@kici-dev/orchestrator 0.1.26 → 0.1.27

package/dist/storage/blob-routes.d.ts

@@ -11,9 +11,25 @@
  * filesystem backend is active (`deps.fsCache` truthy in app.ts).
  */
 import type { Hono } from 'hono';
+/**
+ * URL prefix for the filesystem-backend blob transfer route. The app-level
+ * webhook body-size cap MUST exempt this prefix: blob PUTs carry internal
+ * artifacts (dependency tarballs up to `cacheMaxTarballBytes`, 500MB by
+ * default), which the S3 backend uploads direct-to-S3 uncapped. Binding them
+ * to the tenant-webhook body limit would 413 legitimate large caches on the
+ * filesystem backend. The PUT route below enforces its own `maxUploadBytes`
+ * bound instead.
+ */
+export declare const CACHE_BLOB_PATH_PREFIX = "/api/v1/cache/blob/";
 export interface FsCacheRouteDeps {
     basePath: string;
     signingSecret: string;
+    /**
+     * Upper bound on a single blob PUT, in bytes. Aligned with the dep-cache's
+     * `cacheMaxTarballBytes` (500MB default) so the filesystem backend accepts
+     * the same artifact sizes the S3 backend does.
+     */
+    maxUploadBytes: number;
 }
 /** Mount filesystem-backend cache routes onto an existing Hono app. */
 export declare function registerBlobRoutes(app: Hono, deps: FsCacheRouteDeps): void;

package/dist/ws/{dashboard-env-handler.d.ts → dashboard-context-handler.d.ts}

@@ -1,8 +1,8 @@
 /**
- * Dashboard environment handler for the orchestrator.
+ * Dashboard context handler for the orchestrator.
  *
- * Responds to dashboard.environments.* and dashboard.held-runs.* WS messages
- * from Platform by calling the appropriate stores (EnvironmentStore, VariableStore,
+ * Responds to dashboard.contexts.* and dashboard.held-runs.* WS messages
+ * from Platform by calling the appropriate stores (ContextStore, VariableStore,
  * BindingStore, PgSecretStore) and sending typed responses.
  *
  * Each handler:
@@ -11,12 +11,12 @@
  * 3. Returns a response message with requestId and data (or error)
  */
 import { type Kysely } from 'kysely';
-import type { HeldRunStore, ReleaseSignal } from '../environments/held-runs.js';
+import type { HeldRunStore, ReleaseSignal } from '../contexts/held-runs.js';
 import type { TeamMembershipLookup } from '../approvals/approval-resolver.js';
 import type { DashboardPlatformToOrchMessage } from '@kici-dev/engine';
-import type { EnvironmentStore } from '../environments/environment-store.js';
-import type { VariableStore } from '../environments/variable-store.js';
-import type { BindingStore } from '../environments/binding-store.js';
+import type { ContextStore } from '../contexts/context-store.js';
+import type { VariableStore } from '../contexts/variable-store.js';
+import type { BindingStore } from '../contexts/binding-store.js';
 import type { Database } from '../db/types.js';
 import type { AccessLogWriter } from '../audit/access-log.js';
 /** Secret store interface (subset of PgSecretStore methods used here). */
@@ -29,12 +29,12 @@ interface SecretStoreForDashboard {
     renameScope?(orgId: string, oldScope: string, newScope: string): Promise<void>;
     deleteScope?(orgId: string, scope: string): Promise<void>;
 }
-export interface DashboardEnvHandlerDeps {
+export interface DashboardContextHandlerDeps {
     /** Organization ID for all operations. */
     orgId: string;
     /** Send a response message back to Platform over the WS connection. */
     send: (msg: unknown) => void;
-    environmentStore: EnvironmentStore;
+    contextStore: ContextStore;
     variableStore: VariableStore;
     bindingStore: BindingStore;
     secretStore: SecretStoreForDashboard;
@@ -72,15 +72,15 @@ export interface ApprovalHandlerDeps {
     rejectWorkflow?: (runId: string) => Promise<void>;
 }
 /**
- * Handler for all dashboard environment and held run WS messages.
+ * Handler for all dashboard context and held run WS messages.
  *
  * Dispatches incoming messages by type and calls the appropriate store.
  */
-export declare class DashboardEnvHandler {
+export declare class DashboardContextHandler {
     private readonly deps;
     private routingKey;
     private readonly accessLog;
-    constructor(deps: DashboardEnvHandlerDeps);
+    constructor(deps: DashboardContextHandlerDeps);
     /** Update the orgId used for all operations (called when resolved from DB). */
     setOrgId(orgId: string): void;
     /** Update the routing key bound to access_log rows. */
@@ -105,8 +105,8 @@ export declare class DashboardEnvHandler {
     handleMessage(msg: DashboardPlatformToOrchMessage): Promise<boolean>;
     private handleEnvList;
     /**
-     * Map each environment id to the distinct secret key names reachable through
-     * its scope bindings. Joins `environment_bindings` → `scoped_secrets` on the
+     * Map each context id to the distinct secret key names reachable through
+     * its scope bindings. Joins `context_bindings` → `scoped_secrets` on the
      * scope pattern, excluding the `__empty__` sentinel. Returns key names only —
      * never values. Scoped to the caller-resolved org (the request's target org,
      * or the connection-level org on the legacy path).
@@ -159,4 +159,4 @@ export declare class DashboardEnvHandler {
     private sendError;
 }
 export {};
-//# sourceMappingURL=dashboard-env-handler.d.ts.map
+//# sourceMappingURL=dashboard-context-handler.d.ts.map

