMessageSchema, peerHelloResponseSchema, peerHelloSchema, persistedHoldTypeSpellings, platformToOsArchLabels, platformToTaints, reservedEventNamePrefix, resolveRoleLabels, resolveScheduleInputs, resolveSecretsWithProvenance, scalerAgentLabels, scalerLabel, scalerPlatformSchema, scheduleTriggerKey, secretAuditLogWarmSqlCase, shouldRecordAccess, shouldRecordSecretResolve, truncateDecisionsToByteBudget, trustPolicyUpdateSchema, trustedContributorHoldReason, validateScopeName, validateSecretKey, wrapUntrusted } from "@kici-dev/engine";
 import * as os$1 from "node:os";
 import os, { cpus, freemem, homedir, hostname, release, tmpdir, totalmem, uptime, userInfo } from "node:os";
@@ -1359,7 +1359,7 @@ var logger$135, SOFTWARE_VERSION$1, PeerClient$1;
 var init_peer_client = __esmMin((() => {
 	init_peer_crypto();
 	logger$135 = createLogger({ prefix: "peer-client" });
-	SOFTWARE_VERSION$1 = "0.9.0";
+	SOFTWARE_VERSION$1 = "0.9.1";
 	PeerClient$1 = class {
 		ws = null;
 		_state = "disconnected";
@@ -3373,7 +3373,7 @@ var init_peer_handler = __esmMin((() => {
 	init_peer_crypto();
 	init_join_token();
 	logger$133 = createLogger({ prefix: "peer-handler" });
-	SOFTWARE_VERSION = "0.9.0";
+	SOFTWARE_VERSION = "0.9.1";
 	RATE_LIMIT_MAX = 5;
 	RATE_LIMIT_WINDOW_MS = 6e4;
 }));
@@ -12938,28 +12938,41 @@ async function loadAccessLogRange(args) {
 	const coldToTs = toTs && toTs < warmCutoff ? toTs : warmCutoff;
 	const coldRemaining = limit - hotItems.length;
 	const tenantToScan = filter.orgId ?? "__orchestrator__";
+	const matches = (row) => {
+		if (filter.actorType && row.actor_type !== filter.actorType) return false;
+		if (filter.actorId && row.actor_id !== filter.actorId) return false;
+		if (filter.action && row.action !== filter.action) return false;
+		if (filter.source && row.source !== filter.source) return false;
+		if (filter.outcome && row.outcome !== filter.outcome) return false;
+		if (filter.targetType && row.target_type !== filter.targetType) return false;
+		if (filter.targetId && row.target_id !== filter.targetId) return false;
+		if (filter.agentLabel && row.agent_label !== filter.agentLabel) return false;
+		if (filter.agentOnly && row.agent_label == null) return false;
+		if (filter.q && filter.q.length > 0) {
+			if (!(row.error_message ?? "").toLowerCase().includes(filter.q.toLowerCase())) return false;
+		}
+		return true;
+	};
+	const beforeCursor = (it) => !cursor || cursor.source !== "cold" || it.createdAt < cursor.createdAt || it.createdAt === cursor.createdAt && it.id < cursor.id;
 	const coldItems = [];
+	let stoppedEarly = false;
 	try {
 		for await (const row of coldStore.fetchRange({
 			db: "orchestrator",
 			table: "access_log",
 			tenantId: tenantToScan,
 			fromTs: coldFromTs,
-			toTs: coldToTs
+			toTs: coldToTs,
+			order: "desc"
 		})) {
-			if (filter.actorType && row.actor_type !== filter.actorType) continue;
-			if (filter.actorId && row.actor_id !== filter.actorId) continue;
-			if (filter.action && row.action !== filter.action) continue;
-			if (filter.source && row.source !== filter.source) continue;
-			if (filter.outcome && row.outcome !== filter.outcome) continue;
-			if (filter.targetType && row.target_type !== filter.targetType) continue;
-			if (filter.targetId && row.target_id !== filter.targetId) continue;
-			if (filter.agentLabel && row.agent_label !== filter.agentLabel) continue;
-			if (filter.agentOnly && row.agent_label == null) continue;
-			if (filter.q && filter.q.length > 0) {
-				if (!(row.error_message ?? "").toLowerCase().includes(filter.q.toLowerCase())) continue;
-			}
-			coldItems.push(toAccessLogItem(row));
