@kici-dev/orchestrator 0.1.26 → 0.1.27

package/dist/environments/protection/aggregate.d.ts

@@ -1,43 +0,0 @@
-import { EnvGateRejectReason, type Environment } from '@kici-dev/engine';
-import type { JobDispatchContext } from './pipeline.js';
-/** A single environment's rejection under all-must-pass aggregation. */
-export interface EnvGateRejection {
-    environment: string;
-    reason: EnvGateRejectReason;
-    detail: string;
-}
-/** Effective protection parameters after most-restrictive aggregation. */
-export interface EffectiveProtection {
-    minimumTrust?: 'known' | 'trusted';
-    requiredReviewers: string[];
-    waitTimerSeconds: number | null;
-    holdExpirySeconds: number;
-    concurrencyLimit: number | null;
-    concurrencyStrategy: 'queue' | 'cancel-pending';
-}
-/**
- * Evaluate each environment's hard reject gates against the run context. A name
- * with no `Environment` record yields an `env_not_found` rejection. Returns all
- * rejections (empty = every environment passed the reject gates).
- */
-export declare function evaluateMultiEnvGates(envs: ReadonlyArray<{
-    name: string;
-    env: Environment | undefined;
-}>, ctx: JobDispatchContext): EnvGateRejection[];
-/**
- * Aggregate hold/wait/queue parameters across all bound environments, most
- * restrictive wins: trust = max tier, reviewers = sorted dedup union, wait timer
- * = max, hold expiry = min, concurrency limit = min (tightest). The concurrency
- * strategy follows the primary (first) environment.
- */
-export declare function aggregateProtectionParams(envs: ReadonlyArray<Environment>): EffectiveProtection;
-/**
- * Build a synthetic `Environment` carrying the aggregated protection parameters,
- * so the existing per-rule gate functions (trust/concurrency/reviewer/wait) can
- * evaluate the all-must-pass holds in one pass. Branch/trigger/repo/enabled are
- * already handled by `evaluateMultiEnvGates`, so they are neutralized here.
- */
-export declare function buildEffectiveEnvironment(primary: Environment, eff: EffectiveProtection): Environment;
-/** Format a human-readable rejection reason naming the env(s) and rule(s). */
-export declare function formatMultiEnvRejection(rejections: ReadonlyArray<EnvGateRejection>): string;
-//# sourceMappingURL=aggregate.d.ts.map

package/dist/environments/protection/branch-gate.d.ts

@@ -1,5 +0,0 @@
-import type { Environment, ProtectionGateResult } from '@kici-dev/engine';
-import type { JobDispatchContext } from './pipeline.js';
-/** Evaluate branch restrictions, trigger type filters, and repo patterns. */
-export declare function evaluateBranchGate(env: Environment, ctx: JobDispatchContext): ProtectionGateResult;
-//# sourceMappingURL=branch-gate.d.ts.map

package/dist/environments/protection/concurrency-gate.d.ts

@@ -1,7 +0,0 @@
-/**
- * Concurrency gate -- checks concurrency limits.
- */
-import type { Environment, ProtectionGateResult } from '@kici-dev/engine';
-/** Evaluate concurrency limits for the environment. */
-export declare function evaluateConcurrencyGate(env: Environment, currentRunningCount: number, _concurrencyGroup: string): ProtectionGateResult;
-//# sourceMappingURL=concurrency-gate.d.ts.map

package/dist/environments/protection/reviewer-gate.d.ts

@@ -1,7 +0,0 @@
-/**
- * Reviewer gate -- checks required reviewers.
- */
-import type { Environment, ProtectionGateResult } from '@kici-dev/engine';
-/** Evaluate reviewer requirements for the environment. */
-export declare function evaluateReviewerGate(env: Environment): ProtectionGateResult;
-//# sourceMappingURL=reviewer-gate.d.ts.map

package/dist/environments/protection/trust-gate.d.ts

@@ -1,7 +0,0 @@
-/**
- * Trust gate -- checks contributor trust tier against environment minimumTrust.
- */
-import type { Environment, ProtectionGateResult, TrustTier } from '@kici-dev/engine';
-/** Evaluate minimumTrust requirements for the environment. */
-export declare function evaluateTrustGate(env: Environment, trustTier: TrustTier | undefined): ProtectionGateResult;
-//# sourceMappingURL=trust-gate.d.ts.map

