@kici-dev/shared 0.5.0 → 0.6.1

package/dist/db.js

@@ -76,7 +76,8 @@ function isPoolAcquireTimeout(err) {
 * its own schema type (e.g., orchestrator Database vs Platform Database).
 */
 function createDb(pool) {
-	return new Kysely({ dialect: new PostgresDialect({ pool }) });
+	const dialect = new PostgresDialect({ pool });
+	return new Kysely({ dialect });
 }
 //#endregion
 export { createDb, createPool, isPoolAcquireTimeout };

package/dist/diagnostics/bundle-archive.d.ts

@@ -1,19 +1,17 @@
 /**
  * Shared debug-bundle archive primitives.
  *
- * Allowlist config redaction and windowed log-file archiving, used by the
- * orchestrator's in-process bundle writer, the kici-admin CLI's local bundle,
- * and the agent's fleet mini-bundle assembler. Keeping one copy means a node
- * cannot drift from the redaction posture of its peers.
+ * Windowed log-file archiving, used by the orchestrator's in-process bundle
+ * writer, the kici-admin CLI's local bundle, and the agent's fleet mini-bundle
+ * assembler. Keeping one copy means a node cannot drift from the archiving
+ * posture of its peers.
+ *
+ * The redaction primitives it applies live in `@kici-dev/core` so the `kici`
+ * CLI can reuse them without importing this package.
  */
 import type { Archiver } from 'archiver';
 /** Maximum total log bytes to include in bundle (50MB). */
 export declare const MAX_LOG_BYTES: number;
-/**
- * Redact config values using allowlist approach.
- * Only known-safe fields are preserved; everything else becomes "****".
- */
-export declare function redactConfig(obj: unknown, parentKey?: string): unknown;
 /**
  * Add log files from logDir to the archive, respecting MAX_LOG_BYTES cap
  * and the logWindow time filter. Matches any `*.log` file in the directory,

