@kici-dev/shared 0.1.15 → 0.1.16

package/dist/diagnostics/bundle-archive.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Shared debug-bundle archive primitives.
+ *
+ * Allowlist config redaction and windowed log-file archiving, used by the
+ * orchestrator's in-process bundle writer, the kici-admin CLI's local bundle,
+ * and the agent's fleet mini-bundle assembler. Keeping one copy means a node
+ * cannot drift from the redaction posture of its peers.
+ */
+import type archiver from 'archiver';
+/** Maximum total log bytes to include in bundle (50MB). */
+export declare const MAX_LOG_BYTES: number;
+/**
+ * Redact config values using allowlist approach.
+ * Only known-safe fields are preserved; everything else becomes "****".
+ */
+export declare function redactConfig(obj: unknown, parentKey?: string): unknown;
+/**
+ * Add log files from logDir to the archive, respecting MAX_LOG_BYTES cap
+ * and the logWindow time filter. Matches any `*.log` file in the directory,
+ * so the per-instance filename pattern produced by
+ * `buildLogFilename()` is picked up without additional configuration.
+ *
+ * Exported for reuse by the `kici-admin debug-bundle` CLI command, which
+ * runs outside the orchestrator process but still needs to include the
+ * same log files in its locally-assembled bundle.
+ */
+export declare function addLogsToArchive(archive: archiver.Archiver, logDir: string, logWindowHours: number): Promise<void>;
+//# sourceMappingURL=bundle-archive.d.ts.map

