@kici-dev/engine 0.1.25 → 0.1.27

package/dist/approval/types.d.ts

@@ -2,7 +2,7 @@
  * Shared approval requirement + clause types.
  *
  * One normalized `ApprovalRequirement` is produced by both approval triggers —
- * a mandatory environment policy and an explicit SDK `approval` config — and is
+ * a mandatory context policy and an explicit SDK `approval` config — and is
  * consumed identically by the orchestrator gate, the resolver, the held-run
  * store, and the agent step round-trip. Pure Zod (no node built-ins), so this
  * module is safe in the browser-facing engine barrel.
@@ -26,9 +26,9 @@ export declare const HoldScope: z.ZodEnum<{
     step: "step";
 }>;
 export type HoldScope = z.infer<typeof HoldScope>;
-/** What triggered the hold: an environment policy (mandatory) or SDK code (explicit). */
+/** What triggered the hold: a context policy (mandatory) or SDK code (explicit). */
 export declare const TriggerSource: z.ZodEnum<{
-    environment: "environment";
+    context: "context";
     explicit: "explicit";
 }>;
 export type TriggerSource = z.infer<typeof TriggerSource>;

package/dist/approval/types.js

@@ -5,7 +5,7 @@ import { z } from "zod";
 * Shared approval requirement + clause types.
 *
 * One normalized `ApprovalRequirement` is produced by both approval triggers —
-* a mandatory environment policy and an explicit SDK `approval` config — and is
+* a mandatory context policy and an explicit SDK `approval` config — and is
 * consumed identically by the orchestrator gate, the resolver, the held-run
 * store, and the agent step round-trip. Pure Zod (no node built-ins), so this
 * module is safe in the browser-facing engine barrel.
@@ -22,8 +22,8 @@ const HoldScope = z.enum([
 	"job",
 	"step"
 ]);
-/** What triggered the hold: an environment policy (mandatory) or SDK code (explicit). */
-const TriggerSource = z.enum(["environment", "explicit"]);
+/** What triggered the hold: a context policy (mandatory) or SDK code (explicit). */
+const TriggerSource = z.enum(["context", "explicit"]);
 /**
 * The normalized requirement attached to a held element. `clauses` is a flat
 * AND list; an empty list means "any approval-capable org member". `expiresAt`

package/dist/audit/access-log-policy.js

@@ -71,7 +71,7 @@ const POLICY_BY_ACTION = {
 		kind: "sample",
 		allowedRate: .05
 	},
-	"environment.list.read": {
+	"context.list.read": {
 		kind: "sample",
 		allowedRate: .1
 	},
@@ -83,11 +83,11 @@ const POLICY_BY_ACTION = {
 		kind: "sample",
 		allowedRate: .1
 	},
-	"environment.get.read": {
+	"context.get.read": {
 		kind: "sample",
 		allowedRate: .2
 	},
-	"environment.history.read": {
+	"context.history.read": {
 		kind: "sample",
 		allowedRate: .2
 	},
@@ -95,7 +95,7 @@ const POLICY_BY_ACTION = {
 		kind: "sample",
 		allowedRate: .2
 	},
-	"env_binding.list.read": {
+	"context_binding.list.read": {
 		kind: "sample",
 		allowedRate: .2
 	},
@@ -131,16 +131,16 @@ const POLICY_BY_ACTION = {
 	"job.cancel": { kind: "always" },
 	"event_log.detail.read": { kind: "always" },
 	"event_log.payload.read": { kind: "always" },
-	"environment.create": { kind: "always" },
-	"environment.update": { kind: "always" },
-	"environment.delete": { kind: "always" },
-	"env_var.list.read": { kind: "always" },
-	"env_var.set": { kind: "always" },
-	"env_var.delete": { kind: "always" },
+	"context.create": { kind: "always" },
+	"context.update": { kind: "always" },
+	"context.delete": { kind: "always" },
+	"context_var.list.read": { kind: "always" },
+	"context_var.set": { kind: "always" },
+	"context_var.delete": { kind: "always" },
 	"source_override.list.read": { kind: "always" },
 	"source_override.set": { kind: "always" },
 	"source_override.delete": { kind: "always" },
-	"env_binding.set": { kind: "always" },
+	"context_binding.set": { kind: "always" },
 	"secret.list.read": { kind: "always" },
 	"secret.set": { kind: "always" },
 	"secret.delete": { kind: "always" },
@@ -165,6 +165,7 @@ const POLICY_BY_ACTION = {
 	"global_workflows.update": { kind: "always" },
 	"org_settings.dashboard_write_policy.update": { kind: "always" },
 	"cluster_name.update": { kind: "always" },
+	"attestation.retry": { kind: "always" },
 	"access_log.list.read": { kind: "always" },
 	"event_dlq.list.read": {
 		kind: "sample",