package/dist/diagnostics/bundle-archive.js

@@ -1,94 +1,21 @@
 import "../rolldown-runtime-ClRpJifh.js";
+import { scrubText } from "@kici-dev/core";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
 //#region src/diagnostics/bundle-archive.ts
 /**
 * Shared debug-bundle archive primitives.
 *
-* Allowlist config redaction and windowed log-file archiving, used by the
-* orchestrator's in-process bundle writer, the kici-admin CLI's local bundle,
-* and the agent's fleet mini-bundle assembler. Keeping one copy means a node
-* cannot drift from the redaction posture of its peers.
+* Windowed log-file archiving, used by the orchestrator's in-process bundle
+* writer, the kici-admin CLI's local bundle, and the agent's fleet mini-bundle
+* assembler. Keeping one copy means a node cannot drift from the archiving
+* posture of its peers.
+*
+* The redaction primitives it applies live in `@kici-dev/core` so the `kici`
+* CLI can reuse them without importing this package.
 */
 /** Maximum total log bytes to include in bundle (50MB). */
-const MAX_LOG_BYTES = 50 * 1024 * 1024;
-/**
-* Config field names that are safe to include unredacted.
-* Everything else gets replaced with "****".
-*/
-const SAFE_CONFIG_KEYS = /* @__PURE__ */ new Set([
-	"mode",
-	"host",
-	"port",
-	"logLevel",
-	"region",
-	"environment",
-	"name",
-	"label",
-	"labels",
-	"enabled",
-	"disabled",
-	"timeout",
-	"interval",
-	"maxRetries",
-	"retries",
-	"workers",
-	"concurrency",
-	"maxConcurrency",
-	"batchSize",
-	"bufferSize",
-	"warmPool",
-	"cooldown",
-	"type",
-	"provider",
-	"scaler",
-	"driver",
-	"backend",
-	"protocol",
-	"scheme",
-	"path",
-	"basePath",
-	"metricsPath",
-	"healthPath",
-	"logFormat",
-	"logFile",
-	"logDir",
-	"dataDir",
-	"version",
-	"debug",
-	"verbose",
-	"quiet",
-	"tls",
-	"cors",
-	"rateLimiting",
-	"maxConnections",
-	"poolSize",
-	"minPool",
-	"maxPool",
-	"idleTimeout",
-	"connectTimeout",
-	"requestTimeout",
-	"shutdownTimeout",
-	"gracefulShutdown"
-]);
-/**
-* Redact config values using allowlist approach.
-* Only known-safe fields are preserved; everything else becomes "****".
-*/
-function redactConfig(obj, parentKey) {
-	if (obj === null || obj === void 0) return obj;
-	if (Array.isArray(obj)) return obj.map((item) => redactConfig(item, parentKey));
-	if (typeof obj === "object") {
-		const result = {};
-		for (const [key, value] of Object.entries(obj)) result[key] = redactConfig(value, key);
-		return result;
-	}
-	if (typeof obj === "string" && parentKey && !SAFE_CONFIG_KEYS.has(parentKey)) return "****";
-	if (typeof obj === "number" || typeof obj === "boolean") return obj;
-	if (typeof obj === "string" && parentKey && SAFE_CONFIG_KEYS.has(parentKey)) return obj;
-	if (typeof obj === "string") return "****";
-	return obj;
-}
+const MAX_LOG_BYTES = 52428800;
 /**
 * Add log files from logDir to the archive, respecting MAX_LOG_BYTES cap
 * and the logWindow time filter. Matches any `*.log` file in the directory,
@@ -117,9 +44,9 @@ async function addLogsToArchive(archive, logDir, logWindowHours) {
 		const filePath = path$1.join(logDir, entry);
 		const stat = fs.statSync(filePath);
 		if (totalBytes + stat.size > 52428800) break;
-		const content = fs.readFileSync(filePath, "utf-8");
+		const content = scrubText(fs.readFileSync(filePath, "utf-8"));
 		archive.append(content, { name: `logs/${entry}` });
-		totalBytes += stat.size;
+		totalBytes += Buffer.byteLength(content, "utf-8");
 		const lines = content.split("\n");
 		totalLines += lines.length;
 		for (const line of lines) {
@@ -136,6 +63,6 @@ async function addLogsToArchive(archive, logDir, logWindowHours) {
 	archive.append(JSON.stringify(summary, null, 2), { name: "logs/summary.json" });
 }
 //#endregion
-export { MAX_LOG_BYTES, addLogsToArchive, redactConfig };
+export { MAX_LOG_BYTES, addLogsToArchive };
 
 //# sourceMappingURL=bundle-archive.js.map

package/dist/diagnostics/bundle-chunks.js

@@ -9,7 +9,7 @@ import "../rolldown-runtime-ClRpJifh.js";
 * the receiver. Used on both the orchestrator-agent and peer channels.
 */
 /** Raw bytes per chunk before base64 (matches webhook-relay's ~85 KiB frames). */
-const FLEET_CHUNK_BYTES = 85 * 1024;
+const FLEET_CHUNK_BYTES = 87040;
 /** Split a Buffer into ordered base64 frames. An empty buffer yields one final frame. */
 function chunkBuffer(buf, chunkBytes = FLEET_CHUNK_BYTES) {
 	const frames = [];

package/dist/env/define-env.d.ts

@@ -112,12 +112,13 @@ export declare function defineEnv<TShape extends z.ZodRawShape>(opts: DefineEnvO
  *   `hack/lib/commit-build-counter.mjs` (skip the per-build `.build-counter`
  *   commit on a force-synced checkout, e.g. a remote E2E executor). Set in the
  *   ambient shell for `pnpm build`; the native orchestrator spawn inherits it.
- * - `KICI_TEST_ISOLATION`: the test-isolation marker set at config-eval time
- *   by every vitest config in this repository (`hack/lib/vitest-isolation.ts`,
- *   enforced by `hack/check-vitest-isolation.ts`). It makes the CLI's
- *   `getConfigDir` refuse the developer machine's ambient `~/.kici` config, and
- *   it is inherited by every service a test spawns — same leak-by-inheritance
- *   shape as the `KICI_E2E_` prefix below.
+ * - `KICI_CONFIG_DIR`: the isolated, empty config directory the vitest harness
+ *   sets at config-eval time (`hack/lib/vitest-isolation.ts`, enforced by
+ *   `hack/check-vitest-isolation.ts`) so the CLI's `getConfigDir` reads a
+ *   throwaway dir instead of the developer machine's ambient `~/.kici`. It is a
+ *   real CLI var (not a config typo) inherited by every service a test spawns —
+ *   which do not read it — same leak-by-inheritance shape as the `KICI_E2E_`
+ *   prefix below.
  *
  * Keep this list small and well-justified. Every addition is a typo we can
  * no longer catch, so only list things that are (a) actually set in the

