@kici-dev/orchestrator 0.0.0 → 0.1.2

package/dist/diagnostics/bundle-reader.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Debug bundle reader.
+ *
+ * Parses a diagnostic ZIP bundle and returns a structured summary
+ * for the inspect-bundle CLI command. Works offline -- no network
+ * access or running orchestrator needed.
+ */
+export interface BundleManifest {
+    version: string;
+    generated_at: string;
+    orchestrator_id?: string;
+    source?: string;
+    node_version: string;
+    platform: string;
+}
+export interface BundleSummary {
+    /** Bundle metadata. */
+    manifest: BundleManifest;
+    /** Diagnostic check results from the bundle. */
+    checkResults: Array<{
+        name: string;
+        status: 'pass' | 'warn' | 'fail';
+        message: string;
+        durationMs: number;
+    }>;
+    /** Number of checks that failed. */
+    errorCount: number;
+    /** Number of checks that warned. */
+    warningCount: number;
+    /** System information from the bundle. */
+    systemInfo: Record<string, unknown>;
+    /** Detected config issues (missing required fields, etc.). */
+    configIssues: string[];
+    /** Log file statistics (if logs were included). */
+    logSummary?: {
+        totalLines: number;
+        errors: number;
+        warnings: number;
+    };
+}
+/**
+ * Read and parse a debug bundle ZIP file.
+ *
+ * @param zipPath - Path to the ZIP file to parse
+ * @returns Structured summary of the bundle contents
+ */
+export declare function readDebugBundle(zipPath: string): Promise<BundleSummary>;
+//# sourceMappingURL=bundle-reader.d.ts.map

package/dist/diagnostics/bundle-writer.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Debug bundle writer.
+ *
+ * Creates a sanitized ZIP diagnostic bundle containing config (secrets redacted),
+ * recent logs, system info, metrics, cluster state, and execution data.
+ * This is the primary support tool -- operators run debug-bundle and share
+ * the ZIP for troubleshooting.
+ */
+import archiver from 'archiver';
+import type { DiagnosticDeps } from './types.js';
+export interface BundleOptions {
+    /** Where to write the ZIP. */
+    outputPath: string;
+    /** Orchestrator instance identifier. */
+    orchestratorId: string;
+    /** Raw orchestrator config (will be redacted). */
+    config: Record<string, unknown>;
+    /** Path to log files directory. */
+    logDir?: string;
+    /** Hours of logs to include (default: 4). */
+    logWindow?: number;
+    /** Dependencies for running diagnostic checks. */
+    diagnosticDeps: DiagnosticDeps;
+    /** URL for cluster health endpoint. */
+    clusterHealthUrl?: string;
+    /** URL for recent runs endpoint. */
+    recentRunsUrl?: string;
+}
+/**
+ * Redact config values using allowlist approach.
+ * Only known-safe fields are preserved; everything else becomes "****".
+ */
+export declare function redactConfig(obj: unknown, parentKey?: string): unknown;
+/**
+ * Create a debug bundle ZIP file.
+ *
+ * The bundle contains:
+ * - manifest.json: version, timestamp, orchestrator ID
+ * - config/config.json: redacted configuration
+ * - system/info.json: OS, Node, CPU, memory info
+ * - diagnostics/results.json: health check results
+ * - logs/: recent log files (if logDir provided)
+ * - logs/summary.json: log statistics
+ */
+export declare function createDebugBundle(options: BundleOptions): Promise<string>;
+/**
+ * Add log files from logDir to the archive, respecting MAX_LOG_BYTES cap
+ * and the logWindow time filter. Matches any `*.log` file in the directory,
+ * so the per-instance filename pattern produced by
+ * `buildLogFilename()` is picked up without additional configuration.
+ *
+ * Exported for reuse by the `kici-admin debug-bundle` CLI command, which
+ * runs outside the orchestrator process but still needs to include the
+ * same log files in its locally-assembled bundle.
+ */
+export declare function addLogsToArchive(archive: archiver.Archiver, logDir: string, logWindowHours: number): Promise<void>;
+//# sourceMappingURL=bundle-writer.d.ts.map

