@kici-dev/orchestrator 0.1.26 → 0.1.27

package/dist/pipeline/decorating-secret-resolver.d.ts

@@ -1,13 +1,13 @@
 /**
  * CLI-secret overlay for `kici run` test dispatch.
  *
- * Wraps the orchestrator's environment `SecretResolver` and overlays the
+ * Wraps the orchestrator's context `SecretResolver` and overlays the
  * developer's CLI-uploaded local secrets on top of the env-resolved secrets,
  * with CLI winning on collision. Passed to the shared dispatch core via
  * `ProcessingDeps.secretResolver`, so the core's secret-resolution path is
  * unchanged and oblivious to "test secrets".
  *
- * Precedence: env-resolved secrets → CLI context for the requested environment
+ * Precedence: env-resolved secrets → CLI context for the requested context
  * → CLI flat. The CLI flat overlay is applied last so a CLI flat key always
  * wins.
  */
@@ -21,12 +21,12 @@ export declare class DecoratingSecretResolver implements SecretResolverApi {
     private readonly base;
     private readonly cli;
     constructor(base: SecretResolverApi, cli: CliSecrets);
-    resolveForJob(orgId: string, environmentName: string): Promise<Record<string, string>>;
+    resolveForJob(orgId: string, contextName: string): Promise<Record<string, string>>;
     resolveNamed(orgId: string, scope: string, key: string, opts?: {
         store?: string;
         runId?: string;
         jobId?: string;
     }): Promise<string | null>;
-    resolveForJobWithMeta(orgId: string, environmentName: string): Promise<Record<string, ResolvedSecretMeta>>;
+    resolveForJobWithMeta(orgId: string, contextName: string): Promise<Record<string, ResolvedSecretMeta>>;
 }
 //# sourceMappingURL=decorating-secret-resolver.d.ts.map

package/dist/pipeline/dispatch-matched-workflow.d.ts

@@ -3,7 +3,7 @@
  *
  * Handles everything that happens AFTER a workflow has been matched against an
  * incoming webhook: payload storage, cache + build coordination, secret
- * resolution, per-job environment evaluation, static job dispatch (cluster +
+ * resolution, per-job context evaluation, static job dispatch (cluster +
  * single-orch paths), execution-tracker registration, deferred init dispatch
  * for jobs with dynamic fields, and deferred dynamic-job-fn dispatch for
  * `_type:'dynamic'` lock entries.
@@ -113,7 +113,7 @@ export interface WorkflowDispatchContext {
      * Run-wide flat secrets layered onto EVERY dispatched job's `jobConfig.secrets`
      * (env-declaring or not). Used by the test path to deliver `kici run --secret`
      * / `--env` CLI flat secrets, which must reach a job regardless of whether it
-     * declares an `environment:`. Merged UNDER the per-job env-resolved secrets so
+     * declares an `context:`. Merged UNDER the per-job env-resolved secrets so
      * the CLI value wins on a key collision (matching the prior B1-env -> A-CLI
      * precedence). Undefined for webhook runs.
      */
@@ -140,7 +140,7 @@ export interface DispatchMatchedWorkflowResult {
     held?: boolean;
     /**
      * User-visible warnings aggregated from dispatched jobs — today, one per job
-     * whose bound test-run environment(s) were unavailable and skipped. Surfaced
+     * whose bound test-run context(s) were unavailable and skipped. Surfaced
      * on the accepted trigger response so the CLI can print them.
      */
     envWarnings?: string[];

package/dist/pipeline/inline-eval.d.ts

@@ -36,8 +36,8 @@ export declare function evaluateInlineRecord(expression: string, event: object):
  * failures are immediate dispatch failures (no init-job fallback).
  */
 export declare function evaluateInlineFields(lockJob: LockJob, event: object): {
-    /** Resolved name per `environments` element, aligned by index; undefined for static or impure-dynamic elements. */
-    inlineEnvironmentNames: Array<string | undefined>;
+    /** Resolved name per `contexts` element, aligned by index; undefined for static or impure-dynamic elements. */
+    inlineContextNames: Array<string | undefined>;
     inlineEnv: Record<string, string> | undefined;
     inlineConcurrencyGroup: string | undefined;
 };