package/dist/audit/retention-policy.js

@@ -21,13 +21,13 @@ const ACCESS_LOG_WARM_DAYS = {
 	"step.logs.read": 30,
 	"attestations.read": 30,
 	"event_log.list.read": 30,
-	"environment.list.read": 30,
-	"environment.get.read": 30,
-	"environment.history.read": 30,
+	"context.list.read": 30,
+	"context.get.read": 30,
+	"context.history.read": 30,
 	"registration.list.read": 30,
 	"global_workflows.get.read": 30,
 	"held_run.list.read": 30,
-	"env_binding.list.read": 30,
+	"context_binding.list.read": 30,
 	"backend.list.read": 30,
 	"backend.get.read": 30,
 	"diagnostics.read": 30,
@@ -37,7 +37,7 @@ const ACCESS_LOG_WARM_DAYS = {
 	"event_log.detail.read": 180,
 	"event_log.payload.read": 180,
 	"run.payload.read": 180,
-	"env_var.list.read": 180,
+	"context_var.list.read": 180,
 	"source_override.list.read": 180,
 	"access_log.list.read": 180,
 	"secret.list.read": 180,
@@ -46,14 +46,14 @@ const ACCESS_LOG_WARM_DAYS = {
 	"run.manual_schedule": 180,
 	"run.trigger": 180,
 	"job.cancel": 180,
-	"environment.create": 180,
-	"environment.update": 180,
-	"environment.delete": 180,
-	"env_var.set": 180,
-	"env_var.delete": 180,
+	"context.create": 180,
+	"context.update": 180,
+	"context.delete": 180,
+	"context_var.set": 180,
+	"context_var.delete": 180,
 	"source_override.set": 180,
 	"source_override.delete": 180,
-	"env_binding.set": 180,
+	"context_binding.set": 180,
 	"held_run.approve": 180,
 	"held_run.auto_approve": 180,
 	"held_run.reject": 180,
@@ -71,6 +71,7 @@ const ACCESS_LOG_WARM_DAYS = {
 	"global_workflows.update": 180,
 	"org_settings.dashboard_write_policy.update": 180,
 	"cluster_name.update": 180,
+	"attestation.retry": 180,
 	"event_dlq.list.read": 30,
 	"event_dlq.retry": 180,
 	"event_dlq.discard": 180,
@@ -266,13 +267,13 @@ const ACCESS_LOG_COLD_DAYS = {
 	"step.logs.read": 180,
 	"attestations.read": 180,
 	"event_log.list.read": 180,
-	"environment.list.read": 180,
-	"environment.get.read": 180,
-	"environment.history.read": 180,
+	"context.list.read": 180,
+	"context.get.read": 180,
+	"context.history.read": 180,
 	"registration.list.read": 180,
 	"global_workflows.get.read": 180,
 	"held_run.list.read": 180,
-	"env_binding.list.read": 180,
+	"context_binding.list.read": 180,
 	"backend.list.read": 180,
 	"backend.get.read": 180,
 	"diagnostics.read": 30,
@@ -282,7 +283,7 @@ const ACCESS_LOG_COLD_DAYS = {
 	"event_log.detail.read": 730,
 	"event_log.payload.read": 730,
 	"run.payload.read": 730,
-	"env_var.list.read": 730,
+	"context_var.list.read": 730,
 	"source_override.list.read": 730,
 	"access_log.list.read": 730,
 	"secret.list.read": 730,
@@ -291,14 +292,14 @@ const ACCESS_LOG_COLD_DAYS = {
 	"run.manual_schedule": 730,
 	"run.trigger": 730,
 	"job.cancel": 730,
-	"environment.create": 730,
-	"environment.update": 730,
-	"environment.delete": 730,
-	"env_var.set": 730,
-	"env_var.delete": 730,
+	"context.create": 730,
+	"context.update": 730,
+	"context.delete": 730,
+	"context_var.set": 730,
+	"context_var.delete": 730,
 	"source_override.set": 730,
 	"source_override.delete": 730,
-	"env_binding.set": 730,
+	"context_binding.set": 730,
 	"held_run.approve": 730,
 	"held_run.auto_approve": 730,
 	"held_run.reject": 730,
@@ -316,6 +317,7 @@ const ACCESS_LOG_COLD_DAYS = {
 	"global_workflows.update": 730,
 	"org_settings.dashboard_write_policy.update": 730,
 	"cluster_name.update": 730,
+	"attestation.retry": 730,
 	"event_dlq.list.read": 180,
 	"event_dlq.retry": 730,
 	"event_dlq.discard": 730,