package/dist/diagnostics/checks/agents.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Agent connectivity diagnostic check.
+ *
+ * Reads the agent registry count and reports whether any agents
+ * are connected. Zero agents is a warning (not failure) since
+ * agents may be scaling up.
+ */
+import type { DiagnosticDeps, DiagnosticResult } from '../types.js';
+export declare function checkAgentConnectivity(deps: DiagnosticDeps): Promise<DiagnosticResult>;
+//# sourceMappingURL=agents.d.ts.map

package/dist/diagnostics/checks/certs.d.ts

@@ -0,0 +1,9 @@
+/**
+ * TLS certificate expiry diagnostic check.
+ *
+ * Reads a TLS certificate from the configured path and checks
+ * the not-after date. Warns if expiring within 30 days, fails if expired.
+ */
+import type { DiagnosticDeps, DiagnosticResult } from '../types.js';
+export declare function checkCertificateExpiry(deps: DiagnosticDeps): Promise<DiagnosticResult>;
+//# sourceMappingURL=certs.d.ts.map

package/dist/diagnostics/checks/config.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Config validity diagnostic check.
+ *
+ * Validates the current orchestrator config against key required fields.
+ * Uses a lightweight validation (not the full Zod schema) to avoid
+ * importing the entire config module.
+ */
+import type { DiagnosticDeps, DiagnosticResult } from '../types.js';
+export declare function checkConfigValidity(deps: DiagnosticDeps): Promise<DiagnosticResult>;
+//# sourceMappingURL=config.d.ts.map

package/dist/diagnostics/checks/db.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Database connectivity diagnostic check.
+ *
+ * Runs a simple SELECT 1 query to verify the database is reachable
+ * and reports latency.
+ */
+import type { DiagnosticDeps, DiagnosticResult } from '../types.js';
+export declare function checkDbConnectivity(deps: DiagnosticDeps): Promise<DiagnosticResult>;
+//# sourceMappingURL=db.d.ts.map

package/dist/diagnostics/checks/disk.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Disk space diagnostic check.
+ *
+ * Uses `df` command to check available disk space on the root partition.
+ * Thresholds: warn < 1GB, fail < 100MB.
+ */
+import type { DiagnosticDeps, DiagnosticResult } from '../types.js';
+export declare function checkDiskSpace(_deps: DiagnosticDeps): Promise<DiagnosticResult>;
+//# sourceMappingURL=disk.d.ts.map

package/dist/diagnostics/checks/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Diagnostic check registry.
+ *
+ * Exports the array of all diagnostic check functions
+ * in the order they should be displayed.
+ */
+import type { DiagnosticCheck } from '../types.js';
+import { checkDbConnectivity } from './db.js';
+import { checkWsToPlatform } from './ws.js';
+import { checkAgentConnectivity } from './agents.js';
+import { checkDiskSpace } from './disk.js';
+import { checkConfigValidity } from './config.js';
+import { checkCertificateExpiry } from './certs.js';
+/** All diagnostic checks in display order. */
+export declare const defaultChecks: DiagnosticCheck[];
+export { checkDbConnectivity, checkWsToPlatform, checkAgentConnectivity, checkDiskSpace, checkConfigValidity, checkCertificateExpiry, };
+//# sourceMappingURL=index.d.ts.map

package/dist/diagnostics/checks/ws.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Platform WebSocket connectivity diagnostic check.
+ *
+ * Attempts an HTTP(S) request to the Platform URL health endpoint
+ * to verify the relay is reachable.
+ */
+import type { DiagnosticDeps, DiagnosticResult } from '../types.js';
+export declare function checkWsToPlatform(deps: DiagnosticDeps): Promise<DiagnosticResult>;
+//# sourceMappingURL=ws.d.ts.map