+			if (!matches(row)) continue;
+			const item = toAccessLogItem(row);
+			if (!beforeCursor(item)) continue;
+			if (coldItems.length >= coldRemaining && item.createdAt < coldItems[coldRemaining - 1].createdAt) {
+				stoppedEarly = true;
+				break;
+			}
+			coldItems.push(item);
 		}
 	} catch (err) {
 		if (cursor?.source === "cold") {
@@ -12978,14 +12991,9 @@ async function loadAccessLogRange(args) {
 			nextCursor: hotHasMore && hotItems.length > 0 ? buildHotCursor(hotItems[hotItems.length - 1]) : null
 		};
 	}
-	coldItems.sort((a, b) => a.createdAt < b.createdAt ? 1 : a.createdAt > b.createdAt ? -1 : 0);
-	let coldStart = 0;
-	if (cursor && cursor.source === "cold") {
-		coldStart = coldItems.findIndex((it) => it.createdAt < cursor.createdAt || it.createdAt === cursor.createdAt && it.id < cursor.id);
-		if (coldStart < 0) coldStart = coldItems.length;
-	}
-	const coldPage = coldItems.slice(coldStart, coldStart + coldRemaining);
-	const coldHasMore = coldStart + coldRemaining < coldItems.length;
+	coldItems.sort((a, b) => a.createdAt < b.createdAt ? 1 : a.createdAt > b.createdAt ? -1 : a.id < b.id ? 1 : a.id > b.id ? -1 : 0);
+	const coldPage = coldItems.slice(0, coldRemaining);
+	const coldHasMore = stoppedEarly || coldItems.length > coldRemaining;
 	return {
 		items: [...hotItems, ...coldPage],
 		nextCursor: coldHasMore && coldPage.length > 0 ? buildColdCursor(coldPage[coldPage.length - 1]) : hotHasMore && hotItems.length > 0 && coldPage.length === 0 ? buildHotCursor(hotItems[hotItems.length - 1]) : null
@@ -60206,7 +60214,8 @@ async function loadEventLogRange(args) {
 			table: "event_log",
 			tenantId: routingKey,
 			fromTs: coldFromTs,
-			toTs: coldToTs
+			toTs: coldToTs,
+			order: "desc"
 		})) {
 			if (orgId !== void 0 && row.org_id !== orgId) continue;
 			if (event !== void 0 && row.event !== event) continue;
@@ -60214,6 +60223,7 @@ async function loadEventLogRange(args) {
 			if (status !== void 0 && row.status !== status) continue;
 			if (deliveryId !== void 0 && !row.delivery_id.includes(deliveryId)) continue;
 			coldRows.push(row);
+			if (coldRows.length >= coldOffset + remaining) break;
 		}
 	} catch (err) {
 		if (hotRows.length === 0) {
@@ -60229,10 +60239,6 @@ async function loadEventLogRange(args) {
 		});
 		return hotRows;
 	}
-	coldRows.sort((a, b) => {
-		const at = a.received_at instanceof Date ? a.received_at.getTime() : new Date(a.received_at).getTime();
-		return (b.received_at instanceof Date ? b.received_at.getTime() : new Date(b.received_at).getTime()) - at;
-	});
 	return [...hotRows, ...coldRows.slice(coldOffset, coldOffset + remaining)];
 }
 /**
@@ -61405,14 +61411,14 @@ var init_admin_config = __esmMin((() => {
 function createHealthRoutes$1(deps = {}) {
 	return createHealthRoutes({
 		livenessInfo: () => ({
-			version: "0.9.0",
-			buildDate: "2026-09-21T08:00:42.105Z",
-			buildCommit: "69765a7ee",
-			sdkVersion: "0.9.0",
+			version: "0.9.1",
+			buildDate: "2026-09-22T01:37:00.466Z",
+			buildCommit: "38c8c0e0b",
+			sdkVersion: "0.9.1",
 			sdkBundleHash: "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d",
-			sharedVersion: "0.9.0",
-			sharedBundleHash: "c1c70e41a1ec14fd7cf3a6047251e9aa11258a21e3694ea89a50e8bf14b99f9d",
-			engineVersion: "0.9.0",
+			sharedVersion: "0.9.1",
+			sharedBundleHash: "500b8ea553b9686ed8e5f6dda956dbcf2d429fed6153c46aefdc687643c2dfc5",
+			engineVersion: "0.9.1",
 			engineBundleHash: "c5e0e34d8d7f56f747bba71076a5fbccac4c932be855ef71c596b4211ca8698c"
 		}),
 		readinessCheck: deps.db ? async () => {
@@ -61448,7 +61454,7 @@ function createCapabilitiesRoutes() {
 	const app = new Hono();