package/dist/diagnostics/bundle-archive.js

@@ -0,0 +1,141 @@
+import "../chunk-gOLHoazu.js";
+import * as fs from "node:fs";
+import * as path from "node:path";
+//#region src/diagnostics/bundle-archive.ts
+/**
+* Shared debug-bundle archive primitives.
+*
+* Allowlist config redaction and windowed log-file archiving, used by the
+* orchestrator's in-process bundle writer, the kici-admin CLI's local bundle,
+* and the agent's fleet mini-bundle assembler. Keeping one copy means a node
+* cannot drift from the redaction posture of its peers.
+*/
+/** Maximum total log bytes to include in bundle (50MB). */
+const MAX_LOG_BYTES = 50 * 1024 * 1024;
+/**
+* Config field names that are safe to include unredacted.
+* Everything else gets replaced with "****".
+*/
+const SAFE_CONFIG_KEYS = new Set([
+	"mode",
+	"host",
+	"port",
+	"logLevel",
+	"region",
+	"environment",
+	"name",
+	"label",
+	"labels",
+	"enabled",
+	"disabled",
+	"timeout",
+	"interval",
+	"maxRetries",
+	"retries",
+	"workers",
+	"concurrency",
+	"maxConcurrency",
+	"batchSize",
+	"bufferSize",
+	"warmPool",
+	"cooldown",
+	"type",
+	"provider",
+	"scaler",
+	"driver",
+	"backend",
+	"protocol",
+	"scheme",
+	"path",
+	"basePath",
+	"metricsPath",
+	"healthPath",
+	"logFormat",
+	"logFile",
+	"logDir",
+	"dataDir",
+	"version",
+	"debug",
+	"verbose",
+	"quiet",
+	"tls",
+	"cors",
+	"rateLimiting",
+	"maxConnections",
+	"poolSize",
+	"minPool",
+	"maxPool",
+	"idleTimeout",
+	"connectTimeout",
+	"requestTimeout",
+	"shutdownTimeout",
+	"gracefulShutdown"
+]);
+/**
+* Redact config values using allowlist approach.
+* Only known-safe fields are preserved; everything else becomes "****".
+*/
+function redactConfig(obj, parentKey) {
+	if (obj === null || obj === void 0) return obj;
+	if (Array.isArray(obj)) return obj.map((item) => redactConfig(item, parentKey));
+	if (typeof obj === "object") {
+		const result = {};
+		for (const [key, value] of Object.entries(obj)) result[key] = redactConfig(value, key);
+		return result;
+	}
+	if (typeof obj === "string" && parentKey && !SAFE_CONFIG_KEYS.has(parentKey)) return "****";
+	if (typeof obj === "number" || typeof obj === "boolean") return obj;
+	if (typeof obj === "string" && parentKey && SAFE_CONFIG_KEYS.has(parentKey)) return obj;
+	if (typeof obj === "string") return "****";
+	return obj;
+}
+/**
+* Add log files from logDir to the archive, respecting MAX_LOG_BYTES cap
+* and the logWindow time filter. Matches any `*.log` file in the directory,
+* so the per-instance filename pattern produced by
+* `buildLogFilename()` is picked up without additional configuration.
+*
+* Exported for reuse by the `kici-admin debug-bundle` CLI command, which
+* runs outside the orchestrator process but still needs to include the
+* same log files in its locally-assembled bundle.
+*/
+async function addLogsToArchive(archive, logDir, logWindowHours) {
+	const cutoff = Date.now() - logWindowHours * 60 * 60 * 1e3;
+	const entries = fs.readdirSync(logDir).filter((f) => {
+		if (!f.endsWith(".log")) return false;
+		return fs.statSync(path.join(logDir, f)).mtimeMs >= cutoff;
+	});
+	entries.sort((a, b) => {
+		const aStat = fs.statSync(path.join(logDir, a));
+		return fs.statSync(path.join(logDir, b)).mtimeMs - aStat.mtimeMs;
+	});
