@ai-sdlc/orchestrator 0.1.0

package/dist/security.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Security context module — integrates enterprise security primitives
+ * (sandbox, JIT credentials, kill switch, approval workflow) into the
+ * AI-SDLC pipeline.
+ *
+ * Uses stub implementations from the reference for testability.
+ */
+import { createGitHubSandbox, createGitHubJITCredentialIssuer, classifyApprovalTier, compareTiers, type Sandbox, type JITCredentialIssuer, type JITCredential, type KillSwitch, type ApprovalWorkflow, type ApprovalTier, type ApprovalRequest, type CodespacesClient, type GitHubSandboxConfig, type SecretsClient, type SecretEncryptor, type GitHubJITConfig, type NetworkPolicy, type SandboxConstraints, type SandboxStatus, type ApprovalStatus, type ApprovalClassificationInput } from '@ai-sdlc/reference';
+export interface SecurityContext {
+    sandbox: Sandbox;
+    jitCredentials: JITCredentialIssuer;
+    killSwitch: KillSwitch;
+    approvalWorkflow: ApprovalWorkflow;
+}
+/**
+ * Create a pipeline security context using stub implementations.
+ * Accepts optional partial overrides to replace individual primitives.
+ */
+export declare function createPipelineSecurity(overrides?: Partial<SecurityContext>): SecurityContext;
+/**
+ * Check the kill switch and throw if active.
+ */
+export declare function checkKillSwitch(security: SecurityContext): Promise<void>;
+/**
+ * Issue JIT credentials for an agent with a scoped TTL.
+ */
+export declare function issueAgentCredentials(security: SecurityContext, agentId: string, scope?: string[], ttlMs?: number): Promise<JITCredential>;
+/**
+ * Revoke agent credentials after execution.
+ */
+export declare function revokeAgentCredentials(security: SecurityContext, credentialId: string): Promise<void>;
+/**
+ * Classify the required approval tier and submit an approval request.
+ * Returns the request (auto-approved if tier is 'auto').
+ */
+export declare function classifyAndSubmitApproval(security: SecurityContext, complexityScore: number, requester: string, description: string, opts?: {
+    securitySensitive?: boolean;
+    isInfraChange?: boolean;
+}): Promise<ApprovalRequest>;
+/**
+ * Create a GitHub Codespace-backed sandbox (requires CodespacesClient).
+ */
+export declare function createGitHubSandboxProvider(client: CodespacesClient, config: GitHubSandboxConfig): Sandbox;
+/**
+ * Create a GitHub Secrets-backed JIT credential issuer (requires SecretsClient).
+ * Encryptor can be provided via config.encryptor.
+ */
+export declare function createGitHubJITProvider(client: SecretsClient, config: GitHubJITConfig): JITCredentialIssuer;
+export { classifyApprovalTier, compareTiers, createGitHubSandbox, createGitHubJITCredentialIssuer };
+export type { ApprovalTier, ApprovalRequest, JITCredential, CodespacesClient, GitHubSandboxConfig, SecretsClient, SecretEncryptor, GitHubJITConfig, NetworkPolicy, SandboxConstraints, SandboxStatus, ApprovalStatus, ApprovalClassificationInput, };
+//# sourceMappingURL=security.d.ts.map

package/dist/security.js

@@ -0,0 +1,70 @@
+/**
+ * Security context module — integrates enterprise security primitives
+ * (sandbox, JIT credentials, kill switch, approval workflow) into the
+ * AI-SDLC pipeline.
+ *
+ * Uses stub implementations from the reference for testability.
+ */
+import { createStubSandbox, createStubJITCredentialIssuer, createStubKillSwitch, createStubApprovalWorkflow, createGitHubSandbox, createGitHubJITCredentialIssuer, classifyApprovalTier, compareTiers, } from '@ai-sdlc/reference';
+import { DEFAULT_JIT_TTL_MS, DEFAULT_JIT_SCOPE } from './defaults.js';
+/**
+ * Create a pipeline security context using stub implementations.
+ * Accepts optional partial overrides to replace individual primitives.
+ */
+export function createPipelineSecurity(overrides) {
+    return {
+        sandbox: overrides?.sandbox ?? createStubSandbox(),
+        jitCredentials: overrides?.jitCredentials ?? createStubJITCredentialIssuer(),
+        killSwitch: overrides?.killSwitch ?? createStubKillSwitch(),
+        approvalWorkflow: overrides?.approvalWorkflow ?? createStubApprovalWorkflow(),
+    };
+}
+/**
+ * Check the kill switch and throw if active.