package/dist/pipeline/install-secrets-resolver.d.ts

@@ -4,10 +4,10 @@
  * private registries.
  *
  * Each `tokenSecret` / `installEnv[]` entry uses the qualified
- * `<environment>:<secret-name>` syntax. The resolver:
+ * `<context>:<secret-name>` syntax. The resolver:
  *
- *   1. Parses every qualified ref and groups by environment name.
- *   2. Fires the per-environment protection-rule pipeline once per unique env
+ *   1. Parses every qualified ref and groups by context name.
+ *   2. Fires the per-context protection-rule pipeline once per unique env
  *      (branch / trust / concurrency / reviewer / wait-timer). A `reject`
  *      result fails the whole workflow dispatch with a clear reason; a
  *      `hold` / `wait` / `queue` result returns a structured `hold` decision
@@ -15,13 +15,13 @@
  *      run and resume it when the gate clears. On the resume path the caller
  *      sets `skipProtectionGate` so the gate (already satisfied) is bypassed
  *      and secrets are resolved directly.
- *   3. Resolves secrets per environment via `secretResolver.resolveForJob`
+ *   3. Resolves secrets per context via `secretResolver.resolveForJob`
  *      (which writes its own audit log lines).
  *   4. Validates each registry URL scheme: HTTPS always allowed; `http://`
  *      allowed only for loopback / `*.local` hosts OR when the org operator
  *      has flipped `org_settings.allow_http_npm_registries=true`.
  *   5. Strips the resolved auth entirely when the contributor-trust tier is
- *      not `trusted` (defense in depth: even if a misconfigured environment
+ *      not `trusted` (defense in depth: even if a misconfigured context
  *      lets an unknown contributor through the protection-pipeline trust
  *      gate, this strip ensures fork PRs never see registry tokens — the
  *      install fails naturally because the deps are unreachable).
@@ -32,8 +32,8 @@
 import type { ApproverClause, LockRegistry } from '@kici-dev/engine';
 import type { TrustResolution } from '../security/trust-resolver.js';
 import type { SecretResolverApi } from '../secrets/secret-resolver.js';
-import type { EnvironmentStore } from '../environments/environment-store.js';
-import { type JobDispatchContext } from '../environments/protection/pipeline.js';
+import type { ContextStore } from '../contexts/context-store.js';
+import { type JobDispatchContext } from '../contexts/protection/pipeline.js';
 /** Registry spec carried on the dispatch message (token already resolved). */
 export interface NpmRegistrySpec {
     url: string;
@@ -47,7 +47,7 @@ export interface ResolveInstallSecretsArgs {
     allowHttpNpmRegistries: boolean;
     resolvedOrgId: string;
     trustResolution: TrustResolution | undefined;
-    environmentStore: EnvironmentStore | undefined;
+    contextStore: ContextStore | undefined;
     secretResolver: SecretResolverApi | undefined;
     protectionContext: JobDispatchContext;
     /**
@@ -75,16 +75,16 @@ export type ResolveInstallSecretsResult = {
     decision: 'hold';
     /** The gate action that paused the dispatch. */
     action: 'hold' | 'wait' | 'queue';
-    /** The environment whose install gate held. */
+    /** The context whose install gate held. */
     envName: string;
-    /** Resolved environment id (for the held row). */
-    environmentId: string;
+    /** Resolved context id (for the held row). */
+    contextId: string;
     /** Discriminates the release trigger: 'reviewer' | 'wait_timer' | 'concurrency' | 'security'. */
     holdType: string;
-    queueType: 'environment' | 'security';
+    queueType: 'context' | 'security';
     requirement: InstallHoldRequirement;
 };
-/** Parse `<environment>:<secret-name>`. Returns null on malformed input. */
+/** Parse `<context>:<secret-name>`. Returns null on malformed input. */
 export declare function parseQualifiedSecretRef(ref: string): {
     envName: string;
     secretName: string;