package/dist/diagnostics/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Diagnostics module.
+ *
+ * Re-exports all diagnostic types, runner, checks, bundle writer, and bundle reader.
+ */
+export type { DiagnosticResult, DiagnosticDeps, DiagnosticCheck } from './types.js';
+export { runDiagnostics } from './runner.js';
+export type { RunDiagnosticsOptions } from './runner.js';
+export { createDebugBundle, redactConfig } from './bundle-writer.js';
+export type { BundleOptions } from './bundle-writer.js';
+export { readDebugBundle } from './bundle-reader.js';
+export type { BundleSummary, BundleManifest } from './bundle-reader.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/diagnostics/runner.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Diagnostic check runner.
+ *
+ * Executes all diagnostic checks in parallel with timeout safety.
+ * Each check runs independently -- a failing or timing out check
+ * does not prevent other checks from completing.
+ */
+import type { DiagnosticCheck, DiagnosticDeps, DiagnosticResult } from './types.js';
+/** Options for the diagnostic runner. */
+export interface RunDiagnosticsOptions {
+    /** Timeout per check in milliseconds. Default: 5000. */
+    timeoutMs?: number;
+}
+/**
+ * Run all diagnostic checks and return results.
+ *
+ * @param deps - Dependencies available to checks
+ * @param checks - Array of check functions (defaults to all 6 checks)
+ * @param options - Runner options (timeout, etc.)
+ * @returns Array of diagnostic results, one per check
+ */
+export declare function runDiagnostics(deps: DiagnosticDeps, checks?: DiagnosticCheck[], options?: RunDiagnosticsOptions): Promise<DiagnosticResult[]>;
+//# sourceMappingURL=runner.d.ts.map

package/dist/diagnostics/types.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Diagnostic health check types.
+ *
+ * Defines the shape of diagnostic results and check functions
+ * used by the diagnostic runner and CLI/HTTP interfaces.
+ */
+import type { Kysely } from 'kysely';
+import type { Database } from '../db/types.js';
+import type { AgentRegistry } from '../agent/registry.js';
+/** Result of a single diagnostic check. */
+export interface DiagnosticResult {
+    /** Human-readable check name (e.g., "Database connectivity"). */
+    name: string;
+    /** Check outcome: pass, warn, or fail. */
+    status: 'pass' | 'warn' | 'fail';
+    /** Short description of the result. */
+    message: string;
+    /** Optional structured details for debugging. */
+    details?: Record<string, unknown>;
+    /** How long the check took to run in milliseconds. */
+    durationMs: number;
+}
+/** Dependencies available to diagnostic checks. */
+export interface DiagnosticDeps {
+    /** DB connection (optional -- standalone mode may not have DB). */
+    db?: Kysely<Database>;
+    /** Platform WS URL (for connectivity check). */
+    platformUrl?: string;
+    /** Agent registry for checking connected agents. */
+    agentRegistry?: AgentRegistry;
+    /** Orchestrator config (for config validity check). */
+    config: Record<string, unknown>;
+    /** TLS cert path (for expiry check). */
+    tlsCertPath?: string;
+}
+/** A diagnostic check function. */
+export type DiagnosticCheck = (deps: DiagnosticDeps) => Promise<DiagnosticResult>;
+//# sourceMappingURL=types.d.ts.map