package/dist/env/define-env.js

@@ -231,12 +231,13 @@ function suggestClosest(name, candidates) {
 *   `hack/lib/commit-build-counter.mjs` (skip the per-build `.build-counter`
 *   commit on a force-synced checkout, e.g. a remote E2E executor). Set in the
 *   ambient shell for `pnpm build`; the native orchestrator spawn inherits it.
-* - `KICI_TEST_ISOLATION`: the test-isolation marker set at config-eval time
-*   by every vitest config in this repository (`hack/lib/vitest-isolation.ts`,
-*   enforced by `hack/check-vitest-isolation.ts`). It makes the CLI's
-*   `getConfigDir` refuse the developer machine's ambient `~/.kici` config, and
-*   it is inherited by every service a test spawns — same leak-by-inheritance
-*   shape as the `KICI_E2E_` prefix below.
+* - `KICI_CONFIG_DIR`: the isolated, empty config directory the vitest harness
+*   sets at config-eval time (`hack/lib/vitest-isolation.ts`, enforced by
+*   `hack/check-vitest-isolation.ts`) so the CLI's `getConfigDir` reads a
+*   throwaway dir instead of the developer machine's ambient `~/.kici`. It is a
+*   real CLI var (not a config typo) inherited by every service a test spawns —
+*   which do not read it — same leak-by-inheritance shape as the `KICI_E2E_`
+*   prefix below.
 *
 * Keep this list small and well-justified. Every addition is a typo we can
 * no longer catch, so only list things that are (a) actually set in the
@@ -246,7 +247,7 @@ const RESERVED_NON_SCHEMA_KICI_VARS = [
 	"KICI_CACHE",
 	"KICI_DEV",
 	"KICI_BUILD_COUNTER_NO_COMMIT",
-	"KICI_TEST_ISOLATION"
+	"KICI_CONFIG_DIR"
 ];
 /**
 * `KICI_*` prefixes that are entirely outside the service-config namespace —

package/dist/graceful-shutdown.d.ts

@@ -44,8 +44,12 @@ export interface GracefulShutdownOptions {
  * trigger shutdown programmatically (e.g., from SIGUSR1 drain handlers).
  */
 export interface ShutdownHandle {
-    /** Trigger shutdown with the given reason string. */
-    shutdown(signal: string): Promise<void>;
+    /**
+     * Trigger shutdown with the given reason string. Pass a non-zero `code` for a
+     * deliberate-but-failed stop (e.g. a one-shot agent whose self-bootstrap claim
+     * was rejected) so the process exits non-zero; omit it for a clean stop.
+     */
+    shutdown(signal: string, code?: number): Promise<void>;
 }
 /**
  * Wire up SIGTERM / SIGINT (and optionally uncaughtException /

package/dist/graceful-shutdown.js

@@ -77,7 +77,7 @@ function setupGracefulShutdown(options) {
 			gracefulShutdown("unhandledRejection", 1);
 		});
 	}
-	return { shutdown: (signal) => gracefulShutdown(signal) };
+	return { shutdown: (signal, code = 0) => gracefulShutdown(signal, code) };
 }
 //#endregion
 export { setupGracefulShutdown };

package/dist/idempotency-files.js

@@ -195,7 +195,8 @@ function renderEnvDiffBody(entry, opts) {
 	const local = entry.localContent ?? "";
 	const remote = entry.category === "new" ? "" : entry.remoteContent ?? "";
 	if (local === "" && remote === "" && entry.category !== "new") return [];
-	return renderEnvDiff(diffEnvFiles(local, remote), {
+	const diff = diffEnvFiles(local, remote);
+	return renderEnvDiff(diff, {
 		reveal: opts.revealEnvValues ?? false,
 		color: opts.color ?? false
 	});