+ */
+export async function checkKillSwitch(security) {
+    const active = await security.killSwitch.isActive();
+    if (active) {
+        const reason = await security.killSwitch.getReason();
+        throw new Error(`Pipeline aborted: kill switch active — ${reason ?? 'no reason given'}`);
+    }
+}
+/**
+ * Issue JIT credentials for an agent with a scoped TTL.
+ */
+export async function issueAgentCredentials(security, agentId, scope = DEFAULT_JIT_SCOPE, ttlMs = DEFAULT_JIT_TTL_MS) {
+    return security.jitCredentials.issue(agentId, scope, ttlMs);
+}
+/**
+ * Revoke agent credentials after execution.
+ */
+export async function revokeAgentCredentials(security, credentialId) {
+    await security.jitCredentials.revoke(credentialId);
+}
+/**
+ * Classify the required approval tier and submit an approval request.
+ * Returns the request (auto-approved if tier is 'auto').
+ */
+export async function classifyAndSubmitApproval(security, complexityScore, requester, description, opts) {
+    const tier = classifyApprovalTier({
+        complexityScore,
+        securitySensitive: opts?.securitySensitive,
+        isInfraChange: opts?.isInfraChange,
+    });
+    return security.approvalWorkflow.submit(tier, requester, description);
+}
+/**
+ * Create a GitHub Codespace-backed sandbox (requires CodespacesClient).
+ */
+export function createGitHubSandboxProvider(client, config) {
+    return createGitHubSandbox(client, config);
+}
+/**
+ * Create a GitHub Secrets-backed JIT credential issuer (requires SecretsClient).
+ * Encryptor can be provided via config.encryptor.
+ */
+export function createGitHubJITProvider(client, config) {
+    return createGitHubJITCredentialIssuer(client, config);
+}
+export { classifyApprovalTier, compareTiers, createGitHubSandbox, createGitHubJITCredentialIssuer };
+//# sourceMappingURL=security.js.map

package/dist/shared.d.ts

@@ -0,0 +1,134 @@
+/**
+ * Shared utilities extracted from execute.ts and fix-ci.ts.
+ * Eliminates ~400 lines of duplicated logic across orchestrators.
+ */
+import { type AuditLog, type AgentConstraints, type AutonomyLevel, type AutonomyPolicy, type Permissions, type MetricStore, type AgentMemory, type ComplianceCoverageReport, type SecretStore, type AuthorizationHook, type AuthorizationContext, type AuthorizationResult } from '@ai-sdlc/reference';
+export declare function execFileAsync(cmd: string, args: string[], opts?: Record<string, unknown>): Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+/**
+ * Replace `{key}` placeholders in a string with values from `vars`.
+ * Unknown keys are left as-is.
+ */
+export declare function interpolate(text: string, vars: Record<string, string>): string;
+/**
+ * Interpolate a branch name pattern by replacing `{key}` placeholders.
+ * Falls back to `ai-sdlc/issue-{issueNumber}` when no pattern is provided.
+ */
+export declare function interpolateBranchPattern(pattern: string | undefined, vars: Record<string, string>): string;
+/**
+ * Interpolate a PR title template by replacing `{key}` placeholders.
+ * Falls back to `fix: {issueTitle} (#{issueNumber})` when no template is provided.
+ */
+export declare function interpolatePRTitle(template: string | undefined, vars: Record<string, string>): string;
+export declare const BRANCH_PATTERN: RegExp;
+/**
+ * Extract the issue number from an `ai-sdlc/issue-N` branch name.
+ * Returns null if the branch doesn't match the pattern.
+ */
+export declare function extractIssueNumber(branch: string): number | null;
+export interface GitHubEnvConfig {
+    org: string;
+    repo: string;
+    token: string | undefined;
+}
+/**
+ * Read GitHub org/repo/token from standard environment variables.
+ * Accepts an optional SecretStore to resolve the token through the
+ * adapter system instead of reading process.env directly.
+ *
+ * Falls back to empty strings when no env vars are set — explicit
+ * configuration is required for production use.
+ */
+export declare function getGitHubConfig(secretStore?: SecretStore): GitHubEnvConfig;
+/**
+ * Resolve the repository root directory using `git rev-parse`.
+ */
+export declare function resolveRepoRoot(): Promise<string>;
+/**
+ * Create the default JSONL-backed audit log for a work directory.
+ */
+export declare function createDefaultAuditLog(workDir: string): AuditLog;
+/**
+ * Find the applicable autonomy level from the policy.