package/dist/context/host-match.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Identity facts of a single fan-out child, matched against a binding's
+ * `host_pattern`. `agentId` / `host` are the stable dispatch identity; `labels`
+ * is the host's label set. The union of all three is the match target.
+ */
+export interface HostFacts {
+    agentId: string;
+    host: string;
+    labels: readonly string[];
+}
+/**
+ * Whether a fan-out child's identity facts satisfy a binding's `host_pattern`.
+ *
+ * `'**'` / empty matches every host. Otherwise the pattern is compiled once
+ * (exact / glob / regex, same selector grammar as `runsOnAll`) and tested
+ * against the union `[agentId, host, ...labels]` — true if any element matches.
+ */
+export declare function matchHostPattern(facts: HostFacts, pattern: string): boolean;
+/**
+ * Rank a `host_pattern` by specificity for precedence: an exact literal (2)
+ * beats a glob/regex (1), which beats `'**'`/empty (0). Used to let a per-host
+ * binding override a fleet-wide one on a key collision.
+ */
+export declare function hostSpecificity(pattern: string): number;
+//# sourceMappingURL=host-match.d.ts.map

package/dist/{environment → context}/host-match.js

@@ -1,7 +1,7 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import { matcherMatches } from "../labels-match.js";
 import { assertSafeRegex, toLabelMatcher } from "../labels/compile.js";
-//#region src/environment/host-match.ts
+//#region src/context/host-match.ts
 /** `'**'`, empty, or absent means "matches every host". */
 function matchesAllHosts(pattern) {
 	return pattern === "" || pattern === "**";

package/dist/context/index.d.ts

@@ -0,0 +1,6 @@
+export type { Context, ContextBinding, ContextVariable, ContextSourceOverride, ScopedSecret, HeldRun, ProtectionGateResult, TrustTier, } from './types.js';
+export { TrustTierSchema } from './types.js';
+export { resolveSecretsForContext, matchScopePattern, stripScopePrefix } from './scope-resolver.js';
+export type { HostFacts } from './host-match.js';
+export { mergeOrderedMaps, ContextGateRejectReason } from './multi-context.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/context/index.js

@@ -0,0 +1,5 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { TrustTierSchema } from "./types.js";
+import { matchScopePattern, resolveSecretsForContext, stripScopePrefix } from "./scope-resolver.js";
+import { ContextGateRejectReason, mergeOrderedMaps } from "./multi-context.js";
+export { ContextGateRejectReason, TrustTierSchema, matchScopePattern, mergeOrderedMaps, resolveSecretsForContext, stripScopePrefix };