package/dist/index.d.ts

@@ -2,11 +2,11 @@ export * from '@kici-dev/core';
 export * from './agent-platform.js';
 export { encrypt, decrypt, deriveKey, generateMasterKey, type EncryptedValue, } from './secret-crypto.js';
 export { RingBuffer } from './ring-buffer.js';
-export { redactConfig, addLogsToArchive, MAX_LOG_BYTES } from './diagnostics/bundle-archive.js';
+export { addLogsToArchive, MAX_LOG_BYTES } from './diagnostics/bundle-archive.js';
 export { chunkBuffer, BundleChunkAssembler, ChunkRequestWaiter, FLEET_CHUNK_BYTES, type BundleChunkFrame, } from './diagnostics/bundle-chunks.js';
 export { createPool, createDb, isPoolAcquireTimeout, type CreatePoolOptions, type PgPoolErrorSource, type PoolAcquireOutcome, } from './db.js';
 export { isPgUniqueViolation } from './pg-errors.js';
-export { parseDatabaseUrl, maskDatabaseUrl, dropAndCreateDatabase, dropDatabaseDirect, ensureDatabase, type EnsureDatabaseOpts, createDbRole, createReadOnlyDbUser, computeMigrationsHash, storeMigrationContentHash, readStoredMigrationContentHash, isSchemaCurrent, clearDispatchQueueDirect, clearScalerStateDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, purgeScopedSecretsDirect, purgeContextsDirect, seedContextDirect, deleteContextDirect, seedContextBindingDirect, setContextPolicyDirect, listContextsDirect, showContextDirect, createContextTemplateDirect, setContextSecretDirect, listQueueDirect, showQueueEntryDirect, listExecutionRunsDirect, showExecutionRunDirect, listCheckRunTrackingDirect, listExecutionJobsDirect, listRegistrationsDirect, showRegistrationDirect, registerWorkflowManualDirect, resetRaftStateDirect, emitKiciEventDirect, seedGenericWebhookSourceDirect, purgeSecretBackendsDirect, apiKeyExistsDirect, seedApiKeyInlineDirect, platformConnectionExistsDirect, countWebhookSourcesByConnectionIdDirect, getWebhookSourceByRoutingKeyDirect, findAnyUserApiKeyIdDirect, seedSyntheticGithubSourceDirect, seedWebhookSecretDirect, seedSourcePrivateKeyDirect, bumpRegistryVersionDirect, pollKiciEventsDirect, waitForPostgresDirect, waitForRunCompletionDirect, cleanupExecutionRowsDirect, isSchemaCurrentFromFilesDirect, storeMigrationContentHashInTableDirect, createJoinTokenDirect, deleteJoinTokensByCreatedByDirect, updateSourceRoutingKeyDirect, prunePeerCredentialsDirect, waitForPlatformRegistrationsDirect, seedUniversalGitSourceDirect, seedCiSecurityFixturesDirect, CI_SECURITY_OTHER_REPO, waitForExecutionRunReachesStatusSinceDirect, latestExecutionRunByStatusDirect, waitForLatestExecutionJobStatusDirect, describeTableColumnsDirect, tableExistsDirect, insertKiciEventRawDirect, showKiciEventDirect, listKiciEventsDirect, deleteKiciEventsDirect, insertKiciEventAtDirect, paginateUnprocessedEventsKeysetDirect, verifyKiciEventNotifyDirect, seedCrossRepoTrustDirect, listCrossRepoTrustBySourceRoutingKeyDirect, deleteCrossRepoTrustDirect, insertCrossRepoTrustStrictDirect, deleteWorkflowRegistrationsDirect, getWorkflowRegistrationByIdDirect, listRegistrationsByRoutingKeyDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, updateWorkflowRegistrationCommitShaDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, getRegistryVersionDirect, bumpRegistryVersionSimpleDirect, upsertCronLastFiredDirect, countCronLastFiredDirect, insertCronLastFiredNowDirect, deleteCronLastFiredDirect, deleteExecutionRunsByWorkflowNameDirect, getGenericWebhookSourceByRoutingKeyDirect, listActiveGenericWebhookSourcesDirect, updateGenericWebhookVerificationConfigDirect, deleteGenericWebhookSourcesByNameDirect, restoreSoftDeletedGenericWebhookSourceDirect, upsertOrgSettingsGlobalWorkflowsDirect, setClusterGlobalWorkflowsEnabledDirect, updateOrgSettingsDeniedReposDirect, deleteOrgSettingsByCustomerIdDirect, getExecutionRunSecurityDirect, getHeldRunByIdDirect, listHeldRunApprovalsDirect, countHeldRunsByRunIdDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForEventLogRowByDeliveryIdDirect, resolvePlatformWebhookSourceRoutingKeyDirect, ensureOrgOwnerMemberDirect, deletePeerCredentialsByInstanceIdLikeDirect, insertPeerCredentialExpiredDirect, getPeerCredentialRevokedAtDirect, listActivePeerCredentialsExcludingDirect, clearPeerCredentialsRevokedAtByIdsDirect, countActivePeerCredentialsByInstanceDirect, terminateIdleDbBackendsDirect, type ColumnInfo, type KiciEventRow, type CrossRepoTrustRow, type WorkflowRegistrationFullRow, type RegistrationsScopedResult, type LatestExecutionRunResult, type WaitForLatestJobResult, type ExecutionRunSecurityRow, type HeldRunSecurityRow, type EventLogRow as PlatformEventLogRow, type UpsertOrgSettingsOpts, type OrgSettingsRepoPatternEntry, type InsertKiciEventRawOpts, type EmitKiciEventOpts, type SeedGenericWebhookSourceOpts, REGISTERABLE_TRIGGER_TYPES, MIGRATION_HASH_TABLE, type PurgeStaleExecutionResult, type PurgeStaleSourcesResult, type SeedContextOpts, type SeedContextResult, type SeedContextBindingOpts, type SetContextPolicyOpts, type ContextRow, type ContextVariableRow, type ContextBindingRow, type ShowContextResult, type CreateContextTemplateOpts, type SetContextSecretOpts, type DispatchQueueRow, type ListQueueOpts, type ExecutionRunRow, type ExecutionJobRow, type ListExecutionRunsOpts, type CheckRunTrackingDirectRow, type ListCheckRunTrackingOpts, type WorkflowRegistrationRow, type ListRegistrationsOpts, type ListRegistrationsResult, type ShowRegistrationResult, type RegisterWorkflowManualOpts, type RegisterWorkflowManualResult, } from './db-admin.js';
+export { parseDatabaseUrl, maskDatabaseUrl, dropAndCreateDatabase, ensureDatabase, type EnsureDatabaseOpts, createDbRole, createReadOnlyDbUser, computeMigrationsHash, storeMigrationContentHash, readStoredMigrationContentHash, isSchemaCurrent, clearDispatchQueueDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, purgeScopedSecretsDirect, purgeContextsDirect, seedContextDirect, deleteContextDirect, seedContextBindingDirect, setContextPolicyDirect, listContextsDirect, showContextDirect, createContextTemplateDirect, setContextSecretDirect, listQueueDirect, showQueueEntryDirect, listExecutionRunsDirect, showExecutionRunDirect, listCheckRunTrackingDirect, listRegistrationsDirect, showRegistrationDirect, registerWorkflowManualDirect, resetRaftStateDirect, emitKiciEventDirect, purgeSecretBackendsDirect, prunePeerCredentialsDirect, type EventLogRow as PlatformEventLogRow, type OrgSettingsRepoPatternEntry, type EmitKiciEventOpts, REGISTERABLE_TRIGGER_TYPES, MIGRATION_HASH_TABLE, type PurgeStaleExecutionResult, type PurgeStaleSourcesResult, type SeedContextOpts, type SeedContextResult, type SeedContextBindingOpts, type SetContextPolicyOpts, type ContextRow, type ContextVariableRow, type ContextBindingRow, type ShowContextResult, type CreateContextTemplateOpts, type SetContextSecretOpts, type DispatchQueueRow, type ListQueueOpts, type ExecutionRunRow, type ExecutionJobRow, type ListExecutionRunsOpts, type CheckRunTrackingDirectRow, type ListCheckRunTrackingOpts, type WorkflowRegistrationRow, type ListRegistrationsOpts, type ListRegistrationsResult, type ShowRegistrationResult, type RegisterWorkflowManualOpts, type RegisterWorkflowManualResult, } from './db-admin.js';
 export { createMetricsRoutes, type MetricsRoutesDeps } from './routes/metrics.js';
 export { createHealthRoutes, type HealthRoutesDeps } from './routes/health.js';
 export { getReconnectDelay } from './reconnect-delay.js';