package/dist/pipeline/{job-environments.d.ts → job-contexts.d.ts}

@@ -1,59 +1,59 @@
 /**
- * Multi-environment resolution helpers for the dispatch path.
+ * Multi-context resolution helpers for the dispatch path.
  *
- * A job binds an ordered list of environments (`LockJob.environments`). This
- * module resolves that list into concrete environment names (static values
+ * A job binds an ordered list of contexts (`LockJob.contexts`). This
+ * module resolves that list into concrete context names (static values
  * verbatim, pure-inline dynamic elements evaluated against the event) and folds
- * the per-environment secrets/variables last-wins. It keeps the heavy fold logic
+ * the per-context secrets/variables last-wins. It keeps the heavy fold logic
  * out of `dispatchMatchedWorkflow`, which must stay under the function-length cap.
  */
-import { type Environment, type HostFacts, type LockJob } from '@kici-dev/engine';
+import { type Context, type HostFacts, type LockJob } from '@kici-dev/engine';
 import type { SecretResolverApi } from '../secrets/secret-resolver.js';
-import type { VariableStore } from '../environments/variable-store.js';
+import type { VariableStore } from '../contexts/variable-store.js';
 /**
  * Placeholder written into the persisted bound-env list for an impure dynamic
  * element the orchestrator cannot resolve at dispatch. The agent's init eval
  * later overwrites the list with the resolved name.
  */
 export declare const DYNAMIC_ENV_PLACEHOLDER = "(dynamic)";
-/** Ordered resolved environment names plus whether any element still needs agent init. */
-export interface ResolvedJobEnvironments {
+/** Ordered resolved context names plus whether any element still needs agent init. */
+export interface ResolvedJobContexts {
     /** Resolved static + pure-inline names, in order. */
     names: string[];
     /** True when an impure dynamic element must be resolved by an agent init job. */
     needsInit: boolean;
 }
 /**
- * Resolve the ordered bound-environment names from a lock job. Static elements
+ * Resolve the ordered bound-context names from a lock job. Static elements
  * use their value verbatim; pure-inline dynamic elements use the matching
  * pre-evaluated inline name (aligned by index); an impure dynamic element cannot
  * be resolved here and flags `needsInit`.
  */
-export declare function resolveJobEnvironmentNames(lockJob: LockJob, inlineNames: ReadonlyArray<string | undefined>): ResolvedJobEnvironments;
+export declare function resolveJobContextNames(lockJob: LockJob, inlineNames: ReadonlyArray<string | undefined>): ResolvedJobContexts;
 /**
- * Build the ordered bound-environment display list for persistence at dispatch.
- * Unlike {@link resolveJobEnvironmentNames}, this never drops an unresolved
+ * Build the ordered bound-context display list for persistence at dispatch.
+ * Unlike {@link resolveJobContextNames}, this never drops an unresolved
  * element: a static element uses its value, a pure-inline element uses its
  * resolved name when known, and any element the orchestrator cannot resolve at
  * dispatch (impure dynamic, or an unresolved pure-inline) becomes the
  * `(dynamic)` placeholder — so the persisted column reflects every declared
- * slot in order. Returns an empty array when the job binds no environment.
+ * slot in order. Returns an empty array when the job binds no context.
  */
-export declare function buildJobEnvironmentDisplayNames(lockJob: LockJob, inlineNames: ReadonlyArray<string | undefined>): string[];
-/** Merged secrets/variables across an ordered list of resolved environments. */
+export declare function buildJobContextDisplayNames(lockJob: LockJob, inlineNames: ReadonlyArray<string | undefined>): string[];
+/** Merged secrets/variables across an ordered list of resolved contexts. */
 export interface MultiEnvMergedData {
-    environmentVars?: Record<string, string>;
+    contextVars?: Record<string, string>;
     jobSecrets?: Record<string, string>;
     jobNamespacedSecrets?: Record<string, Record<string, string>>;
 }
 /**
  * Resolve and fold variables + secrets across the ordered list of matched
- * environments, last-wins. Each environment is resolved with the existing
- * single-env logic (longest-scope-path-wins preserved within each environment),
- * then folded in array order so a later environment overrides an earlier key.
- * Secrets are also returned namespaced per environment so qualified
+ * contexts, last-wins. Each context is resolved with the existing
+ * single-env logic (longest-scope-path-wins preserved within each context),
+ * then folded in array order so a later context overrides an earlier key.
+ * Secrets are also returned namespaced per context so qualified
  * `<env>:<secret>` references still resolve. `entries` carries the matched
- * `Environment` for each name (in order); variables resolve by environment id.
+ * `Context` for each name (in order); variables resolve by context id.
  */
 export declare function resolveMultiEnvMergedData(args: {
     deps: {
@@ -63,9 +63,9 @@ export declare function resolveMultiEnvMergedData(args: {
     orgId: string;
     entries: ReadonlyArray<{
         name: string;
-        env: Environment;
+        env: Context;
     }>;
     hostCtx?: HostFacts;
     routingKey?: string;
 }): Promise<MultiEnvMergedData>;
-//# sourceMappingURL=job-environments.d.ts.map
+//# sourceMappingURL=job-contexts.d.ts.map