package/dist/context/multi-context.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Multi-context merge helpers shared across the orchestrator dispatch path.
+ *
+ * A job may bind several contexts in order; their resolved
+ * secrets/variables are folded last-wins (a later context's key overrides an
+ * earlier one) and their protection gates combine all-must-pass. This module is
+ * browser-safe (pure functions + a Zod enum, no Node built-ins) so it can be
+ * exported from the engine context barrel.
+ */
+import { z } from 'zod';
+/**
+ * Reason a single bound context rejects a run under all-must-pass
+ * aggregation. Used to name which context and which rule blocked dispatch.
+ */
+export declare const ContextGateRejectReason: z.ZodEnum<{
+    branch_restricted: "branch_restricted";
+    trigger_filtered: "trigger_filtered";
+    repo_unmatched: "repo_unmatched";
+    trust_too_low: "trust_too_low";
+    context_disabled: "context_disabled";
+    context_not_found: "context_not_found";
+}>;
+export type ContextGateRejectReason = z.infer<typeof ContextGateRejectReason>;
+/**
+ * Fold an ordered list of per-context resolved maps into one. Later entries
+ * override earlier keys (last-wins), matching the documented merge order for
+ * `contexts: [...]`.
+ */
+export declare function mergeOrderedMaps(maps: ReadonlyArray<Record<string, string>>): Record<string, string>;
+//# sourceMappingURL=multi-context.d.ts.map

package/dist/context/multi-context.js

@@ -0,0 +1,38 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { z } from "zod";
+//#region src/context/multi-context.ts
+/**
+* Multi-context merge helpers shared across the orchestrator dispatch path.
+*
+* A job may bind several contexts in order; their resolved
+* secrets/variables are folded last-wins (a later context's key overrides an
+* earlier one) and their protection gates combine all-must-pass. This module is
+* browser-safe (pure functions + a Zod enum, no Node built-ins) so it can be
+* exported from the engine context barrel.
+*/
+/**
+* Reason a single bound context rejects a run under all-must-pass
+* aggregation. Used to name which context and which rule blocked dispatch.
+*/
+const ContextGateRejectReason = z.enum([
+	"branch_restricted",
+	"trigger_filtered",
+	"repo_unmatched",
+	"trust_too_low",
+	"context_disabled",
+	"context_not_found"
+]);
+/**
+* Fold an ordered list of per-context resolved maps into one. Later entries
+* override earlier keys (last-wins), matching the documented merge order for
+* `contexts: [...]`.
+*/
+function mergeOrderedMaps(maps) {
+	const out = {};
+	for (const m of maps) Object.assign(out, m);
+	return out;
+}
+//#endregion
+export { ContextGateRejectReason, mergeOrderedMaps };
+
+//# sourceMappingURL=multi-context.js.map

package/dist/context/scope-resolver.d.ts

@@ -0,0 +1,46 @@
+import type { ContextBinding, ScopedSecret } from './types.js';
+import { type HostFacts } from './host-match.js';
+export type { HostFacts } from './host-match.js';
+/**
+ * Check whether a scope string matches a pattern.
+ *
+ * Supports exact match and glob patterns (via picomatch).
+ * Scope paths use '/' as separator (e.g., 'aws/prod/db').
+ *
+ * For prefixed scopes (e.g., 'pg:aws/prod'), the pattern may be prefixed too
+ * (e.g., 'pg:**'). In this case, the backend prefix must match exactly and
+ * the path portion is matched separately against the glob. This is needed
+ * because picomatch's '**' requires '/' separators — 'pg:**' wouldn't match
+ * 'pg:aws/prod' without splitting on the colon.
+ */
+export declare function matchScopePattern(scope: string, pattern: string): boolean;
+/**
+ * Strip the backend prefix from a scope string.
+ * Prefixed scopes have the form "backendName:path" (e.g., "pg:aws/prod").
+ * Returns the path after the first colon, or the full scope if no prefix.
+ */
+export declare function stripScopePrefix(scope: string): string;
+/**
+ * Resolve secrets for a context by matching bindings against scoped secrets.
+ *
+ * Takes already-filtered bindings (for the target context). For each binding,
+ * finds secrets whose (substituted) scope matches the binding's scopePattern via
+ * picomatch. When multiple scopes provide the same key, precedence is the tuple
+ * `(host specificity, scope depth)` — a per-host binding (exact host) overrides a
+ * fleet-wide one, then longest scope path wins. Scope depth is computed AFTER
+ * stripping the backend prefix.
+ *
+ * When `hostFacts` is supplied (a fan-out child's identity), each binding is
+ * gated by its `host_pattern` and its `scope_pattern` is templated per-child
+ * (`${agentId}`/`${host}`/`${label:NAME}`). When omitted, only fleet-wide
+ * (`'**'`/NULL) non-templated bindings contribute — preserving the workflow-level
+ * (no-host) behaviour.
+ *
+ * @param bindings - Bindings already filtered for the target context
+ * @param allSecrets - All scoped secrets in the org
+ * @param decryptFn - Pure decryption function (keeps this module crypto-free)
+ * @param hostFacts - Optional fan-out child identity for per-host resolution
+ * @returns Flat record of decrypted secret key-value pairs
+ */
+export declare function resolveSecretsForContext(bindings: ContextBinding[], allSecrets: ScopedSecret[], decryptFn: (s: ScopedSecret) => string, hostFacts?: HostFacts): Record<string, string>;
+//# sourceMappingURL=scope-resolver.d.ts.map