package/dist/entry-helpers.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Shared helpers for orchestrator entry points (server.ts and standalone.ts).
+ *
+ * Extracted to eliminate code duplication between the two entry points.
+ * Both entry points import these helpers instead of maintaining separate copies.
+ */
+import { type SourceProvider, SourceSubtype } from '@kici-dev/engine';
+import { ProviderRegistry } from './provider-registry.js';
+/**
+ * A provider source for Platform registration.
+ *
+ * `provider` is the coarse-grained Platform-routing family (`github` /
+ * `gitlab` / `bitbucket` / `generic`). `subtype` is the fine-grained
+ * source kind that survives all the way to the dashboard so universal-git,
+ * generic_webhook, and internal sources stay distinguishable. `name` is
+ * the human-readable label shown in the runs view + sources tab.
+ */
+export interface ProviderSource {
+    provider: SourceProvider;
+    routingKey: string;
+    name: string;
+    subtype: SourceSubtype;
+}
+/**
+ * Map a generic_webhook_sources `provider_type` (plus optional `git_config`
+ * presence) to the canonical {@link SourceSubtype}.
+ *
+ * Single source of truth for the orchestrator-side mapping — both the
+ * boot-time bulk registration (`server.ts`) and any future per-source
+ * register/update path (`platform-client.ts`) go through here so the
+ * subtype emitted to Platform stays consistent with what the dashboard
+ * eventually renders.
+ */
+export declare function genericProviderTypeToSubtype(providerType: string, options: {
+    hasGitConfig: boolean;
+}): SourceSubtype;
+/**
+ * Extract repo identifier (owner/repo) from a git clone URL.
+ * e.g., "https://github.com/myorg/myrepo.git" -> "myorg/myrepo"
+ */
+export declare function extractRepoIdentifier(repoUrl: string): string;
+/**
+ * Diff two provider source arrays by routingKey.
+ * Returns which sources were added and which were removed.
+ *
+ * Used during config reload to determine which source.register and
+ * source.deregister messages to send.
+ */
+export declare function diffProviderSources(oldSources: ProviderSource[], newSources: ProviderSource[]): {
+    added: ProviderSource[];
+    removed: ProviderSource[];
+};
+/**
+ * Register the internal provider bundle for E2E testing when the
+ * `internalProviderRepoPath` config field (KICI_INTERNAL_PROVIDER_REPO_PATH)
+ * is set.
+ *
+ * When the field is present, this overwrites the previously-registered
+ * `generic:default` bundle with one that has a lockFileFetcher and
+ * repoUrlBuilder (needed for the webhook pipeline to match triggers and
+ * dispatch jobs).
+ *
+ * When the field is not set, does nothing (leaves `generic:default` as-is).
+ *
+ * @returns true if the internal provider was registered, false otherwise
+ */
+export declare function registerInternalProviderIfConfigured(registry: ProviderRegistry, config: {
+    internalProviderRepoPath?: string;
+    internalProviderCloneUrl?: string;
+}): boolean;
+/**
+ * Decide whether the local orchestrator can serve a `generic_webhook_sources`
+ * row with the given `provider_type`. Used at boot (and any future reload) to
+ * filter the source.register payload sent to Platform — if a peer can't serve
+ * the row, advertising it would invite Platform's least-loaded relay to pick
+ * this peer and drop the webhook silently in a pipeline whose lock-file
+ * fetcher returns null.
+ *
+ * - `'generic'` / `'universal-git'` → always servable (the bundles register
+ *   without filesystem dependencies; per-row failures during universal-git
+ *   bundle registration are already isolated in orchestrator-core.ts).
+ * - `'internal'` → only servable when `internalProviderRepoPath` is set, the
+ *   path exists on disk, and is a directory. This mirrors the fail-fast
+ *   guard in `registerInternalProviderIfConfigured`. The check is binary
+ *   per peer: a single `KICI_INTERNAL_PROVIDER_REPO_PATH` backs every
+ *   internal source on that peer (per-source `repoIdentifier`s nest under
+ *   the same base dir).
+ * - Any unknown provider_type returns false to fail closed.
+ */
+export declare function canServeGenericProviderType(providerType: string, config: {
+    internalProviderRepoPath?: string;
+}): boolean;
+//# sourceMappingURL=entry-helpers.d.ts.map

package/dist/environments/binding-store.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Binding store -- scope-to-environment binding CRUD.
+ *
+ * Bindings map scope patterns (e.g. 'aws/prod/**') to environments,
+ * controlling which scoped secrets are available in each environment.
+ */
+import type { Kysely } from 'kysely';
+import type { Database, EnvironmentBinding } from '../db/types.js';
+/**
+ * Data access layer for environment bindings.
+ */
+export declare class BindingStore {
+    private readonly db;
+    constructor(db: Kysely<Database>);
+    /** List all bindings for an environment. */
+    list(orgId: string, environmentId: string): Promise<EnvironmentBinding[]>;
+    /**
+     * Replace all bindings for an environment in a transaction.
+     *
+     * Deletes existing bindings and inserts the new set atomically.
+     * Pass an empty array to clear all bindings.
+     */
+    set(orgId: string, environmentId: string, scopePatterns: string[]): Promise<void>;
+    /** Find bindings for an environment (alias for list, used by secret resolver). */
+    findBindingsForEnvironment(orgId: string, environmentId: string): Promise<EnvironmentBinding[]>;
+}
+//# sourceMappingURL=binding-store.d.ts.map