package/dist/pipeline/manual-schedule.d.ts

@@ -15,7 +15,14 @@ import type { RegistrationIndex } from '../registration/registration-index.js';
 interface ManualScheduleDeps extends RerunDeps {
     registrationIndex: RegistrationIndex;
 }
-export declare function handleManualSchedule(registrationId: string, triggeredBy: string | null, triggeredByAgentLabel: string | null, deps: ManualScheduleDeps): Promise<{
+export declare function handleManualSchedule(registrationId: string, triggeredBy: string | null, triggeredByAgentLabel: string | null, deps: ManualScheduleDeps, 
+/**
+ * Platform-minted `requestId`. Stable across an HA relay failover re-send, so
+ * it is the idempotency key: after the read-only validation, the first
+ * coordinator to claim it creates the run and a failover re-send returns that
+ * same run instead of minting a second one.
+ */
+requestId: string): Promise<{
     newRunId: string;
 }>;
 export declare function buildManualJobConfig(workflow: LockWorkflow, mat: MaterializedJob): {

package/dist/pipeline/processor.d.ts

@@ -46,10 +46,10 @@ import type { GlobalWorkflowPolicy } from '../security/global-workflow-policy.js
 import type { EventLogWriter } from '../webhook/event-log.js';
 import { EventLogSource } from '@kici-dev/engine';
 import type { LockJob } from '@kici-dev/engine';
-import type { EnvironmentStore } from '../environments/environment-store.js';
-import type { VariableStore } from '../environments/variable-store.js';
+import type { ContextStore } from '../contexts/context-store.js';
+import type { VariableStore } from '../contexts/variable-store.js';
 import type { TrustResolver, IdentityLink, PermissionLevel } from '../security/trust-resolver.js';
-import type { HeldRunStore } from '../environments/held-runs.js';
+import type { HeldRunStore } from '../contexts/held-runs.js';
 import type { WorkflowDecision } from '@kici-dev/engine';
 /**
  * Pending dispatch context for jobs gated by the needs scheduler.
@@ -302,9 +302,9 @@ export interface ProcessingDeps {
     secretKey?: string;
     /** Log storage backend for persisting webhook payloads. Optional -- if not set, payload storage is skipped. */
     logStorage?: LogStorage;
-    /** Environment store for looking up deployment environments. Optional -- if not set, environment features are inactive. */
-    environmentStore?: EnvironmentStore;
-    /** Variable store for resolving environment variables. Optional -- if not set, environment vars are not merged. */
+    /** Context store for looking up deployment contexts. Optional -- if not set, context features are inactive. */
+    contextStore?: ContextStore;
+    /** Variable store for resolving context variables. Optional -- if not set, context vars are not merged. */
     variableStore?: VariableStore;
     /** Held run store for persisting protection rule holds. Optional -- if not set, holds are not persisted. */
     heldRunStore?: HeldRunStore;

package/dist/pipeline/request-idempotency.d.ts

@@ -0,0 +1,28 @@
+import type { Kysely } from 'kysely';
+import type { Database } from '../db/types.js';
+/**
+ * Atomically claim a run-minting request by its Platform `requestId`. Returns
+ * the run id to use. `claimed: false` means a sibling coordinator already owns
+ * this requestId (a relay failover re-sent the same request): the caller MUST
+ * return `{ newRunId }` WITHOUT creating or dispatching a run, so one user
+ * click yields exactly one run.
+ *
+ * Shared by `run.rerun.request` and `run.manual_schedule.request` — both mint a
+ * fresh run and both ride the Platform's timeout-driven failover path. HA
+ * coordinator siblings share one orchestrator DB, so the `INSERT … ON CONFLICT
+ * (request_id) DO NOTHING` is the single point of arbitration: exactly one hop
+ * inserts and wins; the loser reads back the winner's `new_run_id`.
+ */
+export declare function claimRequestId(db: Kysely<Database>, requestId: string): Promise<{
+    newRunId: string;
+    claimed: boolean;
+}>;
+/**
+ * Prune `request_idempotency` rows older than 1h. The request budget is ~10s,
+ * so a claimed requestId is never re-sent after an hour; keeping the table
+ * bounded avoids unbounded growth on a long-lived coordinator.
+ *
+ * @returns the number of rows deleted.
+ */
+export declare function pruneRequestIdempotency(db: Kysely<Database>): Promise<number>;
+//# sourceMappingURL=request-idempotency.d.ts.map