+	let totalBytes = 0;
+	let totalLines = 0;
+	let errors = 0;
+	let warnings = 0;
+	for (const entry of entries) {
+		const filePath = path.join(logDir, entry);
+		const stat = fs.statSync(filePath);
+		if (totalBytes + stat.size > 52428800) break;
+		const content = fs.readFileSync(filePath, "utf-8");
+		archive.append(content, { name: `logs/${entry}` });
+		totalBytes += stat.size;
+		const lines = content.split("\n");
+		totalLines += lines.length;
+		for (const line of lines) {
+			if (/\berror\b/i.test(line)) errors++;
+			if (/\bwarn(ing)?\b/i.test(line)) warnings++;
+		}
+	}
+	const summary = {
+		totalLines,
+		errors,
+		warnings,
+		totalBytes
+	};
+	archive.append(JSON.stringify(summary, null, 2), { name: "logs/summary.json" });
+}
+//#endregion
+export { MAX_LOG_BYTES, addLogsToArchive, redactConfig };
+
+//# sourceMappingURL=bundle-archive.js.map

package/dist/diagnostics/bundle-archive.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=bundle-archive.test.d.ts.map

package/dist/diagnostics/bundle-chunks.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Channel-agnostic chunked transfer for fleet bundle ZIPs.
+ *
+ * The WS frame cap (WS_MAX_PAYLOAD_BYTES = 25 MiB) forbids shipping a whole
+ * bundle in one frame, so a bundle Buffer is split into ordered base64 frames
+ * (~85 KiB raw each, matching the webhook-relay frame size) and reassembled by
+ * the receiver. Used on both the orchestrator-agent and peer channels.
+ */
+/** Raw bytes per chunk before base64 (matches webhook-relay's ~85 KiB frames). */
+export declare const FLEET_CHUNK_BYTES: number;
+export interface BundleChunkFrame {
+    seq: number;
+    dataB64: string;
+    isLast: boolean;
+}
+/** Split a Buffer into ordered base64 frames. An empty buffer yields one final frame. */
+export declare function chunkBuffer(buf: Buffer, chunkBytes?: number): BundleChunkFrame[];
+/**
+ * Correlation core for any "send a request, await a chunked response" channel.
+ *
+ * Key-agnostic so both the orchestrator-agent channel (keyed by requestId) and
+ * the peer channel (keyed by messageId) share one implementation. Pending
+ * requests reject on timeout, on an error frame, or on disconnect. No
+ * orchestrator-initiated request/response primitive existed before fleet
+ * collection; this is it.
+ */
+export declare class ChunkRequestWaiter {
+    private pending;
+    /** Register a pending request `id` that rejects after `timeoutMs`. */
+    add(id: string, timeoutMs: number): Promise<Buffer>;
+    /** Accumulate a chunk; resolves the pending request on the final frame. */
+    onChunk(id: string, seq: number, dataB64: string, isLast: boolean): void;
+    /** Reject the pending request `id` with `message`. */
+    onError(id: string, message: string): void;
+    /** Reject every pending request — used when the underlying connection drops. */
+    rejectAll(reason: string): void;
+}
+/** Reassembles ordered frames into a Buffer. Throws on gaps/reordering. */
+export declare class BundleChunkAssembler {
+    private parts;
+    private next;
+    private done;
+    /** Returns the assembled Buffer on the final frame, otherwise undefined. */
+    accept(seq: number, dataB64: string, isLast: boolean): Buffer | undefined;
+}
+//# sourceMappingURL=bundle-chunks.d.ts.map