package/dist/environments/environment-store.d.ts

@@ -0,0 +1,74 @@
+import { type Kysely } from 'kysely';
+import type { Environment as EngineEnvironment } from '@kici-dev/engine';
+import type { Database, Environment } from '../db/types.js';
+/**
+ * Map a DB environment row (snake_case) to the engine Environment type (camelCase).
+ *
+ * Kysely returns JSONB columns as strings; this function parses them into arrays.
+ */
+export declare function toEnvironment(row: Environment): EngineEnvironment;
+/** Fields accepted when creating an environment. */
+export interface EnvironmentCreateInput {
+    name: string;
+    type?: 'fixed' | 'glob';
+    globPattern?: string | null;
+    branchRestrictions?: string[];
+    triggerTypeFilters?: string[];
+    repoPatterns?: string[];
+    concurrencyLimit?: number | null;
+    concurrencyStrategy?: 'queue' | 'cancel-pending';
+    concurrencyTimeoutMs?: number;
+    requiredReviewers?: string[] | null;
+    waitTimerSeconds?: number | null;
+    holdExpirySeconds?: number;
+    minimumTrust?: 'known' | 'trusted' | null;
+    allowLocalExecution?: boolean;
+    enabled?: boolean;
+    createdBy?: string | null;
+}
+/** Fields accepted when updating an environment. */
+export interface EnvironmentUpdateInput {
+    name?: string;
+    type?: 'fixed' | 'glob';
+    globPattern?: string | null;
+    branchRestrictions?: string[];
+    triggerTypeFilters?: string[];
+    repoPatterns?: string[];
+    concurrencyLimit?: number | null;
+    concurrencyStrategy?: 'queue' | 'cancel-pending';
+    concurrencyTimeoutMs?: number;
+    requiredReviewers?: string[] | null;
+    waitTimerSeconds?: number | null;
+    holdExpirySeconds?: number;
+    minimumTrust?: 'known' | 'trusted' | null;
+    allowLocalExecution?: boolean;
+    enabled?: boolean;
+}
+/**
+ * Data access layer for environments.
+ */
+export declare class EnvironmentStore {
+    private readonly db;
+    constructor(db: Kysely<Database>);
+    /** List all environments for an org, ordered by name. */
+    list(orgId: string): Promise<Environment[]>;
+    /** Get a single environment by org + id. Returns null if not found. */
+    get(orgId: string, id: string): Promise<Environment | null>;
+    /** Get a single environment by org + name. Returns null if not found. */
+    getByName(orgId: string, name: string): Promise<Environment | null>;
+    /** Create a new environment. Returns the created row. */
+    create(orgId: string, data: EnvironmentCreateInput): Promise<Environment>;
+    /** Update an environment. Returns the updated row, or null if not found. */
+    update(orgId: string, id: string, updates: EnvironmentUpdateInput): Promise<Environment | null>;
+    /** Delete an environment. Cascade deletes bindings, variables, and overrides. */
+    delete(orgId: string, id: string): Promise<boolean>;
+    /**
+     * Match an environment name against org environments.
+     *
+     * First tries exact name match (for fixed environments).
+     * If no exact match, scans glob-type environments and uses picomatch.
+     * Returns the first matching environment or null.
+     */
+    matchEnvironment(orgId: string, name: string): Promise<Environment | null>;
+}
+//# sourceMappingURL=environment-store.d.ts.map