package/dist/{environment → context}/scope-resolver.js

@@ -2,7 +2,7 @@ import "../rolldown-runtime-ClRpJifh.js";
 import { hostSpecificity, matchHostPattern } from "./host-match.js";
 import { substituteScopePattern } from "./scope-template.js";
 import picomatch from "picomatch";
-//#region src/environment/scope-resolver.ts
+//#region src/context/scope-resolver.ts
 /**
 * Check whether a scope string matches a pattern.
 *
@@ -70,9 +70,9 @@ function candidateWins(c, existing) {
 	return c.scopeDepth > existing.scopeDepth;
 }
 /**
-* Resolve secrets for an environment by matching bindings against scoped secrets.
+* Resolve secrets for a context by matching bindings against scoped secrets.
 *
-* Takes already-filtered bindings (for the target environment). For each binding,
+* Takes already-filtered bindings (for the target context). For each binding,
 * finds secrets whose (substituted) scope matches the binding's scopePattern via
 * picomatch. When multiple scopes provide the same key, precedence is the tuple
 * `(host specificity, scope depth)` — a per-host binding (exact host) overrides a
@@ -85,13 +85,13 @@ function candidateWins(c, existing) {
 * (`'**'`/NULL) non-templated bindings contribute — preserving the workflow-level
 * (no-host) behaviour.
 *
-* @param bindings - Bindings already filtered for the target environment
+* @param bindings - Bindings already filtered for the target context
 * @param allSecrets - All scoped secrets in the org
 * @param decryptFn - Pure decryption function (keeps this module crypto-free)
 * @param hostFacts - Optional fan-out child identity for per-host resolution
 * @returns Flat record of decrypted secret key-value pairs
 */
-function resolveSecretsForEnvironment(bindings, allSecrets, decryptFn, hostFacts) {
+function resolveSecretsForContext(bindings, allSecrets, decryptFn, hostFacts) {
 	const resolved = /* @__PURE__ */ new Map();
 	for (const binding of bindings) {
 		const scopePattern = bindingScopeForHost(binding, hostFacts);
@@ -112,6 +112,6 @@ function resolveSecretsForEnvironment(bindings, allSecrets, decryptFn, hostFacts
 	return result;
 }
 //#endregion
-export { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix };
+export { matchScopePattern, resolveSecretsForContext, stripScopePrefix };
 
 //# sourceMappingURL=scope-resolver.js.map

package/dist/context/scope-template.d.ts

@@ -0,0 +1,18 @@
+import type { HostFacts } from './host-match.js';
+/**
+ * Substitute `${agentId}` / `${host}` / `${label:NAME}` placeholders in a
+ * binding's `scope_pattern` with a fan-out child's identity, so one templated
+ * binding selects each host's own subtree (`prod/hosts/${agentId}/**`).
+ *
+ * Returns the substituted pattern, or `null` when the binding must be **skipped
+ * for this host** because either:
+ * - a referenced variable is unresolved (a missing `${label:NAME}`), or
+ * - a substituted value is unsafe — it contains anything outside
+ *   `[A-Za-z0-9._-]` (a `/` path separator or a glob metacharacter), which
+ *   could let a hostname/label value escape its segment or inject a pattern.
+ *
+ * A multi-valued label resolves to its lexicographic-first value
+ * (deterministic). A pattern with no placeholders is returned unchanged.
+ */
+export declare function substituteScopePattern(pattern: string, facts: HostFacts): string | null;
+//# sourceMappingURL=scope-template.d.ts.map