package/dist/ws/oidc-token-relay.d.ts

@@ -58,6 +58,12 @@ export interface OidcTokenHandlerDeps {
      * OIDC audience (config.testMintDeferAudience). Ignored unless `testMode`.
      */
     testMintDeferAudience?: string;
+    /**
+     * Test-only: force the *initial* agent mint to defer for this OIDC audience
+     * (config.testMintRejectAudience) so a pending row is created, which the
+     * retrier then terminally rejects. Ignored unless `testMode`.
+     */
+    testMintRejectAudience?: string;
 }
 /**
  * Build the agent.api handler for `OIDC_TOKEN_REQUEST_METHOD`. Validates the

package/installer-image-digests.json

@@ -1,7 +1,7 @@
 {
-  "version": "0.1.26",
+  "version": "0.1.27",
   "images": {
-    "kici-agent": "sha256:f53aeb2bc7c0da72461fbbbe13c94b119ed2c3ed564e2c3f528acde58124a6a9",
-    "kici-orchestrator": "sha256:eff0bddaff3ee355aeb1f05c46ea773cef75b57d04d18919068329f758aa63fb"
+    "kici-agent": "sha256:301120d679c7f199df1836bedde1ef896c9742f5212cd70753b84e89df195995",
+    "kici-orchestrator": "sha256:03af091cc946da7b037ce048867684d8fcc3528fd1320fa7a408627ad2a55f76"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/orchestrator",
-  "version": "0.1.26",
+  "version": "0.1.27",
   "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
   "keywords": [
     "ci",
@@ -84,8 +84,8 @@
     "ws": "^8.21.0",
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
-    "@kici-dev/engine": "0.1.26",
-    "@kici-dev/shared": "0.1.26"
+    "@kici-dev/shared": "0.1.27",
+    "@kici-dev/engine": "0.1.27"
   },
   "kici": {
     "metrics": {
@@ -99,7 +99,7 @@
     "@types/archiver": "^8.0.0",
     "@types/dockerode": "^4.0.1",
     "kysely-ctl": "^0.21.0",
-    "@kici-dev/agent": "0.1.26"
+    "@kici-dev/agent": "0.1.27"
   },
   "scripts": {
     "build": "node ../../scripts/build-service.mjs && tsc --emitDeclarationOnly",