package/dist/pipeline/rerun.d.ts

@@ -68,6 +68,14 @@ export interface RerunDeps {
     coldStore: ColdStore | null;
 }
 export declare function handleRerun(originalRunId: string, triggeredBy: string | null, triggeredByAgentLabel: string | null, deps: RerunDeps, 
+/**
+ * Platform-minted `requestId` for this rerun. Stable across an HA relay
+ * failover re-send (the Platform re-sends the same message verbatim to a
+ * sibling coordinator on a timeout), so it is the idempotency key: after the
+ * read-only validation, the first coordinator to claim it creates the run and
+ * a failover re-send returns that same run instead of minting a second one.
+ */
+requestId: string, 
 /**
  * Phase F — routing key for the original run, forwarded by Platform
  * via the WS `run.rerun.request` payload. Required to address the

package/dist/pipeline/resume-workflow.d.ts

@@ -1,7 +1,7 @@
 import type { Kysely } from 'kysely';
 import type { Database } from '../db/types.js';
 import type { ProcessingDeps } from './processor.js';
-import type { ReleaseSignal } from '../environments/held-runs.js';
+import type { ReleaseSignal } from '../contexts/held-runs.js';
 import { type WorkflowDispatchContext } from './dispatch-matched-workflow.js';
 import { type SerializableWorkflowDispatchInputs } from './pending-workflow-context.js';
 /**

package/dist/pipeline/test-pipeline.d.ts

@@ -3,7 +3,7 @@
  *
  * Resolves the lock file, matched decisions, and fixture-specific concerns
  * (inline-vs-provider lock, decision selection, fixture-payload storage, the
- * `allow_local_execution` environment gate, CLI-secret overlay, in-memory
+ * `allow_local_execution` context gate, CLI-secret overlay, in-memory
  * test-run marking), then dispatches each matched workflow through the SAME
  * shared core as webhooks (`dispatchMatchedWorkflow`). The test path is a thin
  * adapter — needs-DAG scheduling, `expansionMap` fan-out edges, `runsOnAll`
@@ -94,7 +94,7 @@ interface TestTriggerResult {
     jobIds: string[];
     /**
      * User-visible warnings on an accepted run — today, one per job whose bound
-     * test-run environment(s) were unavailable (non-test or unconfigured) and
+     * test-run context(s) were unavailable (non-test or unconfigured) and
      * skipped. Printed by the CLI on acceptance.
      */
     warnings?: string[];

package/dist/provenance/trust-root.d.ts

@@ -20,5 +20,12 @@ export declare function createProvenanceTrustRoot(opts?: {
     issuer?: string | null;
     fetchImpl?: typeof fetch;
     ttlMs?: number;
+    /**
+     * In-process JWKS served directly (no HTTP fetch). Set for the offline local
+     * dev plane, whose `kici-local` issuer is not a URL — the plane's own signer
+     * is the key source, so a `kici-local` bundle verifies at ingest without a
+     * `.well-known/jwks.json` endpoint. When set, discovery/fetch is bypassed.
+     */
+    staticJwks?: JSONWebKeySet;
 }): ProvenanceTrustRoot;
 //# sourceMappingURL=trust-root.d.ts.map

package/dist/provider-registry.d.ts

@@ -29,6 +29,14 @@ export interface ProviderBundle {
     repoUrlBuilder?: RepoUrlBuilder;
     contributorResolver?: ContributorResolver;
     checkStatusPoster?: CheckStatusPoster;
+    /**
+     * Local `file://` in-place profile: this bundle's `repoBasePath` is the
+     * operator's real working tree, so a dispatched run against it skips the
+     * source-pack `__build__` job (the tree is used directly by the agent's
+     * `KICI_IN_PLACE` profile). Set only by `createLocalProviderBundle`. Undefined
+     * for every non-local (or non-in-place local) bundle.
+     */
+    localInPlace?: boolean;
 }
 /**
  * Registry mapping routing keys to their implementation bundles.