package/dist/environments/held-runs.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Held run store -- lifecycle management for runs held by protection gates.
+ *
+ * Manages the lifecycle: pending -> approved/rejected/expired.
+ */
+import { type Kysely } from 'kysely';
+import type { Database, HeldRun } from '../db/types.js';
+/** Status values for held runs (held_runs table). */
+export declare enum HeldRunStatus {
+    Pending = "pending",
+    Approved = "approved",
+    Rejected = "rejected",
+    Expired = "expired",
+    Released = "released"
+}
+/** Data required to create a held run. */
+export interface CreateHeldRunData {
+    runId: string;
+    jobId: string;
+    environmentId: string;
+    holdType: string;
+    reason: string;
+    expiresAt: Date;
+    /** Queue type: 'environment' (default) or 'security'. */
+    queueType?: 'environment' | 'security';
+}
+/** Options for listing held runs. */
+export interface ListHeldRunsOptions {
+    status?: string;
+    limit?: number;
+}
+/** Manages held run lifecycle (pending -> approved/rejected/expired). */
+export declare class HeldRunStore {
+    private readonly db;
+    constructor(db: Kysely<Database>);
+    /** Create a new held run with pending status. */
+    create(orgId: string, data: CreateHeldRunData): Promise<HeldRun>;
+    /** Approve a pending held run. Throws if not found or not pending. */
+    approve(orgId: string, heldRunId: string, approvedBy: string): Promise<HeldRun>;
+    /** Reject a pending held run. Throws if not found or not pending. */
+    reject(orgId: string, heldRunId: string, reason?: string): Promise<HeldRun>;
+    /** List pending held runs for an org, ordered by creation time. */
+    listPending(orgId: string): Promise<HeldRun[]>;
+    /** List held runs for an org with optional filters. */
+    listAll(orgId: string, options?: ListHeldRunsOptions): Promise<HeldRun[]>;
+    /** List held runs for an org filtered by queue type with optional filters. */
+    listByQueueType(orgId: string, queueType: 'environment' | 'security', options?: ListHeldRunsOptions): Promise<HeldRun[]>;
+    /**
+     * Approve a pending held run, enforcing queue_type boundary.
+     * Prevents environment approvals from approving security holds and vice versa.
+     * Throws if not found, not pending, or queue_type mismatch.
+     */
+    approveByQueueType(orgId: string, heldRunId: string, approvedBy: string, queueType: 'environment' | 'security'): Promise<HeldRun>;
+    /** Get a held run by run ID and job ID. Returns null if not found. */
+    getByRunAndJob(orgId: string, runId: string, jobId: string): Promise<HeldRun | null>;
+    /**
+     * Expire overdue pending runs. Called by the stale detector.
+     * Sets status to 'expired' and resolved_at to now() for all
+     * pending runs past their expires_at.
+     * Returns the number of expired runs.
+     */
+    expireOverdue(): Promise<number>;
+}
+//# sourceMappingURL=held-runs.d.ts.map

package/dist/environments/index.d.ts

@@ -0,0 +1,10 @@
+export { EnvironmentStore, type EnvironmentCreateInput, type EnvironmentUpdateInput, } from './environment-store.js';
+export { BindingStore } from './binding-store.js';
+export { VariableStore } from './variable-store.js';
+export { HeldRunStore, type CreateHeldRunData, type ListHeldRunsOptions } from './held-runs.js';
+export { evaluateProtectionRules, type JobDispatchContext } from './protection/pipeline.js';
+export { evaluateBranchGate } from './protection/branch-gate.js';
+export { evaluateConcurrencyGate } from './protection/concurrency-gate.js';
+export { evaluateReviewerGate } from './protection/reviewer-gate.js';
+export { evaluateWaitTimerGate } from './protection/wait-timer-gate.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/environments/protection/branch-gate.d.ts

@@ -0,0 +1,5 @@
+import type { Environment, ProtectionGateResult } from '@kici-dev/engine';
+import type { JobDispatchContext } from './pipeline.js';
+/** Evaluate branch restrictions, trigger type filters, and repo patterns. */
+export declare function evaluateBranchGate(env: Environment, ctx: JobDispatchContext): ProtectionGateResult;
+//# sourceMappingURL=branch-gate.d.ts.map

package/dist/environments/protection/concurrency-gate.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Concurrency gate -- checks concurrency limits.
+ */
+import type { Environment, ProtectionGateResult } from '@kici-dev/engine';
+/** Evaluate concurrency limits for the environment. */
+export declare function evaluateConcurrencyGate(env: Environment, currentRunningCount: number, _concurrencyGroup: string): ProtectionGateResult;
+//# sourceMappingURL=concurrency-gate.d.ts.map