package/dist/{environment → context}/scope-template.js

@@ -1,5 +1,5 @@
 import "../rolldown-runtime-ClRpJifh.js";
-//#region src/environment/scope-template.ts
+//#region src/context/scope-template.ts
 /** A substituted value must be a single literal path segment — no `/` or glob. */
 const SAFE_SEGMENT = /^[A-Za-z0-9._-]+$/;
 const PLACEHOLDER = /\$\{(agentId|host|label:[^}]+)\}/g;

package/dist/context/types.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Context types for KiCI's named-context model.
+ *
+ * Contexts are org-level entities that group secrets, variables,
+ * and protection rules for deployment targets (dev, staging, production).
+ */
+import { z } from 'zod';
+import type { ApproverClause } from '../approval/types.js';
+/** Context entity — org-level deployment target with protection rules. */
+export interface Context {
+    id: string;
+    orgId: string;
+    name: string;
+    type: 'fixed' | 'glob';
+    globPattern: string | null;
+    branchRestrictions: string[];
+    triggerTypeFilters: string[];
+    repoPatterns: string[];
+    concurrencyLimit: number | null;
+    concurrencyStrategy: 'queue' | 'cancel-pending';
+    concurrencyTimeoutMs: number;
+    requiredReviewers: string[] | null;
+    waitTimerSeconds: number | null;
+    holdExpirySeconds: number;
+    /** Minimum trust tier required for CI execution in this context. */
+    minimumTrust?: 'known' | 'trusted';
+    /** Whether this context allows local (no-remote) executions. Default false. */
+    allowLocalExecution?: boolean;
+    enabled: boolean;
+    createdAt: string;
+    updatedAt: string;
+    createdBy: string;
+}
+/** Scoped secret — individual secret with a scope path for precedence resolution. */
+export interface ScopedSecret {
+    id: string;
+    orgId: string;
+    scope: string;
+    key: string;
+    encryptedValue: string;
+    backendType: 'pg' | 'vault';
+    keyVersion: number;
+    createdAt: string;
+    updatedAt: string;
+}
+/** Binding that maps a scope pattern to a context. */
+export interface ContextBinding {
+    id: string;
+    orgId: string;
+    contextId: string;
+    scopePattern: string;
+    /**
+     * Host selector this binding applies to (exact / glob / regex, matched
+     * against a fan-out child's agentId / hostname / labels). `'**'` matches
+     * every host, preserving fleet-wide behaviour for bindings with no host
+     * scope.
+     */
+    hostPattern: string;
+    createdAt: string;
+}
+/** Non-secret key-value config per context, with optional lock. */
+export interface ContextVariable {
+    id: string;
+    orgId: string;
+    contextId: string;
+    key: string;
+    value: string;
+    locked: boolean;
+    createdAt: string;
+    updatedAt: string;
+}
+/** Per-source override for a context variable. */
+export interface ContextSourceOverride {
+    id: string;
+    orgId: string;
+    contextId: string;
+    routingKey: string;
+    key: string;
+    value: string;
+    createdAt: string;
+    updatedAt: string;
+}
+/** Trust tier for contributor-based CI execution gating (single source of truth). */
+export declare const TrustTierSchema: z.ZodEnum<{
+    unknown: "unknown";
+    known: "known";
+    trusted: "trusted";
+}>;
+export type TrustTier = z.infer<typeof TrustTierSchema>;
+/** Held run record for protection gate enforcement. */
+export interface HeldRun {
+    id: string;
+    orgId: string;
+    runId: string;
+    jobId: string;
+    contextId: string;
+    holdType: 'reviewer' | 'timer' | 'concurrency' | 'security';
+    status: 'pending' | 'approved' | 'rejected' | 'expired';
+    reason: string | null;
+    approvedBy: string | null;
+    createdAt: string;
+    expiresAt: string | null;
+    resolvedAt: string | null;
+}
+/** Result from the protection gate pipeline evaluation. */
+export interface ProtectionGateResult {
+    action: 'pass' | 'reject' | 'hold' | 'queue' | 'wait';
+    reason?: string;
+    holdUntil?: string;
+    holdType?: 'reviewer' | 'timer' | 'concurrency' | 'security';
+    /**
+     * Approver clauses for a reviewer hold, mapped from the context's
+     * `requiredReviewers`. Each reviewer string maps to a `{ user }` clause
+     * (team-named reviewers are a documented follow-up). Empty/undefined means
+     * "any approval-capable member".
+     */
+    clauses?: ApproverClause[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/{environment → context}/types.js