+ * @param maxLevel Maximum level to search for (default 1).
+ */
+export declare function resolveAutonomyLevel(policy: AutonomyPolicy, maxLevel?: number): AutonomyLevel;
+/**
+ * Merge blocked paths from agent constraints and autonomy guardrails,
+ * deduplicating the result.
+ */
+export declare function mergeBlockedPaths(constraints: AgentConstraints, guardrails: {
+    blockedPaths?: string[];
+}): string[];
+/**
+ * Resolve the effective agent constraints from an AgentRole and autonomy level.
+ */
+export declare function resolveConstraints(agentConstraints: AgentConstraints | undefined, autonomyLevel: AutonomyLevel): {
+    maxFiles: number;
+    requireTests: boolean;
+    blockedPaths: string[];
+};
+/**
+ * Check if a routing strategy allows fully autonomous execution.
+ */
+export declare function isAutonomousStrategy(strategy: string): boolean;
+/**
+ * Record a metric to an optional MetricStore (no-ops if store is undefined).
+ */
+export declare function recordMetric(store: MetricStore | undefined, metric: string, value: number): void;
+import type { Logger } from './logger.js';
+export interface ValidateAndAuditParams {
+    filesChanged: string[];
+    workDir: string;
+    constraints: {
+        maxFilesPerChange: number;
+        requireTests: boolean;
+        blockedPaths: string[];
+    };
+    guardrails: {
+        maxLinesPerPR?: number;
+    };
+    auditLog: AuditLog;
+    log: Logger;
+    /** Optional callback to post a comment on validation failure. */
+    onViolation?: (violationList: string) => Promise<void>;
+}
+/**
+ * Validate agent output against guardrails and record audit entries.
+ * Throws on guardrail violations.
+ */
+export declare function validateAndAuditOutput(params: ValidateAndAuditParams): Promise<void>;
+/**
+ * Create a pipeline agent memory backed by local files.
+ */
+export declare function createPipelineMemory(workDir: string): AgentMemory;
+/**
+ * Evaluate pipeline compliance across all regulatory frameworks.
+ */
+export declare function evaluatePipelineCompliance(hasMemory: boolean): ComplianceCoverageReport[];
+/**
+ * Authorize a list of files against ABAC permissions and agent constraints.
+ * Throws on the first denied file.
+ */
+export declare function authorizeFilesChanged(files: string[], permissions: Permissions, constraints: AgentConstraints | undefined, auditLog: AuditLog, actor: string): void;
+/**
+ * Create an ABAC permission-check hook wrapping the existing authorize().
+ */
+export declare function createAbacPermissionHook(permissions: Permissions, constraints: AgentConstraints | undefined): AuthorizationHook;
+/**
+ * Create a blocked-paths guardrail hook.
+ */
+export declare function createBlockedPathsHook(blockedPaths: string[]): AuthorizationHook;
+/**
+ * Create an audit logging hook that records authorization decisions.
+ */
+export declare function createAuditLoggingHook(auditLog: AuditLog): AuthorizationHook;
+/**
+ * Compose multiple AuthorizationHook functions into a chain.
+ * Hooks are executed in order; the first denial short-circuits.
+ */
+export declare function createPipelineAuthorizationChain(hooks: AuthorizationHook[]): AuthorizationHook;
+export type { AuthorizationHook, AuthorizationContext, AuthorizationResult };
+//# sourceMappingURL=shared.d.ts.map

package/dist/shared.js

@@ -0,0 +1,284 @@
+/**
+ * Shared utilities extracted from execute.ts and fix-ci.ts.
+ * Eliminates ~400 lines of duplicated logic across orchestrators.
+ */
+import { execFile } from 'node:child_process';
+import { join } from 'node:path';
+import { createAuditLog, createFileSink, authorize, checkAllFrameworks, createAgentMemory, createFileLongTermMemory, createFileEpisodicMemory, } from '@ai-sdlc/reference';
+import { DEFAULT_GITHUB_ORG, DEFAULT_GITHUB_REPO, DEFAULT_CONFIG_DIR_NAME, DEFAULT_MAX_FILES_PER_CHANGE, DEFAULT_REQUIRE_TESTS, DEFAULT_BRANCH_TEMPLATE, DEFAULT_BRANCH_PATTERN, DEFAULT_PR_TITLE_TEMPLATE, } from './defaults.js';
+export function execFileAsync(cmd, args, opts) {
+    return new Promise((resolve, reject) => {
+        execFile(cmd, args, opts ?? {}, (err, stdout, stderr) => {
+            if (err)
+                reject(err);
+            else
+                resolve({ stdout, stderr });
+        });
+    });
+}
+// ── Template interpolation ────────────────────────────────────────────
+/**
+ * Replace `{key}` placeholders in a string with values from `vars`.