package/dist/providers/local/index.d.ts

@@ -29,5 +29,6 @@ export { LocalRepoUrlBuilder } from './repo-url-builder.js';
 export declare function createLocalProviderBundle(opts: {
     repoBasePath: string;
     cloneUrlBase?: string;
+    inPlace?: boolean;
 }): ProviderBundle;
 //# sourceMappingURL=index.d.ts.map

package/dist/providers/local/local-source-config.d.ts

@@ -12,6 +12,7 @@ import { z } from 'zod';
 export declare const LocalSourceConfigSchema: z.ZodObject<{
     repoBasePath: z.ZodString;
     cloneUrlBase: z.ZodOptional<z.ZodString>;
+    inPlace: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
 export type LocalSourceConfig = z.infer<typeof LocalSourceConfigSchema>;
 //# sourceMappingURL=local-source-config.d.ts.map

package/dist/reporting/execution-tracker.d.ts

@@ -125,8 +125,8 @@ export interface ExecutionTrackerDeps {
      * jobs that never started. Persisted in execution_jobs.init_failure.
      */
     initFailure?: InitFailure, 
-    /** Ordered bound deployment-environment names for this job (multi-env jobs). */
-    environments?: string[]) => void;
+    /** Ordered bound deployment-context names for this job (multi-env jobs). */
+    contexts?: string[]) => void;
     /**
      * Optional callback to emit run.event messages to Platform.
      * Fires at orchestrator lifecycle points (dispatch, agent assignment, job start/complete).
@@ -222,8 +222,8 @@ export declare class ExecutionTracker {
         waveGated?: boolean;
         waveMaxParallel?: number;
         waveFailFast?: boolean;
-        environments?: string[];
-        skippedEnvironments?: string[];
+        contexts?: string[];
+        skippedContexts?: string[];
         envWarning?: string;
     }>, routingKey?: string, 
     /** Secret context names dispatched with jobs (for context-disable job lookup). */
@@ -311,8 +311,8 @@ export declare class ExecutionTracker {
         baseJobName?: string;
         variantKind?: string;
         variantLabel?: string;
-        environments?: string[];
-        skippedEnvironments?: string[];
+        contexts?: string[];
+        skippedContexts?: string[];
         envWarning?: string;
     }>, dispatchedContexts?: string[], 
     /** Synthetic job ID to replace (e.g. needs-pending-deploy-{uuid}). */
@@ -481,7 +481,7 @@ export declare class ExecutionTracker {
         deliveryId: string | null;
         providerContext: Record<string, unknown>;
         routingKey: string;
-        environmentName?: string;
+        contextName?: string;
         reason: string;
         triggerEvent?: string;
         commitMessage?: string;
@@ -533,6 +533,16 @@ export declare class ExecutionTracker {
      * Used by LogWriter to construct log paths.
      */
     getJobName(runId: string, jobId: string): string | undefined;
+    /**
+     * Find the runId of the in-memory run that owns a given dispatched jobId.
+     *
+     * The agent's `event.emit` message is job-scoped (it carries only the
+     * emitting jobId), but run context is keyed by runId. This maps job → run so
+     * `getExecutionContext(runId)` resolves for an agent-emitted custom event.
+     * In-memory only (matches `getExecutionContext`'s semantics); emit happens
+     * mid-execution, so the owning run is always live in `this.runs`.
+     */
+    getRunIdForJob(jobId: string): string | undefined;
     /**
      * Get execution context for a run from in-memory state.
      * Used by commit status reporting to access provider/repo/sha info.