package/dist/index.js

@@ -1,11 +1,11 @@
 import "./rolldown-runtime-ClRpJifh.js";
 import { AgentDeliveryMode, AgentPlatform, splitAgentPlatform } from "./agent-platform.js";
 import { createDb, createPool, isPoolAcquireTimeout } from "./db.js";
-import { CI_SECURITY_OTHER_REPO, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, clearScalerStateDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createContextTemplateDirect, createDbRole, createJoinTokenDirect, createReadOnlyDbUser, deleteContextDirect, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCheckRunTrackingDirect, listContextsDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedContextBindingDirect, seedContextDirect, seedCrossRepoTrustDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setClusterGlobalWorkflowsEnabledDirect, setContextPolicyDirect, setContextSecretDirect, showContextDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunReachesStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect } from "./db-admin.js";
+import { MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, clearDispatchQueueDirect, computeMigrationsHash, createContextTemplateDirect, createDbRole, createReadOnlyDbUser, deleteContextDirect, dropAndCreateDatabase, emitKiciEventDirect, ensureDatabase, isSchemaCurrent, listCheckRunTrackingDirect, listContextsDirect, listExecutionRunsDirect, listQueueDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, seedContextBindingDirect, seedContextDirect, setContextPolicyDirect, setContextSecretDirect, showContextDirect, showExecutionRunDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash } from "./db-admin.js";
 import { setupGracefulShutdown } from "./graceful-shutdown.js";
 import { decrypt, deriveKey, encrypt, generateMasterKey } from "./secret-crypto.js";
 import { RingBuffer } from "./ring-buffer.js";
-import { MAX_LOG_BYTES, addLogsToArchive, redactConfig } from "./diagnostics/bundle-archive.js";
+import { MAX_LOG_BYTES, addLogsToArchive } from "./diagnostics/bundle-archive.js";
 import { BundleChunkAssembler, ChunkRequestWaiter, FLEET_CHUNK_BYTES, chunkBuffer } from "./diagnostics/bundle-chunks.js";
 import { isPgUniqueViolation } from "./pg-errors.js";
 import { createMetricsRoutes } from "./routes/metrics.js";
@@ -28,4 +28,4 @@ import { BaseColdStore } from "./cold-store/cold-store.js";
 import { ChunkLru } from "./cold-store/lru.js";
 import "./cold-store/index.js";
 export * from "@kici-dev/core";
-export { AgentDeliveryMode, AgentPlatform, BaseColdStore, BundleChunkAssembler, CI_SECURITY_OTHER_REPO, COLD_BUCKET_NAMES, ChunkLru, ChunkRequestWaiter, DEFAULT_TABLE_CONFIG, FLEET_CHUNK_BYTES, MAX_LOG_BYTES, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, RingBuffer, addLogsToArchive, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, chunkBuffer, chunkObjectKey, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, clearScalerStateDirect, coldDaysToBucket, coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal, collectRuntimeMetricNames, computeChunkId, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createContextTemplateDirect, createDb, createDbRole, createHealthRoutes, createJoinTokenDirect, createMeter, createMetricsRoutes, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, decrypt, deleteContextDirect, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, deriveKey, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, encodeChunk, encodeKeySegment, encrypt, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, generateMasterKey, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getPrometheusExporter, getReconnectDelay, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, initTelemetry, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isLongerColdRetention, isPgUniqueViolation, isPoolAcquireTimeout, isSchemaCurrent, isSchemaCurrentFromFilesDirect, kiciMkdtemp, kiciTmpBase, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCheckRunTrackingDirect, listContextsDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, parseManifest, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, redactConfig, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, resolveTableConfig, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedContextBindingDirect, seedContextDirect, seedCrossRepoTrustDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, serializeManifest, setClusterGlobalWorkflowsEnabledDirect, setContextPolicyDirect, setContextSecretDirect, setupGracefulShutdown, showContextDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, splitAgentPlatform, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, validateRequiredTools, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunReachesStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };
+export { AgentDeliveryMode, AgentPlatform, BaseColdStore, BundleChunkAssembler, COLD_BUCKET_NAMES, ChunkLru, ChunkRequestWaiter, DEFAULT_TABLE_CONFIG, FLEET_CHUNK_BYTES, MAX_LOG_BYTES, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, RingBuffer, addLogsToArchive, chunkBuffer, chunkObjectKey, clearDispatchQueueDirect, coldDaysToBucket, coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal, collectRuntimeMetricNames, computeChunkId, computeMigrationsHash, createContextTemplateDirect, createDb, createDbRole, createHealthRoutes, createMeter, createMetricsRoutes, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, decrypt, deleteContextDirect, deriveKey, dropAndCreateDatabase, emitKiciEventDirect, encodeChunk, encodeKeySegment, encrypt, ensureDatabase, generateMasterKey, getPrometheusExporter, getReconnectDelay, initTelemetry, isLongerColdRetention, isPgUniqueViolation, isPoolAcquireTimeout, isSchemaCurrent, kiciMkdtemp, kiciTmpBase, listCheckRunTrackingDirect, listContextsDirect, listExecutionRunsDirect, listQueueDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, parseManifest, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolveTableConfig, seedContextBindingDirect, seedContextDirect, serializeManifest, setContextPolicyDirect, setContextSecretDirect, setupGracefulShutdown, showContextDirect, showExecutionRunDirect, showQueueEntryDirect, showRegistrationDirect, splitAgentPlatform, storeMigrationContentHash, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix, validateRequiredTools };