package/dist/environments/protection/wait-timer-gate.d.ts

@@ -1,7 +0,0 @@
-/**
- * Wait timer gate -- checks wait timer configuration.
- */
-import type { Environment, ProtectionGateResult } from '@kici-dev/engine';
-/** Evaluate wait timer for the environment. */
-export declare function evaluateWaitTimerGate(env: Environment): ProtectionGateResult;
-//# sourceMappingURL=wait-timer-gate.d.ts.map

package/dist/environments/variable-store.d.ts

@@ -1,39 +0,0 @@
-/**
- * Variable store -- environment variable CRUD with lock enforcement.
- *
- * Manages org-level environment variables and per-source overrides.
- * Lock enforcement: locked org vars cannot be overridden by source overrides.
- */
-import { type Kysely } from 'kysely';
-import type { Database, EnvironmentVariable, EnvironmentSourceOverride } from '../db/types.js';
-/**
- * Data access layer for environment variables and source overrides.
- */
-export declare class VariableStore {
-    private readonly db;
-    constructor(db: Kysely<Database>);
-    /** List all org-level variables for an environment. */
-    listVars(orgId: string, environmentId: string): Promise<EnvironmentVariable[]>;
-    /** Upsert an org-level variable. */
-    setVar(orgId: string, environmentId: string, key: string, value: string, locked?: boolean): Promise<void>;
-    /** Delete an org-level variable. */
-    deleteVar(orgId: string, environmentId: string, key: string): Promise<void>;
-    /** List source overrides for a specific source (routing key). */
-    listSourceOverrides(orgId: string, environmentId: string, routingKey: string): Promise<EnvironmentSourceOverride[]>;
-    /** Upsert a source override. */
-    setSourceOverride(orgId: string, environmentId: string, routingKey: string, key: string, value: string): Promise<void>;
-    /** Delete a source override. */
-    deleteSourceOverride(orgId: string, environmentId: string, routingKey: string, key: string): Promise<void>;
-    /**
-     * Get resolved variables for an environment, optionally merged with source overrides.
-     *
-     * Merge rules:
-     * - Org-level vars form the base
-     * - Source overrides can add new keys and override unlocked org vars
-     * - Locked org vars are NOT overridden by source overrides
-     *
-     * @param routingKey - If provided, source overrides are merged in
-     */
-    getResolvedVars(orgId: string, environmentId: string, routingKey?: string): Promise<Record<string, string>>;
-}
-//# sourceMappingURL=variable-store.d.ts.map

package/dist/routes/admin-environments.d.ts

@@ -1,47 +0,0 @@
-/**
- * Admin API routes for environment management.
- *
- *   POST   /api/v1/admin/environments                                    — create (upsert)
- *   POST   /api/v1/admin/environments/:name/bind                         — bind a scope pattern
- *   PATCH  /api/v1/admin/environments/:name/policy                       — update policy fields
- *   GET    /api/v1/admin/environments?orgId=<id>                         — list environments
- *   GET    /api/v1/admin/environments/:name?orgId=<id>                   — show env + vars + bindings
- *   DELETE /api/v1/admin/environments/:name?orgId=<id>                   — delete env (cascades bindings/variables/overrides; pending held runs block with 409)
- *   POST   /api/v1/admin/environments/templates                          — create/update a template
- *   GET    /api/v1/admin/environments/:name/variables?orgId=<id>         — list org-level variables
- *   PUT    /api/v1/admin/environments/:name/variables/:key?orgId=<id>    — upsert variable
- *   DELETE /api/v1/admin/environments/:name/variables/:key?orgId=<id>    — delete variable
- *
- * Backs the `kici-admin environment` dual-mode CLI. Offline (direct-DB) mode
- * bypasses this router entirely — the CLI calls `*Direct` helpers from
- * @kici-dev/shared. This HTTP surface exists so tooling with only an admin
- * token (no DB reach) can do the same operations.
- *
- * All routes are protected by the admin auth middleware mounted in admin.ts
- * (at `/api/v1/admin/*`). That middleware sets `role` + `userId` on the
- * context, which we use for RBAC gating here.
- */
-import { Hono } from 'hono';
-import { type Kysely } from 'kysely';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
-export interface AdminEnvironmentRoutesDeps {
-    db: Kysely<any>;
-    rbac: RbacEnforcer;
-}
-/** Hono env type for admin-environments routes with context variables. */
-type AdminEnvEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
-/**
- * Create admin API routes for environment management.
- *
- * @param deps - db (Kysely) + rbac enforcer
- * @returns Hono app mounted at /api/v1/admin
- */
-export declare function createAdminEnvironmentRoutes(deps: AdminEnvironmentRoutesDeps): Hono<AdminEnvEnv>;
-export {};
-//# sourceMappingURL=admin-environments.d.ts.map