package/dist/diagnostics/bundle-chunks.js

@@ -0,0 +1,111 @@
+import "../chunk-gOLHoazu.js";
+//#region src/diagnostics/bundle-chunks.ts
+/**
+* Channel-agnostic chunked transfer for fleet bundle ZIPs.
+*
+* The WS frame cap (WS_MAX_PAYLOAD_BYTES = 25 MiB) forbids shipping a whole
+* bundle in one frame, so a bundle Buffer is split into ordered base64 frames
+* (~85 KiB raw each, matching the webhook-relay frame size) and reassembled by
+* the receiver. Used on both the orchestrator-agent and peer channels.
+*/
+/** Raw bytes per chunk before base64 (matches webhook-relay's ~85 KiB frames). */
+const FLEET_CHUNK_BYTES = 85 * 1024;
+/** Split a Buffer into ordered base64 frames. An empty buffer yields one final frame. */
+function chunkBuffer(buf, chunkBytes = FLEET_CHUNK_BYTES) {
+	const frames = [];
+	if (buf.length === 0) return [{
+		seq: 0,
+		dataB64: "",
+		isLast: true
+	}];
+	for (let offset = 0, seq = 0; offset < buf.length; offset += chunkBytes, seq++) {
+		const slice = buf.subarray(offset, Math.min(offset + chunkBytes, buf.length));
+		frames.push({
+			seq,
+			dataB64: slice.toString("base64"),
+			isLast: offset + chunkBytes >= buf.length
+		});
+	}
+	return frames;
+}
+/**
+* Correlation core for any "send a request, await a chunked response" channel.
+*
+* Key-agnostic so both the orchestrator-agent channel (keyed by requestId) and
+* the peer channel (keyed by messageId) share one implementation. Pending
+* requests reject on timeout, on an error frame, or on disconnect. No
+* orchestrator-initiated request/response primitive existed before fleet
+* collection; this is it.
+*/
+var ChunkRequestWaiter = class {
+	pending = /* @__PURE__ */ new Map();
+	/** Register a pending request `id` that rejects after `timeoutMs`. */
+	add(id, timeoutMs) {
+		return new Promise((resolve, reject) => {
+			const timer = setTimeout(() => {
+				this.pending.delete(id);
+				reject(/* @__PURE__ */ new Error(`chunk request ${id} timed out after ${timeoutMs}ms`));
+			}, timeoutMs);
+			this.pending.set(id, {
+				asm: new BundleChunkAssembler(),
+				resolve,
+				reject,
+				timer
+			});
+		});
+	}
+	/** Accumulate a chunk; resolves the pending request on the final frame. */
+	onChunk(id, seq, dataB64, isLast) {
+		const p = this.pending.get(id);
+		if (!p) return;
+		try {
+			const done = p.asm.accept(seq, dataB64, isLast);
+			if (done) {
+				clearTimeout(p.timer);
+				this.pending.delete(id);
+				p.resolve(done);
+			}
+		} catch (err) {
+			clearTimeout(p.timer);
+			this.pending.delete(id);
+			p.reject(err instanceof Error ? err : new Error(String(err)));
+		}
+	}
+	/** Reject the pending request `id` with `message`. */
+	onError(id, message) {
+		const p = this.pending.get(id);
+		if (!p) return;
+		clearTimeout(p.timer);
+		this.pending.delete(id);
+		p.reject(new Error(message));
+	}
+	/** Reject every pending request — used when the underlying connection drops. */
+	rejectAll(reason) {
+		for (const [, p] of this.pending) {
+			clearTimeout(p.timer);
+			p.reject(new Error(reason));
+		}
+		this.pending.clear();
+	}
+};
+/** Reassembles ordered frames into a Buffer. Throws on gaps/reordering. */
+var BundleChunkAssembler = class {
+	parts = [];
+	next = 0;
+	done = false;
+	/** Returns the assembled Buffer on the final frame, otherwise undefined. */
+	accept(seq, dataB64, isLast) {
+		if (this.done) throw new Error("bundle chunk received after final frame");
+		if (seq !== this.next) throw new Error(`out-of-order bundle chunk: expected ${this.next}, got ${seq}`);
+		this.next++;
+		this.parts.push(Buffer.from(dataB64, "base64"));
+		if (isLast) {
+			this.done = true;
+			return Buffer.concat(this.parts);
+		}
+	}
+};
+//#endregion
+export { BundleChunkAssembler, ChunkRequestWaiter, FLEET_CHUNK_BYTES, chunkBuffer };
+
+//# sourceMappingURL=bundle-chunks.js.map