@@ -1,10 +1,10 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
-//#region src/environment/types.ts
+//#region src/context/types.ts
 /**
-* Environment types for KiCI's deployment environment model.
+* Context types for KiCI's named-context model.
 *
-* Environments are org-level entities that group secrets, variables,
+* Contexts are org-level entities that group secrets, variables,
 * and protection rules for deployment targets (dev, staging, production).
 */
 /** Trust tier for contributor-based CI execution gating (single source of truth). */

package/dist/dev-ops/operations.d.ts

@@ -21,7 +21,7 @@
  * Browser-safe: data + TypeScript types only, no Node imports, so it lives in
  * the engine barrel importable by the web UI, the CLI, and the Platform.
  */
-export type DeveloperOpDomain = 'runs' | 'workflows' | 'environments' | 'secrets' | 'held-runs' | 'diagnostics' | 'orchestrators' | 'sources' | 'dlq' | 'attestations' | 'activity' | 'orgs';
+export type DeveloperOpDomain = 'runs' | 'workflows' | 'contexts' | 'secrets' | 'held-runs' | 'diagnostics' | 'orchestrators' | 'sources' | 'dlq' | 'attestations' | 'activity' | 'orgs';
 export type DeveloperOpKind = 'read' | 'write';
 /** Which of the three entrypoints a developer op is (or should be) exposed on. */
 export interface DeveloperOpEntrypoints {

package/dist/dev-ops/operations.js

@@ -88,7 +88,7 @@ const DEVELOPER_OPERATIONS = [
 		mcp: false,
 		ui: true
 	}, false, null),
-	op("environments.delete", "environments", "write", {
+	op("contexts.delete", "contexts", "write", {
 		http: true,
 		cli: false,
 		mcp: false,

package/dist/env/environment-allowlist.d.ts

@@ -42,4 +42,27 @@ export declare const AGENT_REQUIRED_KICI_VARS: readonly ["KICI_ORCHESTRATOR_URL"
  *   -> HTTP_PROXY=http://proxy:3128 in the agent process
  */
 export declare const KICI_AGENT_ENV_PREFIX: "KICI_AGENT_ENV_";
+/**
+ * Non-`KICI_`-prefixed environment variables that are the agent's / orchestrator's
+ * own infrastructure secrets. These are scrubbed from a trusted-env passthrough
+ * in addition to the whole `KICI_*` namespace, so even a trusted fleet agent
+ * never leaks its control-plane credentials into a workflow step.
+ */
+export declare const TRUSTED_ENV_SCRUB_EXACT: readonly ["DATABASE_URL", "PLATFORM_TOKEN", "WEBHOOK_SECRET", "GITHUB_PRIVATE_KEY"];
+/**
+ * A variable that must NEVER reach a workflow step even under the trusted-env
+ * profile. The agent's entire `KICI_*` namespace (its orchestrator URL, agent
+ * token, secret key, bootstrap admin token, scaler internals, identity) is
+ * scrubbed, plus the non-`KICI_` infra-secret denylist above. So "trusted"
+ * means "host env yes, the agent's KiCI identity no".
+ */
+export declare function isTrustedEnvScrubbed(key: string): boolean;
+/**
+ * Build the trusted-env passthrough set: every defined entry of `source` whose
+ * key is not scrubbed by `isTrustedEnvScrubbed`. Used by both env-narrowing
+ * layers (scaler → agent process, agent → step) when the trusted-env profile is
+ * active, so the ambient host env reaches the step minus the agent's own KiCI
+ * identity/operational secrets.
+ */
+export declare function buildTrustedPassthroughEnv(source: Record<string, string | undefined>): Record<string, string>;
 //# sourceMappingURL=environment-allowlist.d.ts.map