+ * Unknown keys are left as-is.
+ */
+export function interpolate(text, vars) {
+    return text.replace(/\{(\w+)\}/g, (_, key) => vars[key] ?? `{${key}}`);
+}
+/**
+ * Interpolate a branch name pattern by replacing `{key}` placeholders.
+ * Falls back to `ai-sdlc/issue-{issueNumber}` when no pattern is provided.
+ */
+export function interpolateBranchPattern(pattern, vars) {
+    return interpolate(pattern ?? DEFAULT_BRANCH_TEMPLATE, vars);
+}
+/**
+ * Interpolate a PR title template by replacing `{key}` placeholders.
+ * Falls back to `fix: {issueTitle} (#{issueNumber})` when no template is provided.
+ */
+export function interpolatePRTitle(template, vars) {
+    return interpolate(template ?? DEFAULT_PR_TITLE_TEMPLATE, vars);
+}
+// ── Branch pattern ───────────────────────────────────────────────────
+export const BRANCH_PATTERN = DEFAULT_BRANCH_PATTERN;
+/**
+ * Extract the issue number from an `ai-sdlc/issue-N` branch name.
+ * Returns null if the branch doesn't match the pattern.
+ */
+export function extractIssueNumber(branch) {
+    const match = branch.match(BRANCH_PATTERN);
+    return match ? Number(match[1]) : null;
+}
+/**
+ * Read GitHub org/repo/token from standard environment variables.
+ * Accepts an optional SecretStore to resolve the token through the
+ * adapter system instead of reading process.env directly.
+ *
+ * Falls back to empty strings when no env vars are set — explicit
+ * configuration is required for production use.
+ */
+export function getGitHubConfig(secretStore) {
+    const org = process.env.GITHUB_REPOSITORY_OWNER ?? DEFAULT_GITHUB_ORG;
+    const repo = process.env.GITHUB_REPOSITORY?.split('/')[1] ?? DEFAULT_GITHUB_REPO;
+    const token = secretStore
+        ? secretStore.get('github-token')
+        : process.env.GITHUB_TOKEN || undefined;
+    return { org, repo, token };
+}
+// ── Repo root ────────────────────────────────────────────────────────
+/**
+ * Resolve the repository root directory using `git rev-parse`.
+ */
+export async function resolveRepoRoot() {
+    const { stdout } = await execFileAsync('git', ['rev-parse', '--show-toplevel']);
+    return stdout.trim();
+}
+// ── Audit log factory ────────────────────────────────────────────────
+/**
+ * Create the default JSONL-backed audit log for a work directory.
+ */
+export function createDefaultAuditLog(workDir) {
+    return createAuditLog(createFileSink(join(workDir, DEFAULT_CONFIG_DIR_NAME, 'audit.jsonl')));
+}
+// ── Autonomy helpers ─────────────────────────────────────────────────
+/**
+ * Find the applicable autonomy level from the policy.
+ * @param maxLevel Maximum level to search for (default 1).
+ */
+export function resolveAutonomyLevel(policy, maxLevel = 1) {
+    const level = policy.spec.levels.find((l) => l.level <= maxLevel);
+    if (!level) {
+        throw new Error(`No autonomy level 0 or ${maxLevel} found in policy`);
+    }
+    return level;
+}
+/**
+ * Merge blocked paths from agent constraints and autonomy guardrails,
+ * deduplicating the result.
+ */
+export function mergeBlockedPaths(constraints, guardrails) {
+    const agentBlocked = constraints.blockedPaths ?? [];
+    const autonomyBlocked = guardrails.blockedPaths ?? [];
+    return [...new Set([...agentBlocked, ...autonomyBlocked])];
+}
+/**
+ * Resolve the effective agent constraints from an AgentRole and autonomy level.
+ */
+export function resolveConstraints(agentConstraints, autonomyLevel) {
+    const constraints = agentConstraints ?? {
+        maxFilesPerChange: DEFAULT_MAX_FILES_PER_CHANGE,
+        requireTests: DEFAULT_REQUIRE_TESTS,
+        blockedPaths: [],
+    };
+    return {
+        maxFiles: constraints.maxFilesPerChange ?? 15,
+        requireTests: constraints.requireTests ?? true,
+        blockedPaths: mergeBlockedPaths(constraints, autonomyLevel.guardrails),
+    };
+}
+// ── Routing strategy ─────────────────────────────────────────────────
+/**
+ * Check if a routing strategy allows fully autonomous execution.