package/dist/reporting/run-aggregator.d.ts

@@ -64,8 +64,8 @@ export interface RunDetailJobRow {
     agent_id: string | null;
     error_message: string | null;
     runs_on_labels: unknown;
-    environments: unknown;
-    skipped_environments: unknown;
+    contexts: unknown;
+    skipped_contexts: unknown;
     env_warning: string | null;
     outputs: unknown;
     init_failure: unknown;
@@ -103,7 +103,7 @@ export declare function buildRunDetailJobs(jobs: RunDetailJobRow[], lookups: Run
     }[];
     initFailure?: {
         scope: "job" | "run";
-        category: "secret_resolution" | "install_secrets" | "lock_resolution" | "build_coordination" | "environment_rules" | "dynamic_eval" | "no_agent" | "matrix_expansion";
+        category: "secret_resolution" | "install_secrets" | "lock_resolution" | "build_coordination" | "context_rules" | "dynamic_eval" | "no_agent" | "matrix_expansion";
         message: string;
         jobName?: string | undefined;
     } | undefined;
@@ -121,8 +121,8 @@ export declare function buildRunDetailJobs(jobs: RunDetailJobRow[], lookups: Run
     orchestratorId: null;
     errorMessage: string | null;
     runsOnLabels: string[] | null;
-    environments: string[] | null;
-    skippedEnvironments: string[] | null;
+    contexts: string[] | null;
+    skippedContexts: string[] | null;
     envWarning: string | null;
     outputs: any;
     secretOutputKeys: string[] | null;

package/dist/routes/admin-contexts.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Admin API routes for context management.
+ *
+ *   POST   /api/v1/admin/contexts                                    — create (upsert)
+ *   POST   /api/v1/admin/contexts/:name/bind                         — bind a scope pattern
+ *   PATCH  /api/v1/admin/contexts/:name/policy                       — update policy fields
+ *   GET    /api/v1/admin/contexts?orgId=<id>                         — list contexts
+ *   GET    /api/v1/admin/contexts/:name?orgId=<id>                   — show env + vars + bindings
+ *   DELETE /api/v1/admin/contexts/:name?orgId=<id>                   — delete env (cascades bindings/variables/overrides; pending held runs block with 409)
+ *   POST   /api/v1/admin/contexts/templates                          — create/update a template
+ *   GET    /api/v1/admin/contexts/:name/variables?orgId=<id>         — list org-level variables
+ *   PUT    /api/v1/admin/contexts/:name/variables/:key?orgId=<id>    — upsert variable
+ *   DELETE /api/v1/admin/contexts/:name/variables/:key?orgId=<id>    — delete variable
+ *
+ * Backs the `kici-admin context` dual-mode CLI. Offline (direct-DB) mode
+ * bypasses this router entirely — the CLI calls `*Direct` helpers from
+ * @kici-dev/shared. This HTTP surface exists so tooling with only an admin
+ * token (no DB reach) can do the same operations.
+ *
+ * All routes are protected by the admin auth middleware mounted in admin.ts
+ * (at `/api/v1/admin/*`). That middleware sets `role` + `userId` on the
+ * context, which we use for RBAC gating here.
+ */
+import { Hono } from 'hono';
+import { type Kysely } from 'kysely';
+import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+export interface AdminContextRoutesDeps {
+    db: Kysely<any>;
+    rbac: RbacEnforcer;
+}
+/** Hono env type for admin-contexts routes with context variables. */
+type AdminEnvEnv = {
+    Variables: {
+        role: Role;
+        userId: string;
+        routingKey: string | null;
+    };
+};
+/**
+ * Create admin API routes for context management.
+ *
+ * @param deps - db (Kysely) + rbac enforcer
+ * @returns Hono app mounted at /api/v1/admin
+ */
+export declare function createAdminContextRoutes(deps: AdminContextRoutesDeps): Hono<AdminEnvEnv>;
+export {};
+//# sourceMappingURL=admin-contexts.d.ts.map

package/dist/routes/admin-registrations.d.ts

@@ -10,7 +10,7 @@ import type { RegistrationStore } from '../registration/registration-store.js';
 import type { RegistrationIndex } from '../registration/registration-index.js';
 import type { TokenManager } from '../secrets/token-manager.js';
 import type { RbacEnforcer, Role } from '../secrets/rbac.js';
-import type { EnvironmentStore } from '../environments/environment-store.js';
+import type { ContextStore } from '../contexts/context-store.js';
 /**
  * Dependencies for admin registration routes.
  */
@@ -25,7 +25,7 @@ export interface AdminRegistrationRoutesDeps {
      * provably-unsatisfiable environment list (missing/disabled env, or
      * mutually-exclusive fixed branch/trigger/repo restrictions).
      */
-    environmentStore?: Pick<EnvironmentStore, 'matchEnvironment'>;
+    contextStore?: Pick<ContextStore, 'matchContext'>;
 }
 /** Hono env type for admin registration routes with context variables. */
 type AdminRegEnv = {