package/dist/telemetry/init.js

@@ -23,10 +23,11 @@ function initTelemetry(config) {
 		prefix: config.metricPrefix
 	});
 	_prometheusExporter = prometheusExporter;
+	const traceExporter = config.otlpEndpoint ? new OTLPTraceExporter({ url: `${config.otlpEndpoint}/v1/traces` }) : void 0;
 	const sdk = new NodeSDK({
 		resource,
 		metricReader: prometheusExporter,
-		traceExporter: config.otlpEndpoint ? new OTLPTraceExporter({ url: `${config.otlpEndpoint}/v1/traces` }) : void 0,
+		traceExporter,
 		instrumentations: [new RuntimeNodeInstrumentation()]
 	});
 	sdk.start();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/shared",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
   "keywords": [
     "ci",
@@ -89,10 +89,14 @@
     "./package-manager-types": {
       "import": "./dist/package-manager-types.js",
       "types": "./dist/package-manager-types.d.ts"
+    },
+    "./container-runtime": {
+      "import": "./dist/container-runtime.js",
+      "types": "./dist/container-runtime.d.ts"
     }
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.1089.0",
+    "@aws-sdk/client-s3": "^3.1121.0",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/exporter-metrics-otlp-http": "^0.221.0",
     "@opentelemetry/exporter-prometheus": "^0.221.0",
@@ -103,22 +107,24 @@
     "@opentelemetry/semantic-conventions": "^1.43.0",
     "archiver": "^8.0.0",
     "diff": "^9.0.0",
-    "hono": "^4.12.32",
+    "hono": "^4.13.2",
     "kysely": "^0.29.4",
     "oxc-transform": "0.140.0",
-    "pg": "^8.22.0",
+    "pg": "^8.23.0",
     "picocolors": "^1.1.1",
     "winston": "^3.19.0",
     "winston-daily-rotate-file": "^5.0.0",
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
     "zx": "^8.8.5",
-    "@kici-dev/core": "0.5.0",
-    "@kici-dev/engine": "0.5.0"
+    "@kici-dev/core": "0.6.1",
+    "@kici-dev/engine": "0.6.1"
   },
   "devDependencies": {
     "@opentelemetry/sdk-trace-base": "^2.10.0",
-    "@types/archiver": "^8.0.0"
+    "@types/archiver": "^8.0.0",
+    "@types/dockerode": "^4.0.1",
+    "dockerode": "^5.0.1"
   },
   "scripts": {
     "build": "node ../../scripts/build-ts.mjs && tsgo --emitDeclarationOnly",