+ */
+export function isAutonomousStrategy(strategy) {
+    return strategy === 'fully-autonomous' || strategy === 'ai-with-review';
+}
+// ── Metric store helper ──────────────────────────────────────────────
+/**
+ * Record a metric to an optional MetricStore (no-ops if store is undefined).
+ */
+export function recordMetric(store, metric, value) {
+    if (store)
+        store.record({ metric, value });
+}
+// ── Output validation (shared block) ─────────────────────────────────
+import { validateAgentOutput } from './validate-agent-output.js';
+/**
+ * Validate agent output against guardrails and record audit entries.
+ * Throws on guardrail violations.
+ */
+export async function validateAndAuditOutput(params) {
+    const { filesChanged, workDir, constraints, guardrails, auditLog, log, onViolation } = params;
+    log.stage('validate-output');
+    const validation = await validateAgentOutput({
+        filesChanged,
+        workDir,
+        constraints,
+        guardrails,
+    });
+    log.stageEnd('validate-output');
+    if (!validation.passed) {
+        auditLog.record({
+            actor: 'system',
+            action: 'check',
+            resource: 'agent-output',
+            decision: 'denied',
+            details: { violations: validation.violations.map((v) => v.rule) },
+        });
+        const violationList = validation.violations
+            .map((v) => `- **${v.rule}**: ${v.message}`)
+            .join('\n');
+        if (onViolation) {
+            await onViolation(violationList);
+        }
+        throw new Error('Agent output failed guardrail validation');
+    }
+    auditLog.record({
+        actor: 'system',
+        action: 'check',
+        resource: 'agent-output',
+        decision: 'allowed',
+    });
+}
+// ── Agent memory ─────────────────────────────────────────────────────
+/**
+ * Create a pipeline agent memory backed by local files.
+ */
+export function createPipelineMemory(workDir) {
+    const base = createAgentMemory();
+    const memDir = join(workDir, DEFAULT_CONFIG_DIR_NAME, 'memory');
+    return {
+        ...base,
+        longTerm: createFileLongTermMemory(join(memDir, 'long-term.json')),
+        episodic: createFileEpisodicMemory(join(memDir, 'episodes.json')),
+    };
+}
+// ── Compliance reporting ─────────────────────────────────────────────
+/**
+ * Evaluate pipeline compliance across all regulatory frameworks.
+ */
+export function evaluatePipelineCompliance(hasMemory) {
+    const controls = new Set([
+        'quality-gates',
+        'audit-logging',
+        'autonomy-governance',
+        'human-review',
+        'metrics-collection',
+        'complexity-routing',
+    ]);
+    if (hasMemory)
+        controls.add('agent-memory');
+    return checkAllFrameworks(controls);
+}
+// ── ABAC authorization ───────────────────────────────────────────────
+/**
+ * Authorize a list of files against ABAC permissions and agent constraints.
+ * Throws on the first denied file.
+ */
+export function authorizeFilesChanged(files, permissions, constraints, auditLog, actor) {
+    for (const file of files) {
+        const result = authorize(permissions, constraints, 'write', file);
+        if (!result.allowed) {
+            auditLog.record({
+                actor,
+                action: 'write',
+                resource: file,
+                decision: 'denied',
+                details: { reason: result.reason, layer: result.layer },
+            });
+            throw new Error(`Authorization denied for ${file}: ${result.reason}`);
+        }
+    }
+}
+// ── Authorization middleware chains ──────────────────────────────────
+/**
+ * Create an ABAC permission-check hook wrapping the existing authorize().
+ */
+export function createAbacPermissionHook(permissions, constraints) {
+    return (ctx) => {
+        return authorize(permissions, constraints, ctx.action, ctx.target);
+    };
+}
+/**
+ * Create a blocked-paths guardrail hook.
+ */
+export function createBlockedPathsHook(blockedPaths) {
+    return (ctx) => {
+        for (const pattern of blockedPaths) {
+            const regex = new RegExp('^' +
+                pattern
+                    .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+                    .replace(/\*\*/g, '{{GLOBSTAR}}')
+                    .replace(/\*/g, '[^/]*')
+                    .replace(/\{\{GLOBSTAR\}\}/g, '.*') +
+                '$');
+            if (regex.test(ctx.target)) {
+                return {
+                    allowed: false,
+                    reason: `Target "${ctx.target}" matches blocked path "${pattern}"`,
+                    layer: 'constraints',
+                };
+            }
+        }
+        return { allowed: true };
+    };
+}
+/**
+ * Create an audit logging hook that records authorization decisions.