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/orchestrator@0.1.26",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Forchestrator/0.1.26/9c3ff4ff-35af-480a-9ce4-a8615e3dc279",
+  "name": "@kici-dev/orchestrator@0.1.27",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Forchestrator/0.1.27/2f6c4db6-3778-40e2-9732-c3fe34e2314d",
   "creationInfo": {
-    "created": "2026-07-06T04:29:58Z",
+    "created": "2026-07-10T06:04:18Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -1190,9 +1190,9 @@
       "homepage": "https://ericsmekens.github.io/jsep/tree/master/packages/regex#readme"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.26",
+      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.27",
       "name": "@kici-dev/core",
-      "versionInfo": "0.1.26",
+      "versionInfo": "0.1.27",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1203,16 +1203,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.26"
+          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.27"
         }
       ],
       "description": "Light shared utilities for the KiCI stack (logging, errors, formatting, crypto, zx init, the TypeScript ESM loader hook). No server-side dependencies.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.26",
+      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.27",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.26",
+      "versionInfo": "0.1.27",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1223,7 +1223,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.26"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.27"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
@@ -1232,7 +1232,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/orchestrator",
-      "versionInfo": "0.1.26",
+      "versionInfo": "0.1.27",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1243,16 +1243,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/orchestrator@0.1.26"
+          "referenceLocator": "pkg:npm/%40kici-dev/orchestrator@0.1.27"
         }
       ],
       "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "name": "@kici-dev/shared",
-      "versionInfo": "0.1.26",
+      "versionInfo": "0.1.27",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1263,7 +1263,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.26"
+          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.27"
         }
       ],
       "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
@@ -8201,57 +8201,57 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.135.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-jose-6.2.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.4",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-safe-regex-2.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
@@ -8287,12 +8287,12 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.26",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.27",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -8401,112 +8401,112 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package--aws-sdk-client-s3-3.1064.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.27",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.27",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-api-1.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-metrics-otlp-http-0.218.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-prometheus-0.218.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-trace-otlp-http-0.218.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-instrumentation-runtime-node-0.31.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-resources-2.7.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-sdk-node-0.218.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-semantic-conventions-1.41.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-archiver-8.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-diff-9.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-hono-4.12.25",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-kysely-0.29.2",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.135.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-pg-8.21.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-yaml-2.9.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.27",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },

package/dist/cli/commands/environment.d.ts

@@ -1,25 +0,0 @@
-/**
- * Environment management CLI commands for kici-admin.
- *
- *   environment create         — upsert an environment
- *   environment bind           — bind a scope pattern to an environment
- *   environment set-policy     — update policy fields (branch, reviewers, timers, trust)
- *   environment list           — list environments for an org
- *   environment show           — show a single environment with variables + bindings
- *   environment delete         — delete an environment (cascades bindings, variables, overrides; held-run history survives; pending held runs block with a clear error, resolved holds do not)
- *   environment create-template — create/update an environment template + its seed variables
- *
- * Each command supports two modes (stage-4 pattern from `maintenance.ts`):
- *
- *   HTTP mode (default): requires `--url` + `--token`, routes through the
- *   orchestrator admin HTTP API at /api/v1/admin/environments.
- *
- *   Direct-DB mode: activated when `--database-url` is passed (or
- *   KICI_DATABASE_URL / DATABASE_URL is set). Opens its own pool and runs the
- *   SQL directly via *Direct helpers in @kici-dev/shared. Used by E2E
- *   `globalSetup` helpers that need to seed envs before the orchestrator is up.
- */
-import type { Command } from 'commander';
-import type { AdminApiClient } from '../api-client.js';
-export declare function registerEnvironmentCommands(program: Command, getClient: () => AdminApiClient): void;
-//# sourceMappingURL=environment.d.ts.map

package/dist/environments/binding-store.d.ts

@@ -1,36 +0,0 @@
-/**
- * Binding store -- scope-to-environment binding CRUD.
- *
- * Bindings map scope patterns (e.g. 'aws/prod/**') to environments,
- * controlling which scoped secrets are available in each environment.
- */
-import type { Kysely } from 'kysely';
-import type { Database, EnvironmentBinding } from '../db/types.js';
-/**
- * A scope→environment binding with its host selector. `hostPattern` defaults to
- * `'**'` (all hosts) when omitted.
- */
-export interface BindingInput {
-    scopePattern: string;
-    hostPattern?: string;
-}
-/**
- * Data access layer for environment bindings.
- */
-export declare class BindingStore {
-    private readonly db;
-    constructor(db: Kysely<Database>);
-    /** List all bindings for an environment. */
-    list(orgId: string, environmentId: string): Promise<EnvironmentBinding[]>;
-    /**
-     * Replace all bindings for an environment in a transaction.
-     *
-     * Deletes existing bindings and inserts the new set atomically. Each binding
-     * carries a `scopePattern` and an optional `hostPattern` (defaulting to
-     * `'**'`). Pass an empty array to clear all bindings.
-     */
-    set(orgId: string, environmentId: string, bindings: BindingInput[]): Promise<void>;
-    /** Find bindings for an environment (alias for list, used by secret resolver). */
-    findBindingsForEnvironment(orgId: string, environmentId: string): Promise<EnvironmentBinding[]>;
-}
-//# sourceMappingURL=binding-store.d.ts.map