 	app.get("/api/v1/capabilities", (c) => {
 		const manifest = {
-			orchestratorVersion: "0.9.0",
+			orchestratorVersion: "0.9.1",
 			protocolVersion: PROTOCOL_VERSION,
 			minProtocolVersion: MIN_PROTOCOL_VERSION
 		};
@@ -64390,7 +64396,7 @@ var init_app = __esmMin((() => {
 	init_log_chunk_sink();
 	init_agent_metrics_aggregator();
 	logger$32 = createLogger({ prefix: "app" });
-	ORCHESTRATOR_VERSION$2 = "0.9.0";
+	ORCHESTRATOR_VERSION$2 = "0.9.1";
 	SourceLocationStore = class {
 		cache = /* @__PURE__ */ new Map();
 		key(workflowName, jobName) {
@@ -75470,11 +75476,13 @@ async function loadSecretAuditLogRange(args) {
 			table: "secret_audit_log",
 			tenantId: tenant,
 			fromTs: coldFromTs,
-			toTs: coldToTs
+			toTs: coldToTs,
+			order: "desc"
 		})) {
 			if (contextName && row.context_name !== contextName) continue;
 			if (action && row.action !== action) continue;
 			coldRows.push(row);
+			if (coldRows.length >= coldOffset + remaining) break;
 		}
 	} catch (err) {
 		if (hotRows.length === 0) {
@@ -75484,7 +75492,6 @@ async function loadSecretAuditLogRange(args) {
 		logger$16.warn("cold-store fetchRange failed; returning hot rows only", { error: toErrorMessage(err) });
 		return hotRows;
 	}
-	coldRows.sort((a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime());
 	const coldSlice = coldRows.slice(coldOffset, coldOffset + remaining);
 	return [...hotRows, ...coldSlice];
 }
@@ -81488,6 +81495,10 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 			config: csConfig,
 			instanceId: config.instanceId,
 			kdb: db,
+			chunkCache: new ChunkLru({
+				maxBytes: COLD_STORE_CHUNK_CACHE_BYTES,
+				sizeOf: (v) => v.byteLength
+			}),
 			log: (level, msg, extra) => {
 				if (level === "info") logger$5.info(msg, extra);
 				else if (level === "warn") logger$5.warn(msg, extra);
@@ -82356,7 +82367,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 	markProcessingDepsReady();
 	tryDispatchNextQueuedRef = tryDispatchNextQueued;
 	ingestOverflowReplayer.setReinjectDirect(reinjectDirect);
-	const server = serve({
+	const server = applyProxyKeepAliveTimeouts(serve({
 		fetch: app.fetch,
 		port: config.port,
 		hostname: config.host,
@@ -82368,7 +82379,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 			mode: config.mode,
 			environment: config.nodeEnv
 		});
-	});
+	}));
 	const heartbeatMonitor = new AgentHeartbeatMonitor({
 		registry: agentRegistry,
 		dispatcher
@@ -82697,7 +82708,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 		]
 	});
 }
-var logger$5;
+var logger$5, COLD_STORE_CHUNK_CACHE_BYTES;
 var init_orchestrator_core = __esmMin((() => {
 	init_data_dir();
 	init_reload();
@@ -82820,6 +82831,7 @@ var init_orchestrator_core = __esmMin((() => {
 	init_disk_guard();
 	init_types$1();
 	logger$5 = createLogger({ prefix: "core" });
+	COLD_STORE_CHUNK_CACHE_BYTES = 134217728;
 }));
 //#endregion
 //#region src/secrets/context-secret-resolver.ts
@@ -84329,7 +84341,7 @@ async function bootstrapWorker(config, _opts) {
 		onConcurrencyReport: void 0
 	});
 	app.get("/ws", upgradeWebSocket(() => agentWsHandler));
-	const server = serve({
+	const server = applyProxyKeepAliveTimeouts(serve({
 		fetch: app.fetch,
 		port: config.port,
 		hostname: config.host,
@@ -84342,7 +84354,7 @@ async function bootstrapWorker(config, _opts) {
 			coordinatorUrls: coordUrls,
 			instanceId: config.cluster.instanceId
 		});
-	});
+	}));
 	const heartbeatMonitor = new AgentHeartbeatMonitor({
 		registry: agentRegistry,
 		dispatcher
@@ -84455,13 +84467,13 @@ var init_worker_core = __esmMin((() => {
 	init_peer_outbox();
 	init_worker_outbox_relay();
 	init_app_on_error();