+ */
+export function createAuditLoggingHook(auditLog) {
+    return (ctx) => {
+        auditLog.record({
+            actor: ctx.agent,
+            action: ctx.action,
+            resource: ctx.target,
+            decision: 'allowed',
+            details: { hook: 'audit-logging' },
+        });
+        return { allowed: true };
+    };
+}
+/**
+ * Compose multiple AuthorizationHook functions into a chain.
+ * Hooks are executed in order; the first denial short-circuits.
+ */
+export function createPipelineAuthorizationChain(hooks) {
+    return (ctx) => {
+        for (const hook of hooks) {
+            const result = hook(ctx);
+            if (!result.allowed)
+                return result;
+        }
+        return { allowed: true };
+    };
+}
+//# sourceMappingURL=shared.js.map

package/dist/state/index.d.ts

@@ -0,0 +1,4 @@
+export { StateStore } from './store.js';
+export { CURRENT_SCHEMA_VERSION, SCHEMA_DDL, MIGRATION_V2, MIGRATION_V3, MIGRATION_V4, MIGRATION_V5, MIGRATIONS, } from './schema.js';
+export type { ComplexityProfile, EpisodicRecord, AutonomyLedgerEntry, PipelineRun, PipelineRunStatus, Convention, HotspotRecord, RoutingDecision, CostLedgerEntry, GateThresholdOverride, AutonomyEvent, AutonomyEventType, HandoffEvent, DeploymentRecord, DeploymentRecordState, RolloutStepRecord, AuditEntryRecord, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/state/index.js

@@ -0,0 +1,3 @@
+export { StateStore } from './store.js';
+export { CURRENT_SCHEMA_VERSION, SCHEMA_DDL, MIGRATION_V2, MIGRATION_V3, MIGRATION_V4, MIGRATION_V5, MIGRATIONS, } from './schema.js';
+//# sourceMappingURL=index.js.map

package/dist/state/schema.d.ts

@@ -0,0 +1,16 @@
+/**
+ * SQLite DDL and migrations for the state store.
+ */
+export declare const CURRENT_SCHEMA_VERSION = 6;
+export declare const SCHEMA_DDL = "\nCREATE TABLE IF NOT EXISTS schema_version (\n  version INTEGER PRIMARY KEY,\n  applied_at TEXT DEFAULT (datetime('now'))\n);\n\nCREATE TABLE IF NOT EXISTS complexity_profile (\n  id INTEGER PRIMARY KEY,\n  repo_path TEXT NOT NULL,\n  score REAL NOT NULL,\n  files_count INTEGER,\n  modules_count INTEGER,\n  dependency_count INTEGER,\n  analyzed_at TEXT DEFAULT (datetime('now')),\n  raw_data TEXT\n);\n\nCREATE TABLE IF NOT EXISTS episodic_memory (\n  id INTEGER PRIMARY KEY,\n  issue_number INTEGER,\n  pr_number INTEGER,\n  pipeline_type TEXT NOT NULL,\n  outcome TEXT NOT NULL,\n  duration_ms INTEGER,\n  files_changed INTEGER,\n  error_message TEXT,\n  metadata TEXT,\n  created_at TEXT DEFAULT (datetime('now'))\n);\n\nCREATE TABLE IF NOT EXISTS autonomy_ledger (\n  id INTEGER PRIMARY KEY,\n  agent_name TEXT NOT NULL UNIQUE,\n  current_level INTEGER DEFAULT 0,\n  total_tasks INTEGER DEFAULT 0,\n  success_count INTEGER DEFAULT 0,\n  failure_count INTEGER DEFAULT 0,\n  last_task_at TEXT,\n  metrics TEXT\n);\n\nCREATE TABLE IF NOT EXISTS pipeline_runs (\n  id INTEGER PRIMARY KEY,\n  run_id TEXT NOT NULL UNIQUE,\n  issue_number INTEGER,\n  pr_number INTEGER,\n  pipeline_type TEXT NOT NULL,\n  status TEXT NOT NULL,\n  current_stage TEXT,\n  started_at TEXT DEFAULT (datetime('now')),\n  completed_at TEXT,\n  result TEXT,\n  gate_results TEXT\n);\n\nCREATE TABLE IF NOT EXISTS conventions (\n  id INTEGER PRIMARY KEY,\n  category TEXT NOT NULL,\n  pattern TEXT NOT NULL,\n  confidence REAL,\n  examples TEXT,\n  detected_at TEXT DEFAULT (datetime('now'))\n);\n";