package/dist/environments/environment-store.d.ts

@@ -1,87 +0,0 @@
-import { type Kysely } from 'kysely';
-import type { Environment as EngineEnvironment } from '@kici-dev/engine';
-import type { Database, Environment } from '../db/types.js';
-/** Thrown by `delete` when pending held runs reference the environment. */
-export declare class EnvironmentDeleteBlockedError extends Error {
-    readonly pendingCount: number;
-    constructor(pendingCount: number);
-}
-/**
- * Map a DB environment row (snake_case) to the engine Environment type (camelCase).
- *
- * Kysely returns JSONB columns as strings; this function parses them into arrays.
- */
-export declare function toEnvironment(row: Environment): EngineEnvironment;
-/** Fields accepted when creating an environment. */
-export interface EnvironmentCreateInput {
-    name: string;
-    type?: 'fixed' | 'glob';
-    globPattern?: string | null;
-    branchRestrictions?: string[];
-    triggerTypeFilters?: string[];
-    repoPatterns?: string[];
-    concurrencyLimit?: number | null;
-    concurrencyStrategy?: 'queue' | 'cancel-pending';
-    concurrencyTimeoutMs?: number;
-    requiredReviewers?: string[] | null;
-    waitTimerSeconds?: number | null;
-    holdExpirySeconds?: number;
-    minimumTrust?: 'known' | 'trusted' | null;
-    allowLocalExecution?: boolean;
-    enabled?: boolean;
-    createdBy?: string | null;
-}
-/** Fields accepted when updating an environment. */
-export interface EnvironmentUpdateInput {
-    name?: string;
-    type?: 'fixed' | 'glob';
-    globPattern?: string | null;
-    branchRestrictions?: string[];
-    triggerTypeFilters?: string[];
-    repoPatterns?: string[];
-    concurrencyLimit?: number | null;
-    concurrencyStrategy?: 'queue' | 'cancel-pending';
-    concurrencyTimeoutMs?: number;
-    requiredReviewers?: string[] | null;
-    waitTimerSeconds?: number | null;
-    holdExpirySeconds?: number;
-    minimumTrust?: 'known' | 'trusted' | null;
-    allowLocalExecution?: boolean;
-    enabled?: boolean;
-}
-/**
- * Data access layer for environments.
- */
-export declare class EnvironmentStore {
-    private readonly db;
-    constructor(db: Kysely<Database>);
-    /** List all environments for an org, ordered by name. */
-    list(orgId: string): Promise<Environment[]>;
-    /** Get a single environment by org + id. Returns null if not found. */
-    get(orgId: string, id: string): Promise<Environment | null>;
-    /** Get a single environment by org + name. Returns null if not found. */
-    getByName(orgId: string, name: string): Promise<Environment | null>;
-    /** Create a new environment. Returns the created row. */
-    create(orgId: string, data: EnvironmentCreateInput): Promise<Environment>;
-    /** Update an environment. Returns the updated row, or null if not found. */
-    update(orgId: string, id: string, updates: EnvironmentUpdateInput): Promise<Environment | null>;
-    /**
-     * Delete an environment.
-     *
-     * Bindings, variables, and source overrides cascade away via their FK.
-     * Terminal held-run history survives with a null `environment_id` (the FK
-     * uses ON DELETE SET NULL). Pending held runs still reference the
-     * environment, so deletion is blocked with `EnvironmentDeleteBlockedError`
-     * until they are approved or rejected.
-     */
-    delete(orgId: string, id: string): Promise<boolean>;
-    /**
-     * Match an environment name against org environments.
-     *
-     * First tries exact name match (for fixed environments).
-     * If no exact match, scans glob-type environments and uses picomatch.
-     * Returns the first matching environment or null.
-     */
-    matchEnvironment(orgId: string, name: string): Promise<Environment | null>;
-}
-//# sourceMappingURL=environment-store.d.ts.map