package/dist/diagnostics/bundle-chunks.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=bundle-chunks.test.d.ts.map

package/dist/index.d.ts

@@ -1,5 +1,7 @@
 export * from '@kici-dev/core';
 export { RingBuffer } from './ring-buffer.js';
+export { redactConfig, addLogsToArchive, MAX_LOG_BYTES } from './diagnostics/bundle-archive.js';
+export { chunkBuffer, BundleChunkAssembler, ChunkRequestWaiter, FLEET_CHUNK_BYTES, type BundleChunkFrame, } from './diagnostics/bundle-chunks.js';
 export { createPool, createDb, type CreatePoolOptions, type PgPoolErrorSource } from './db.js';
 export { parseDatabaseUrl, maskDatabaseUrl, dropAndCreateDatabase, dropDatabaseDirect, ensureDatabase, type EnsureDatabaseOpts, createDbRole, createReadOnlyDbUser, computeMigrationsHash, storeMigrationContentHash, readStoredMigrationContentHash, isSchemaCurrent, clearDispatchQueueDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, purgeScopedSecretsDirect, seedEnvironmentDirect, deleteEnvironmentDirect, seedEnvironmentBindingDirect, setEnvironmentPolicyDirect, listEnvironmentsDirect, showEnvironmentDirect, createEnvironmentTemplateDirect, setEnvironmentSecretDirect, listQueueDirect, showQueueEntryDirect, listExecutionRunsDirect, showExecutionRunDirect, listExecutionJobsDirect, listRegistrationsDirect, showRegistrationDirect, registerWorkflowManualDirect, resetRaftStateDirect, emitKiciEventDirect, seedGenericWebhookSourceDirect, purgeSecretBackendsDirect, apiKeyExistsDirect, seedApiKeyInlineDirect, platformConnectionExistsDirect, countWebhookSourcesByConnectionIdDirect, getWebhookSourceByRoutingKeyDirect, findAnyUserApiKeyIdDirect, seedSyntheticGithubSourceDirect, seedWebhookSecretDirect, seedSourcePrivateKeyDirect, bumpRegistryVersionDirect, pollKiciEventsDirect, waitForPostgresDirect, waitForRunCompletionDirect, cleanupExecutionRowsDirect, isSchemaCurrentFromFilesDirect, storeMigrationContentHashInTableDirect, createJoinTokenDirect, updateSourceRoutingKeyDirect, prunePeerCredentialsDirect, waitForPlatformRegistrationsDirect, seedUniversalGitSourceDirect, seedCiSecurityFixturesDirect, waitForExecutionRunStatusSinceDirect, latestExecutionRunByStatusDirect, waitForLatestExecutionJobStatusDirect, describeTableColumnsDirect, tableExistsDirect, insertKiciEventRawDirect, showKiciEventDirect, listKiciEventsDirect, deleteKiciEventsDirect, verifyKiciEventNotifyDirect, seedCrossRepoTrustDirect, listCrossRepoTrustBySourceRoutingKeyDirect, deleteCrossRepoTrustDirect, insertCrossRepoTrustStrictDirect, deleteWorkflowRegistrationsDirect, getWorkflowRegistrationByIdDirect, listRegistrationsByRoutingKeyDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, updateWorkflowRegistrationCommitShaDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, getRegistryVersionDirect, bumpRegistryVersionSimpleDirect, upsertCronLastFiredDirect, countCronLastFiredDirect, insertCronLastFiredNowDirect, deleteCronLastFiredDirect, deleteExecutionRunsByWorkflowNameDirect, getGenericWebhookSourceByRoutingKeyDirect, listActiveGenericWebhookSourcesDirect, updateGenericWebhookVerificationConfigDirect, deleteGenericWebhookSourcesByNameDirect, restoreSoftDeletedGenericWebhookSourceDirect, upsertOrgSettingsGlobalWorkflowsDirect, updateOrgSettingsDeniedReposDirect, deleteOrgSettingsByCustomerIdDirect, getExecutionRunSecurityDirect, getHeldRunByIdDirect, countHeldRunsByRunIdDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForEventLogRowByDeliveryIdDirect, resolvePlatformWebhookSourceRoutingKeyDirect, ensureOrgOwnerMemberDirect, deletePeerCredentialsByInstanceIdLikeDirect, insertPeerCredentialExpiredDirect, getPeerCredentialRevokedAtDirect, listActivePeerCredentialsExcludingDirect, clearPeerCredentialsRevokedAtByIdsDirect, countActivePeerCredentialsByInstanceDirect, terminateIdleDbBackendsDirect, type ColumnInfo, type KiciEventRow, type CrossRepoTrustRow, type WorkflowRegistrationFullRow, type RegistrationsScopedResult, type LatestExecutionRunResult, type WaitForLatestJobResult, type ExecutionRunSecurityRow, type HeldRunSecurityRow, type EventLogRow as PlatformEventLogRow, type UpsertOrgSettingsOpts, type OrgSettingsRepoPatternEntry, type InsertKiciEventRawOpts, type EmitKiciEventOpts, type SeedGenericWebhookSourceOpts, REGISTERABLE_TRIGGER_TYPES, MIGRATION_HASH_TABLE, type PurgeStaleExecutionResult, type PurgeStaleSourcesResult, type SeedEnvironmentOpts, type SeedEnvironmentResult, type SeedEnvironmentBindingOpts, type SetEnvironmentPolicyOpts, type EnvironmentRow, type EnvironmentVariableRow, type EnvironmentBindingRow, type ShowEnvironmentResult, type CreateEnvironmentTemplateOpts, type SetEnvironmentSecretOpts, type DispatchQueueRow, type ListQueueOpts, type ExecutionRunRow, type ExecutionJobRow, type ListExecutionRunsOpts, type WorkflowRegistrationRow, type ListRegistrationsOpts, type ListRegistrationsResult, type ShowRegistrationResult, type RegisterWorkflowManualOpts, type RegisterWorkflowManualResult, } from './db-admin.js';
 export { createMetricsRoutes, type MetricsRoutesDeps } from './routes/metrics.js';