+export interface Migration {
+    version: number;
+    sql: string;
+}
+export declare const MIGRATION_V2 = "\nALTER TABLE complexity_profile ADD COLUMN architectural_patterns TEXT;\nALTER TABLE complexity_profile ADD COLUMN hotspots TEXT;\nALTER TABLE complexity_profile ADD COLUMN module_graph TEXT;\nALTER TABLE complexity_profile ADD COLUMN conventions_data TEXT;\n\nCREATE TABLE IF NOT EXISTS hotspots (\n  id INTEGER PRIMARY KEY,\n  repo_path TEXT NOT NULL,\n  file_path TEXT NOT NULL,\n  churn_rate REAL NOT NULL,\n  complexity INTEGER NOT NULL,\n  commit_count INTEGER,\n  last_modified TEXT,\n  note TEXT,\n  analyzed_at TEXT DEFAULT (datetime('now'))\n);\n\nCREATE TABLE IF NOT EXISTS routing_history (\n  id INTEGER PRIMARY KEY,\n  issue_number INTEGER,\n  task_complexity INTEGER,\n  codebase_complexity REAL,\n  routing_strategy TEXT NOT NULL,\n  agent_name TEXT,\n  reason TEXT,\n  decided_at TEXT DEFAULT (datetime('now'))\n);\n";
+export declare const MIGRATION_V3 = "\n-- Cost tracking\nCREATE TABLE IF NOT EXISTS cost_ledger (\n  id INTEGER PRIMARY KEY,\n  run_id TEXT NOT NULL,\n  agent_name TEXT NOT NULL,\n  pipeline_type TEXT NOT NULL,\n  model TEXT,\n  input_tokens INTEGER DEFAULT 0,\n  output_tokens INTEGER DEFAULT 0,\n  total_tokens INTEGER DEFAULT 0,\n  cost_usd REAL DEFAULT 0.0,\n  issue_number INTEGER,\n  pr_number INTEGER,\n  created_at TEXT DEFAULT (datetime('now'))\n);\nCREATE INDEX IF NOT EXISTS idx_cost_ledger_run ON cost_ledger(run_id);\nCREATE INDEX IF NOT EXISTS idx_cost_ledger_agent ON cost_ledger(agent_name);\n\n-- Gate threshold overrides per complexity band\nCREATE TABLE IF NOT EXISTS gate_threshold_overrides (\n  id INTEGER PRIMARY KEY,\n  gate_name TEXT NOT NULL,\n  complexity_band TEXT NOT NULL,\n  enforcement_level TEXT NOT NULL,\n  threshold_overrides TEXT,\n  active INTEGER DEFAULT 1,\n  created_at TEXT DEFAULT (datetime('now')),\n  UNIQUE(gate_name, complexity_band)\n);\n\n-- Autonomy event log (immutable)\nCREATE TABLE IF NOT EXISTS autonomy_events (\n  id INTEGER PRIMARY KEY,\n  agent_name TEXT NOT NULL,\n  event_type TEXT NOT NULL,\n  from_level INTEGER NOT NULL,\n  to_level INTEGER NOT NULL,\n  trigger TEXT,\n  metrics_snapshot TEXT,\n  unmet_conditions TEXT,\n  created_at TEXT DEFAULT (datetime('now'))\n);\nCREATE INDEX IF NOT EXISTS idx_autonomy_events_agent ON autonomy_events(agent_name);\n\n-- Extend autonomy_ledger\nALTER TABLE autonomy_ledger ADD COLUMN pr_approval_rate REAL DEFAULT 0.0;\nALTER TABLE autonomy_ledger ADD COLUMN rollback_count INTEGER DEFAULT 0;\nALTER TABLE autonomy_ledger ADD COLUMN security_incidents INTEGER DEFAULT 0;\nALTER TABLE autonomy_ledger ADD COLUMN promoted_at TEXT;\nALTER TABLE autonomy_ledger ADD COLUMN demoted_at TEXT;\nALTER TABLE autonomy_ledger ADD COLUMN time_at_level_ms INTEGER DEFAULT 0;\n\n-- Extend episodic_memory\nALTER TABLE episodic_memory ADD COLUMN agent_name TEXT;\nALTER TABLE episodic_memory ADD COLUMN complexity_score INTEGER;\nALTER TABLE episodic_memory