@kici-dev/orchestrator 0.1.26 → 0.1.27

package/dist/app.d.ts

@@ -38,6 +38,7 @@ import type { PendingInitTracker } from './cache/index.js';
 import type { PendingDynamicTracker } from './cache/index.js';
 import type { CacheStorage } from './storage/types.js';
 import type { ProvenanceTrustRoot } from './provenance/trust-root.js';
+import type { LocalSigner } from './oidc/local-dev-signer.js';
 import { type CheckRunReporter } from './reporting/check-run-reporter.js';
 import type { ExecutionTracker } from './reporting/execution-tracker.js';
 import type { LogWriter } from './reporting/log-writer.js';
@@ -71,9 +72,9 @@ import type { EventLogWriter } from './webhook/event-log.js';
 import type { AccessLogWriter } from './audit/access-log.js';
 import type { GenericSourceManager } from './webhook/generic-sources.js';
 import type { TrustStore } from './events/trust-store.js';
-import type { EnvironmentStore } from './environments/environment-store.js';
-import type { VariableStore } from './environments/variable-store.js';
-import type { HeldRunStore } from './environments/held-runs.js';
+import type { ContextStore } from './contexts/context-store.js';
+import type { VariableStore } from './contexts/variable-store.js';
+import type { HeldRunStore } from './contexts/held-runs.js';
 import type { StepApprovalBridge } from './approvals/step-approval-bridge.js';
 import type { ContributorCache } from './security/contributor-cache.js';
 import { AgentMetricsAggregator } from './metrics/agent-metrics-aggregator.js';
@@ -132,6 +133,13 @@ export interface AppDependencies {
     cacheStorage?: CacheStorage;
     /** Provenance trust root used to verify build-provenance bundles at ingest. */
     provenanceTrustRoot?: ProvenanceTrustRoot;
+    /**
+     * In-process dev-signed identity signer for the offline local dev plane.
+     * Present ONLY in independent mode with KICI_INDEPENDENT_IDENTITY=1. When set
+     * (and NOT Platform-connected), the local mint path for `OIDC_TOKEN_REQUEST_METHOD`
+     * is registered so `ctx.kici.oidc.token()` mints a `kici-local` dev token.
+     */
+    localOidcSigner?: LocalSigner;
     /**
      * Filesystem cache backend handle. Only set when KICI_STORAGE_TYPE is
      * `filesystem`. Drives the /api/v1/cache/blob/* HTTP route that serves and
@@ -141,6 +149,7 @@ export interface AppDependencies {
         basePath: string;
         signingSecret: string;
         ttlMs: number;
+        maxUploadBytes: number;
     };
     /** Pending build tracker for build-then-execute coordination. Optional — requires bundle cache. */
     pendingBuilds?: PendingBuildTracker;
@@ -208,7 +217,7 @@ export interface AppDependencies {
     /** Registration index for admin registration routes. Optional -- mounted when registration system is initialized. */
     registrationIndex?: RegistrationIndex;
     /** Environment store for resolving environment configs. Optional -- if not set, environment resolution is inactive. */
-    environmentStore?: EnvironmentStore;
+    contextStore?: ContextStore;
     /** Variable store for resolving environment variables. Optional -- if not set, environment vars are not merged. */
     variableStore?: VariableStore;
     /** Held run store for persisting protection rule holds. Optional -- if not set, holds are not persisted. */

package/dist/approvals/apply-decision.d.ts

@@ -15,7 +15,7 @@
  * A reject records the decision and `reject()`s the hold (failing the element).
  */
 import { ApprovalDecision } from '@kici-dev/engine';
-import type { HeldRunStore, ReleaseSignal } from '../environments/held-runs.js';
+import type { HeldRunStore, ReleaseSignal } from '../contexts/held-runs.js';
 import { type TeamMembershipLookup } from './approval-resolver.js';
 /** Outcome of applying a decision. */
 export interface ApplyDecisionResult {

package/dist/approvals/step-approval-bridge.d.ts

@@ -1,4 +1,4 @@
-import type { HeldRunStore } from '../environments/held-runs.js';
+import type { HeldRunStore } from '../contexts/held-runs.js';
 import type { AccessLogWriter } from '../audit/access-log.js';
 /** Outcome relayed back to the waiting agent. */
 export type StepApprovalOutcome = 'approved' | 'rejected' | 'expired';

package/dist/cache/pending-inits.d.ts

@@ -1,16 +1,16 @@
 /**
  * Pending init tracker for coordinating init-then-execute pipeline.
  *
- * The orchestrator dispatches an init job for dynamic environment resolution
+ * The orchestrator dispatches an init job for dynamic context resolution
  * and waits for the agent to return the resolved field values
- * (environmentNames, env, concurrencyGroup). The underlying tracker logic lives
+ * (contextNames, env, concurrencyGroup). The underlying tracker logic lives
  * in `PendingTracker<InitResult>`; this subclass wires the init-specific
  * logger prefix and disconnect error.
  */
 import { PendingTracker } from './pending-tracker.js';
 export interface InitResult {
-    /** Resolved bound-environment names, in merge order (one per `environments` element). */
-    environmentNames?: string[];
+    /** Resolved bound-context names, in merge order (one per `contexts` element). */
+    contextNames?: string[];
     env?: Record<string, string>;
     concurrencyGroup?: string;
     /**