package/dist/index.js

@@ -3,6 +3,8 @@ import { createDb, createPool } from "./db.js";
 import { MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createDbRole, createEnvironmentTemplateDirect, createJoinTokenDirect, createReadOnlyDbUser, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteEnvironmentDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listEnvironmentsDirect, listExecutionJobsDirect, listExecutionRunsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedCrossRepoTrustDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, showEnvironmentDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect } from "./db-admin.js";
 import { setupGracefulShutdown } from "./graceful-shutdown.js";
 import { RingBuffer } from "./ring-buffer.js";
+import { MAX_LOG_BYTES, addLogsToArchive, redactConfig } from "./diagnostics/bundle-archive.js";
+import { BundleChunkAssembler, ChunkRequestWaiter, FLEET_CHUNK_BYTES, chunkBuffer } from "./diagnostics/bundle-chunks.js";
 import { createMetricsRoutes } from "./routes/metrics.js";
 import { createHealthRoutes } from "./routes/health.js";
 import { getReconnectDelay } from "./reconnect-delay.js";
@@ -22,4 +24,4 @@ import { ChunkLru } from "./cold-store/lru.js";
 import { DEFAULT_TABLE_CONFIG, resolveTableConfig } from "./cold-store/config.js";
 import "./cold-store/index.js";
 export * from "@kici-dev/core";
-export { BaseColdStore, COLD_BUCKET_NAMES, ChunkLru, DEFAULT_TABLE_CONFIG, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, RingBuffer, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, chunkObjectKey, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, coldDaysToBucket, coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal, collectRuntimeMetricNames, computeChunkId, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createDb, createDbRole, createEnvironmentTemplateDirect, createHealthRoutes, createJoinTokenDirect, createMeter, createMetricsRoutes, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteEnvironmentDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, encodeChunk, encodeKeySegment, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getPrometheusExporter, getReconnectDelay, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, initTelemetry, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isLongerColdRetention, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listEnvironmentsDirect, listExecutionJobsDirect, listExecutionRunsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, parseManifest, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, resolveTableConfig, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedCrossRepoTrustDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, serializeManifest, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, setupGracefulShutdown, showEnvironmentDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, validateRequiredTools, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };
+export { BaseColdStore, BundleChunkAssembler, COLD_BUCKET_NAMES, ChunkLru, ChunkRequestWaiter, DEFAULT_TABLE_CONFIG, FLEET_CHUNK_BYTES, MAX_LOG_BYTES, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, RingBuffer, addLogsToArchive, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, chunkBuffer, chunkObjectKey, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, coldDaysToBucket, coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal, collectRuntimeMetricNames, computeChunkId, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createDb, createDbRole, createEnvironmentTemplateDirect, createHealthRoutes, createJoinTokenDirect, createMeter, createMetricsRoutes, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteEnvironmentDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, encodeChunk, encodeKeySegment, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getPrometheusExporter, getReconnectDelay, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, initTelemetry, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isLongerColdRetention, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listEnvironmentsDirect, listExecutionJobsDirect, listExecutionRunsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, parseManifest, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, redactConfig, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, resolveTableConfig, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedCrossRepoTrustDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, serializeManifest, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, setupGracefulShutdown, showEnvironmentDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, validateRequiredTools, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/shared",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
   "keywords": [
     "ci",
@@ -81,6 +81,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1038.0",
+    "archiver": "^7.0.1",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/exporter-metrics-otlp-http": "^0.217.0",
     "@opentelemetry/exporter-prometheus": "^0.217.0",
@@ -100,10 +101,11 @@
     "yaml": "^2.8.3",
     "zod": "^4.3.6",
     "zx": "^8.8.5",
-    "@kici-dev/core": "0.1.15"
+    "@kici-dev/core": "0.1.16"
   },
   "devDependencies": {
     "@opentelemetry/sdk-trace-base": "^2.7.0",
+    "@types/archiver": "^7.0.0",
     "@types/diff": "^7.0.0"
   },
   "scripts": {