ADD COLUMN routing_strategy TEXT;\nALTER TABLE episodic_memory ADD COLUMN gate_pass_count INTEGER;\nALTER TABLE episodic_memory ADD COLUMN gate_fail_count INTEGER;\nALTER TABLE episodic_memory ADD COLUMN cost_usd REAL;\nALTER TABLE episodic_memory ADD COLUMN is_regression INTEGER DEFAULT 0;\nALTER TABLE episodic_memory ADD COLUMN related_episodes TEXT;\n\n-- Extend pipeline_runs\nALTER TABLE pipeline_runs ADD COLUMN cost_usd REAL DEFAULT 0.0;\nALTER TABLE pipeline_runs ADD COLUMN tokens_used INTEGER DEFAULT 0;\nALTER TABLE pipeline_runs ADD COLUMN model TEXT;\nALTER TABLE pipeline_runs ADD COLUMN agent_name TEXT;\nALTER TABLE pipeline_runs ADD COLUMN complexity_score INTEGER;\n";
+export declare const MIGRATION_V4 = "\n-- Handoff audit trail\nCREATE TABLE IF NOT EXISTS handoff_events (\n  id INTEGER PRIMARY KEY,\n  run_id TEXT NOT NULL,\n  from_agent TEXT NOT NULL,\n  to_agent TEXT NOT NULL,\n  payload_hash TEXT,\n  validation_result TEXT NOT NULL,\n  error_message TEXT,\n  created_at TEXT DEFAULT (datetime('now'))\n);\nCREATE INDEX IF NOT EXISTS idx_handoff_events_run ON handoff_events(run_id);\n";
+export declare const MIGRATION_V5 = "\n-- Deployment records\nCREATE TABLE IF NOT EXISTS deployments (\n  id INTEGER PRIMARY KEY,\n  deployment_id TEXT NOT NULL UNIQUE,\n  target_name TEXT NOT NULL,\n  provider TEXT NOT NULL,\n  version TEXT NOT NULL,\n  environment TEXT NOT NULL,\n  state TEXT NOT NULL,\n  url TEXT,\n  error TEXT,\n  started_at TEXT DEFAULT (datetime('now')),\n  completed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS idx_deployments_target ON deployments(target_name);\nCREATE INDEX IF NOT EXISTS idx_deployments_env ON deployments(environment);\n\n-- Rollout step records\nCREATE TABLE IF NOT EXISTS rollout_steps (\n  id INTEGER PRIMARY KEY,\n  deployment_id TEXT NOT NULL,\n  step_number INTEGER NOT NULL,\n  weight_percent INTEGER NOT NULL,\n  state TEXT NOT NULL,\n  metrics_snapshot TEXT,\n  started_at TEXT DEFAULT (datetime('now')),\n  completed_at TEXT,\n  FOREIGN KEY (deployment_id) REFERENCES deployments(deployment_id)\n);\nCREATE INDEX IF NOT EXISTS idx_rollout_steps_deployment ON rollout_steps(deployment_id);\n\n-- Audit entries (indexed, queryable)\nCREATE TABLE IF NOT EXISTS audit_entries (\n  id INTEGER PRIMARY KEY,\n  entry_id TEXT NOT NULL UNIQUE,\n  actor TEXT NOT NULL,\n  action TEXT NOT NULL,\n  resource_type TEXT,\n  resource_id TEXT,\n  detail TEXT,\n  hash TEXT,\n  previous_hash TEXT,\n  signature TEXT,\n  created_at TEXT DEFAULT (datetime('now'))\n);\nCREATE INDEX IF NOT EXISTS idx_audit_entries_actor ON audit_entries(actor);\nCREATE INDEX IF NOT EXISTS idx_audit_entries_action ON audit_entries(action);\nCREATE INDEX IF NOT EXISTS idx_audit_entries_resource ON audit_entries(resource_type, resource_id);\nCREATE INDEX IF NOT EXISTS idx_audit_entries_created ON audit_entries(created_at);\n";
+export declare const MIGRATION_V6 = "\n-- Cost governance: add stage_name and cache_read_tokens to cost_ledger\nALTER TABLE cost_ledger ADD COLUMN stage_name TEXT;\nALTER TABLE cost_ledger ADD COLUMN cache_read_tokens INTEGER DEFAULT 0;\n";
+export declare const MIGRATIONS: Migration[];
+//# sourceMappingURL=schema.d.ts.map