package/dist/environments/protection/pipeline.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Protection gate pipeline -- evaluates gates sequentially.
+ *
+ * Gates evaluated in order: branch -> trust -> concurrency -> reviewer -> timer.
+ * First non-pass result stops evaluation.
+ */
+import type { Environment, ProtectionGateResult, TrustTier } from '@kici-dev/engine';
+/** Context needed for protection gate evaluation. */
+export interface JobDispatchContext {
+    branch: string;
+    triggerType: string;
+    repository: string;
+    runId: string;
+    jobId: string;
+}
+/** Evaluate all protection rules for an environment. */
+export declare function evaluateProtectionRules(env: Environment, ctx: JobDispatchContext, currentRunningCount: number, concurrencyGroup: string, trustTier?: TrustTier): Promise<ProtectionGateResult>;
+//# sourceMappingURL=pipeline.d.ts.map

package/dist/environments/protection/reviewer-gate.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Reviewer gate -- checks required reviewers.
+ */
+import type { Environment, ProtectionGateResult } from '@kici-dev/engine';
+/** Evaluate reviewer requirements for the environment. */
+export declare function evaluateReviewerGate(env: Environment): ProtectionGateResult;
+//# sourceMappingURL=reviewer-gate.d.ts.map

package/dist/environments/protection/trust-gate.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Trust gate -- checks contributor trust tier against environment minimumTrust.
+ */
+import type { Environment, ProtectionGateResult, TrustTier } from '@kici-dev/engine';
+/** Evaluate minimumTrust requirements for the environment. */
+export declare function evaluateTrustGate(env: Environment, trustTier: TrustTier | undefined): ProtectionGateResult;
+//# sourceMappingURL=trust-gate.d.ts.map

package/dist/environments/protection/wait-timer-gate.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Wait timer gate -- checks wait timer configuration.
+ */
+import type { Environment, ProtectionGateResult } from '@kici-dev/engine';
+/** Evaluate wait timer for the environment. */
+export declare function evaluateWaitTimerGate(env: Environment): ProtectionGateResult;
+//# sourceMappingURL=wait-timer-gate.d.ts.map

package/dist/environments/variable-store.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Variable store -- environment variable CRUD with lock enforcement.
+ *
+ * Manages org-level environment variables and per-source overrides.
+ * Lock enforcement: locked org vars cannot be overridden by source overrides.
+ */
+import { type Kysely } from 'kysely';
+import type { Database, EnvironmentVariable, EnvironmentSourceOverride } from '../db/types.js';
+/**
+ * Data access layer for environment variables and source overrides.
+ */
+export declare class VariableStore {
+    private readonly db;
+    constructor(db: Kysely<Database>);
+    /** List all org-level variables for an environment. */
+    listVars(orgId: string, environmentId: string): Promise<EnvironmentVariable[]>;
+    /** Upsert an org-level variable. */
+    setVar(orgId: string, environmentId: string, key: string, value: string, locked?: boolean): Promise<void>;
+    /** Delete an org-level variable. */
+    deleteVar(orgId: string, environmentId: string, key: string): Promise<void>;
+    /** List source overrides for a specific source (routing key). */
+    listSourceOverrides(orgId: string, environmentId: string, routingKey: string): Promise<EnvironmentSourceOverride[]>;
+    /** Upsert a source override. */
+    setSourceOverride(orgId: string, environmentId: string, routingKey: string, key: string, value: string): Promise<void>;
+    /** Delete a source override. */
+    deleteSourceOverride(orgId: string, environmentId: string, routingKey: string, key: string): Promise<void>;
+    /**
+     * Get resolved variables for an environment, optionally merged with source overrides.
+     *
+     * Merge rules:
+     * - Org-level vars form the base
+     * - Source overrides can add new keys and override unlocked org vars
+     * - Locked org vars are NOT overridden by source overrides
+     *
+     * @param routingKey - If provided, source overrides are merged in
+     */
+    getResolvedVars(orgId: string, environmentId: string, routingKey?: string): Promise<Record<string, string>>;
+}
+//# sourceMappingURL=variable-store.d.ts.map