package/dist/cli/api-client.d.ts

@@ -26,12 +26,15 @@ export interface FleetTopologyResponse {
  */
 export type GenericSourceGitConfigPayload = Record<string, unknown>;
 /**
- * Wire shape for a local filesystem source's config (`{ repoBasePath, cloneUrlBase? }`).
+ * Wire shape for a local filesystem source's config
+ * (`{ repoBasePath, cloneUrlBase?, inPlace? }`).
  * Matches `LocalSourceConfigSchema` in `providers/local/local-source-config.ts`.
  */
 export interface GenericSourceLocalConfigPayload {
     repoBasePath: string;
     cloneUrlBase?: string;
+    /** In-place profile: the repoBasePath is the operator's real working tree. */
+    inPlace?: boolean;
 }
 /**
  * Response shape for generic webhook sources from the admin API.
@@ -111,7 +114,29 @@ export declare class AdminApiClient {
     }>;
     setSecret(orgId: string, scope: string, key: string, value: string): Promise<void>;
     deleteSecret(orgId: string, scope: string, key: string): Promise<void>;
-    listVariables(orgId: string, environment: string): Promise<{
+    /**
+     * Create (or upsert) a deployment context. `allowLocalExecution` lets
+     * CLI-initiated / local runs resolve secrets through this context.
+     */
+    createContext(data: {
+        orgId: string;
+        name: string;
+        allowLocalExecution?: boolean;
+    }): Promise<{
+        envId: string;
+        created: boolean;
+    }>;
+    /**
+     * Bind a scope pattern to a context so its scoped secrets resolve at dispatch.
+     * `hostPattern` defaults to `**` (every host) server-side.
+     */
+    bindContext(data: {
+        orgId: string;
+        name: string;
+        scopePattern: string;
+        hostPattern?: string;
+    }): Promise<unknown>;
+    listVariables(orgId: string, context: string): Promise<{
         variables: Array<{
             key: string;
             value: string;
@@ -119,8 +144,8 @@ export declare class AdminApiClient {
             updated_at: string;
         }>;
     }>;
-    setVariable(orgId: string, environment: string, key: string, value: string, locked?: boolean): Promise<void>;
-    deleteVariable(orgId: string, environment: string, key: string): Promise<void>;
+    setVariable(orgId: string, context: string, key: string, value: string, locked?: boolean): Promise<void>;
+    deleteVariable(orgId: string, context: string, key: string): Promise<void>;
     rotateKey(): Promise<{
         reEncrypted: number;
         reEncryptedConfigs: number;

package/dist/cli/commands/context.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Context management CLI commands for kici-admin.
+ *
+ *   context create         — upsert a context
+ *   context bind           — bind a scope pattern to a context
+ *   context set-policy     — update policy fields (branch, reviewers, timers, trust)
+ *   context list           — list contexts for an org
+ *   context show           — show a single context with variables + bindings
+ *   context delete         — delete a context (cascades bindings, variables, overrides; held-run history survives; pending held runs block with a clear error, resolved holds do not)
+ *   context create-template — create/update a context template + its seed variables
+ *
+ * Each command supports two modes (stage-4 pattern from `maintenance.ts`):
+ *
+ *   HTTP mode (default): requires `--url` + `--token`, routes through the
+ *   orchestrator admin HTTP API at /api/v1/admin/contexts.
+ *
+ *   Direct-DB mode: activated when `--database-url` is passed (or
+ *   KICI_DATABASE_URL / DATABASE_URL is set). Opens its own pool and runs the
+ *   SQL directly via *Direct helpers in @kici-dev/shared. Used by E2E
+ *   `globalSetup` helpers that need to seed envs before the orchestrator is up.
+ */
+import type { Command } from 'commander';
+import type { AdminApiClient } from '../api-client.js';
+export declare function registerContextCommands(program: Command, getClient: () => AdminApiClient): void;
+//# sourceMappingURL=context.d.ts.map

package/dist/cli/commands/debug-bundle.d.ts

@@ -7,7 +7,7 @@
  *
  * Usage: kici-admin debug-bundle [--output <path>]
  */
-import type { Command } from 'commander';
+import { type Command } from 'commander';
 import type { AdminApiClient } from '../api-client.js';
 /**
  * Register the debug-bundle command on the CLI program.

package/dist/cli/commands/variable.d.ts

@@ -1,12 +1,12 @@
 /**
- * Environment variable management commands for kici-admin.
+ * Context variable management commands for kici-admin.
  *
- *   kici-admin variable list   <orgId> <environment>
- *   kici-admin variable get    <orgId> <environment> <key>
- *   kici-admin variable set    <orgId> <environment> <key> [--value | --from-stdin | --from-file | --from-env | --prompt]
- *   kici-admin variable delete <orgId> <environment> <key>
+ *   kici-admin variable list   <orgId> <context>
+ *   kici-admin variable get    <orgId> <context> <key>
+ *   kici-admin variable set    <orgId> <context> <key> [--value | --from-stdin | --from-file | --from-env | --prompt]
+ *   kici-admin variable delete <orgId> <context> <key>
  *
- * Org-level environment variables are plaintext-at-rest in the
+ * Org-level context variables are plaintext-at-rest in the
  * orchestrator's DB; the dashboard write path is gated by the
  * `variables.set` / `variables.delete` switches in the dashboard-write
  * policy. This CLI is the always-available authority path when the

package/dist/cli/service/windows.d.ts

@@ -8,6 +8,12 @@
  */
 import type { ServiceManager, ServiceConfig, ServiceStatus, LogOptions, DiscoveredInstance, LaunchSpec } from './types.js';
 export declare class WindowsServiceManager implements ServiceManager {
+    /**
+     * Check whether a Windows service is currently registered.
+     * `sc.exe query` exits non-zero (execSync throws) when the service does
+     * not exist; exit 0 means it exists (possibly pending-delete).
+     */
+    private serviceExists;
     install(config: ServiceConfig): Promise<void>;
     uninstall(config: ServiceConfig): Promise<void>;
     start(config: ServiceConfig): Promise<void>;