@kici-dev/orchestrator 0.1.26 → 0.1.27

package/dist/secrets/rbac.d.ts

@@ -13,7 +13,7 @@ export type Role = 'owner' | 'admin' | 'auditor';
 /**
  * Permissions for the secrets management admin API.
  */
-export type Permission = 'context.create' | 'context.read' | 'context.update' | 'context.delete' | 'secret.read' | 'secret.write' | 'secret.delete' | 'secret.reveal' | 'audit.read' | 'token.manage' | 'key.rotate' | 'run.read' | 'run.cancel' | 'event_log.read' | 'event_log.read_payload' | 'access_log.read' | 'scheduled_job.trigger' | 'event_dlq.read' | 'event_dlq.manage';
+export type Permission = 'context.create' | 'context.read' | 'context.update' | 'context.delete' | 'secret.read' | 'secret.write' | 'secret.delete' | 'secret.reveal' | 'audit.read' | 'token.manage' | 'key.rotate' | 'run.read' | 'run.cancel' | 'event_log.read' | 'event_log.read_payload' | 'access_log.read' | 'scheduled_job.trigger' | 'attestation.retry' | 'event_dlq.read' | 'event_dlq.manage';
 /**
  * Error thrown when a role lacks the required permission.
  */

package/dist/secrets/secret-resolver.d.ts

@@ -1,13 +1,13 @@
 /**
  * Secret resolver for dispatch-time secret resolution.
  *
- * Uses environment bindings + scope resolver to match secrets from multiple backends.
- * When a job dispatches with an environment name, the resolver:
- * 1. Looks up the environment by name
- * 2. Gets bindings for that environment
+ * Uses context bindings + scope resolver to match secrets from multiple backends.
+ * When a job dispatches with a context name, the resolver:
+ * 1. Looks up the context by name
+ * 2. Gets bindings for that context
  * 3. Queries ALL registered backend stores for secrets
  * 4. Prefixes each secret's scope with the backend name (e.g., pg:aws/prod)
- * 5. Uses resolveSecretsForEnvironment to match bindings against prefixed secrets
+ * 5. Uses resolveSecretsForContext to match bindings against prefixed secrets
  * 6. Returns a flat decrypted key-value map
  *
  * unreachable backends cause job failure (not silent skip).
@@ -15,13 +15,13 @@
  * longest-path-wins uses scope path after stripping backend prefix.
  * audit log includes backend name.
  */
-import { type EnvironmentBinding, type HostFacts, type ScopedSecret } from '@kici-dev/engine';
+import { type ContextBinding, type HostFacts, type ScopedSecret } from '@kici-dev/engine';
 import type { Logger } from '@kici-dev/shared';
 import type { AuditLogger } from './audit-logger.js';
 /**
- * Minimal environment store interface (subset needed by resolver).
+ * Minimal context store interface (subset needed by resolver).
  */
-export interface EnvironmentStoreLike {
+export interface ContextStoreLike {
     getByName(orgId: string, name: string): Promise<{
         id: string;
         name: string;
@@ -32,7 +32,7 @@ export interface EnvironmentStoreLike {
  * Minimal binding store interface (subset needed by resolver).
  */
 export interface BindingStoreLike {
-    getByEnvironmentId(environmentId: string): Promise<EnvironmentBinding[]>;
+    getByContextId(contextId: string): Promise<ContextBinding[]>;
 }
 /**
  * Minimal secret store interface (subset needed by resolver).
@@ -49,7 +49,7 @@ export interface SecretStoreLike {
  * Dependencies for the SecretResolver.
  */
 export interface SecretResolverDeps {
-    environmentStore: EnvironmentStoreLike;
+    contextStore: ContextStoreLike;
     bindingStore: BindingStoreLike;
     /** Map of backend name to store. Replaces single secretStore. */
     backendStores: Map<string, SecretStoreLike>;
@@ -69,16 +69,16 @@ export interface ResolvedSecretMeta {
  * can flow through `ProcessingDeps.secretResolver`.
  */
 export interface SecretResolverApi {
-    resolveForJob(orgId: string, environmentName: string, hostCtx?: HostFacts): Promise<Record<string, string>>;
+    resolveForJob(orgId: string, contextName: string, hostCtx?: HostFacts): Promise<Record<string, string>>;
     resolveNamed(orgId: string, scope: string, key: string, opts?: {