-	ORCHESTRATOR_VERSION$1 = "0.9.0";
-	WORKER_BUILD_COMMIT = "69765a7ee";
-	WORKER_SDK_VERSION = "0.9.0";
+	ORCHESTRATOR_VERSION$1 = "0.9.1";
+	WORKER_BUILD_COMMIT = "38c8c0e0b";
+	WORKER_SDK_VERSION = "0.9.1";
 	WORKER_SDK_BUNDLE_HASH = "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d";
-	WORKER_SHARED_VERSION = "0.9.0";
-	WORKER_SHARED_BUNDLE_HASH = "c1c70e41a1ec14fd7cf3a6047251e9aa11258a21e3694ea89a50e8bf14b99f9d";
-	WORKER_ENGINE_VERSION = "0.9.0";
+	WORKER_SHARED_VERSION = "0.9.1";
+	WORKER_SHARED_BUNDLE_HASH = "500b8ea553b9686ed8e5f6dda956dbcf2d429fed6153c46aefdc687643c2dfc5";
+	WORKER_ENGINE_VERSION = "0.9.1";
 	WORKER_ENGINE_BUNDLE_HASH = "c5e0e34d8d7f56f747bba71076a5fbccac4c932be855ef71c596b4211ca8698c";
 	logger$2 = createLogger({ prefix: "worker" });
 	DRAIN_TIMEOUT_MS = 3e5;
@@ -84486,13 +84498,13 @@ var init_worker_core = __esmMin((() => {
 * Graceful shutdown:
 * agent WS -> heartbeat -> HTTP -> DB
 */
-const ORCHESTRATOR_VERSION = "0.9.0";
-const BUILD_COMMIT = "69765a7ee";
-const SDK_VERSION = "0.9.0";
+const ORCHESTRATOR_VERSION = "0.9.1";
+const BUILD_COMMIT = "38c8c0e0b";
+const SDK_VERSION = "0.9.1";
 const SDK_BUNDLE_HASH = "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d";
-const SHARED_VERSION = "0.9.0";
-const SHARED_BUNDLE_HASH = "c1c70e41a1ec14fd7cf3a6047251e9aa11258a21e3694ea89a50e8bf14b99f9d";
-const ENGINE_VERSION = "0.9.0";
+const SHARED_VERSION = "0.9.1";
+const SHARED_BUNDLE_HASH = "500b8ea553b9686ed8e5f6dda956dbcf2d429fed6153c46aefdc687643c2dfc5";
+const ENGINE_VERSION = "0.9.1";
 const ENGINE_BUNDLE_HASH = "c5e0e34d8d7f56f747bba71076a5fbccac4c932be855ef71c596b4211ca8698c";
 const otelSdk = initTelemetry({
 	serviceName: "kici-orchestrator",

package/installer-image-digests.json

@@ -1,7 +1,7 @@
 {
-  "version": "0.9.0",
+  "version": "0.9.1",
   "images": {
-    "kici-agent": "sha256:371b518421c505041bc8b52eae3ce92e888f25b2cc2d4914f32420dbbf11df55",
-    "kici-orchestrator": "sha256:58c36d0222832fcb82b0af33cdb46d474b97654b0051cb6c54fa96fca9a13af2"
+    "kici-agent": "sha256:e5d740180cf3aa12128355bc9ff9dd2594fc70b7362bf5884430f74cee6677ae",
+    "kici-orchestrator": "sha256:bfe2c58cd88e700f23e6e757ebdb92a97f840632bb1450643d46f5c4180dcb2c"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/orchestrator",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
   "keywords": [
     "ci",
@@ -90,8 +90,8 @@
     "ws": "^8.21.3",
     "yaml": "^2.9.1",
     "zod": "^4.6.5",
-    "@kici-dev/engine": "0.9.0",
-    "@kici-dev/shared": "0.9.0"
+    "@kici-dev/engine": "0.9.1",
+    "@kici-dev/shared": "0.9.1"
   },
   "kici": {
     "metrics": {
@@ -106,7 +106,7 @@
     "@types/dockerode": "^4.0.1",
     "@types/ws": "^8.18.1",
     "kysely-ctl": "^0.21.0",
-    "@kici-dev/agent": "0.9.0"
+    "@kici-dev/agent": "0.9.1"
   },
   "scripts": {
     "build": "node ../../scripts/build-service.mjs && tsc --emitDeclarationOnly",

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/orchestrator@0.9.0",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Forchestrator/0.9.0/f29c1468-46c2-4a20-8f58-978ec346613e",
+  "name": "@kici-dev/orchestrator@0.9.1",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Forchestrator/0.9.1/2061fac6-aebc-4b57-9d8b-6142fd482a5b",
   "creationInfo": {
-    "created": "2026-09-21T08:49:42Z",
+    "created": "2026-09-22T02:16:40Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -964,9 +964,9 @@
       "homepage": "https://ericsmekens.github.io/jsep/tree/master/packages/regex#readme"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-core-0.9.0",
+      "SPDXID": "SPDXRef-Package--kici-dev-core-0.9.1",
       "name": "@kici-dev/core",