package/dist/routes/github-webhook.d.ts

@@ -14,8 +14,8 @@ export interface GithubWebhookRoutesDeps {
 }
 /**
  * Whether the orchestrator serves the direct GitHub ingress route for a given
- * operating mode. Hybrid + independent run local source config; platform mode
- * is relay-only (no local GitHub source to serve).
+ * operating mode. Hybrid and independent modes serve a local GitHub source
+ * config; platform mode is relay-only (no local GitHub source to serve).
  */
 export declare function shouldServeGithubIngress(mode: 'platform' | 'hybrid' | 'independent'): boolean;
 /**

package/dist/secrets/context-secret-resolver.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Shared factory for the dispatch-time `SecretResolver` bound to the orchestrator's
+ * DB-backed context/binding/secret stores.
+ *
+ * Both boot paths use it: `server.ts` (platform/hybrid) always builds it, and
+ * `standalone.ts` (independent) builds it only when dispatch-time context-scoped
+ * secret resolution is explicitly opted in (the local dev plane). Keeping the
+ * ~one construction in one place stops the two call sites from drifting.
+ */
+import type { Kysely } from 'kysely';
+import type { SecretStore } from '@kici-dev/engine';
+import type { Logger } from '@kici-dev/shared';
+import type { Database } from '../db/types.js';
+import type { AuditLogger } from './audit-logger.js';
+import type { PgSecretStore } from './pg-secret-store.js';
+import { SecretResolver } from './secret-resolver.js';
+export interface ContextSecretResolverDeps {
+    pgSecretStore: PgSecretStore;
+    backendStores: Map<string, SecretStore>;
+    db: Kysely<Database>;
+    auditLogger: AuditLogger;
+    logger: Logger;
+}
+/**
+ * Build a `SecretResolver` over the org's contexts, bindings, and registered
+ * secret backends. The `pg` backend decrypts through the master key; external
+ * backends (Vault) return plaintext, so their decrypt is identity.
+ */
+export declare function buildContextSecretResolver(deps: ContextSecretResolverDeps): SecretResolver;
+//# sourceMappingURL=context-secret-resolver.d.ts.map

package/dist/secrets/index.d.ts

@@ -9,7 +9,7 @@ export { AuditLogger } from './audit-logger.js';
 export { loadMasterKey, loadOldMasterKey, loadSecretStoreConfig, type SecretStoreConfig, } from './config.js';
 export { encrypt, decrypt, deriveKey, generateMasterKey, type EncryptedValue, } from '@kici-dev/shared';
 export { VaultSecretStore, type VaultConfig } from './vault-secret-store.js';
-export { SecretResolver, type SecretResolverDeps, type ResolvedSecretMeta, type EnvironmentStoreLike, type BindingStoreLike, type SecretStoreLike, } from './secret-resolver.js';
+export { SecretResolver, type SecretResolverDeps, type ResolvedSecretMeta, type ContextStoreLike, type BindingStoreLike, type SecretStoreLike, } from './secret-resolver.js';
 export { BackendSyncManager } from './backend-sync.js';
 export { RbacEnforcer, PermissionDeniedError, type Role, type Permission } from './rbac.js';
 export { TokenManager } from './token-manager.js';

package/dist/secrets/pg-secret-store.d.ts

@@ -12,7 +12,7 @@ import type { SecretStore } from '@kici-dev/engine';
 import type { AuditLogger } from './audit-logger.js';
 /**
  * Thrown by `renameScope` when the named scope has no secret rows and no
- * environment binding — i.e. there is nothing to rename. Consumers map this to
+ * context binding — i.e. there is nothing to rename. Consumers map this to
  * a 404 (admin HTTP route) or a structured not-found response (dashboard path).
  */
 export declare class SecretScopeNotFoundError extends Error {
@@ -93,11 +93,11 @@ export declare class PgSecretStore implements SecretStore {
      */
     createScope(orgId: string, scope: string): Promise<void>;
     /**
-     * Rename a scope -- atomically update scoped_secrets and environment_bindings.
+     * Rename a scope -- atomically update scoped_secrets and context_bindings.
      */
     renameScope(orgId: string, oldScope: string, newScope: string): Promise<void>;
     /**
-     * Delete a scope and all its secrets, plus any environment bindings referencing it.
+     * Delete a scope and all its secrets, plus any context bindings referencing it.
      */
     deleteScope(orgId: string, scope: string): Promise<void>;
     /**