         store?: string;
         runId?: string;
         jobId?: string;
     }): Promise<string | null>;
-    resolveForJobWithMeta(orgId: string, environmentName: string, hostCtx?: HostFacts): Promise<Record<string, ResolvedSecretMeta>>;
+    resolveForJobWithMeta(orgId: string, contextName: string, hostCtx?: HostFacts): Promise<Record<string, ResolvedSecretMeta>>;
 }
 /**
- * Resolves secrets for a job by matching environment bindings against scoped secrets
+ * Resolves secrets for a job by matching context bindings against scoped secrets
  * from multiple backends.
  *
  * All backend stores are queried. Each secret's scope is prefixed with the backend
@@ -87,7 +87,7 @@ export interface SecretResolverApi {
  * stripping the backend prefix.
  */
 export declare class SecretResolver implements SecretResolverApi {
-    private readonly environmentStore;
+    private readonly contextStore;
     private readonly bindingStore;
     private readonly backendStores;
     private readonly auditLogger;
@@ -97,17 +97,17 @@ export declare class SecretResolver implements SecretResolverApi {
      * Resolve secrets for a job dispatch.
      *
      * @param orgId - Organization ID
-     * @param environmentName - Environment name to resolve secrets for
+     * @param contextName - Context name to resolve secrets for
      * @param hostCtx - Optional fan-out child identity for per-host resolution.
      *   When supplied, each binding is gated by its `host_pattern` and its
      *   `scope_pattern` is templated per-child; when omitted, only fleet-wide
      *   (`'**'`) non-templated bindings contribute.
      * @returns Flat map of decrypted secret key-value pairs
      */
-    resolveForJob(orgId: string, environmentName: string, hostCtx?: HostFacts): Promise<Record<string, string>>;
+    resolveForJob(orgId: string, contextName: string, hostCtx?: HostFacts): Promise<Record<string, string>>;
     /**
      * Resolve a single named secret by (orgId, scope, key), optionally scoped to
-     * a specific backend. Bypasses environment bindings — this is a direct
+     * a specific backend. Bypasses context bindings — this is a direct
      * lookup used for source-scoped credentials (e.g. universal-git PAT/SSH
      * keys stored under `__source__/<sourceId>`).
      *
@@ -130,7 +130,7 @@ export declare class SecretResolver implements SecretResolverApi {
      *
      * Returns the secret value along with which backend and scope provided it.
      */
-    resolveForJobWithMeta(orgId: string, environmentName: string, hostCtx?: HostFacts): Promise<Record<string, ResolvedSecretMeta>>;
+    resolveForJobWithMeta(orgId: string, contextName: string, hostCtx?: HostFacts): Promise<Record<string, ResolvedSecretMeta>>;
     /**
      * Collect all secrets from all backend stores, prefixing scopes.
      * Per /: unreachable backends are tracked but not fatal here.
@@ -142,7 +142,7 @@ export declare class SecretResolver implements SecretResolverApi {
      */
     private buildDecryptFn;
     /**
-     * Check if any failed backend could affect the job's environment bindings.
+     * Check if any failed backend could affect the job's context bindings.
      * throw when a failed backend's scopes could match a binding and
      * no healthy backend already satisfies that binding.
      * jobs referencing only healthy backends succeed normally.

package/dist/security/comment-handler.d.ts

@@ -5,7 +5,7 @@
  * approval/rejection of security holds. Verifies commenter identity
  * via the trust policy cache and checks ci_trust:write+ before acting.
  */
-import type { HeldRunStore } from '../environments/held-runs.js';
+import type { HeldRunStore } from '../contexts/held-runs.js';
 import { type IdentityLink, type PermissionLevel } from './trust-resolver.js';
 import type { CheckStatusPoster as EngineCheckStatusPoster } from '@kici-dev/engine';
 /** Parsed /kici command from a comment body. */