-      "versionInfo": "0.9.0",
+      "versionInfo": "0.9.1",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -977,16 +977,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/core@0.9.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/core@0.9.1"
         }
       ],
       "description": "Light shared utilities for the KiCI stack (logging, errors, formatting, crypto, zx init, the TypeScript ESM loader hook). No server-side dependencies.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.9.0",
+      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.9.1",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.9.0",
+      "versionInfo": "0.9.1",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -997,7 +997,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.9.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.9.1"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
@@ -1006,7 +1006,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/orchestrator",
-      "versionInfo": "0.9.0",
+      "versionInfo": "0.9.1",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1017,16 +1017,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/orchestrator@0.9.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/orchestrator@0.9.1"
         }
       ],
       "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "name": "@kici-dev/shared",
-      "versionInfo": "0.9.0",
+      "versionInfo": "0.9.1",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1037,7 +1037,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.9.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.9.1"
         }
       ],
       "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
@@ -7676,62 +7676,62 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.150.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.6.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-jose-6.2.12",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.7",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-safe-regex-2.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-yaml-2.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.6.5",
       "relationshipType": "DEPENDS_ON"
     },
@@ -7767,12 +7767,12 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.9.0",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -7881,117 +7881,117 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package--aws-sdk-client-s3-3.1135.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-api-1.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-metrics-otlp-http-0.222.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-prometheus-0.222.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-trace-otlp-http-0.222.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-instrumentation-runtime-node-0.35.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-resources-2.11.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-sdk-node-0.222.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-semantic-conventions-1.43.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-archiver-8.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-diff-9.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-hono-4.13.7",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-kysely-0.29.4",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.150.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-pg-8.23.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-yaml-2.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.6.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.9.1",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },