@kici-dev/orchestrator 0.1.26 → 0.2.0

package/dist/secrets/routing-key-scope.d.ts

@@ -17,6 +17,12 @@
  * access is denied, or `null` to let the handler continue. The middleware
  * mounted in each admin route file is responsible for calling
  * `c.set('routingKey', tokenInfo.routingKey)` so these helpers can read it.
+ *
+ * NOT a scope name. `requested` must be a routing key (`<provider>:<id>`) read
+ * from a row or an explicit request field. Secret scope names live in a
+ * different namespace — a path whose `:` is reserved as the backend qualifier —
+ * and must never be passed here. Secret routes have no per-routing-key slice;
+ * they use `requireUnscopedToken` instead.
  */
 import type { Context } from 'hono';
 /**

package/dist/secrets/scope-routing.d.ts

@@ -0,0 +1,126 @@
+/**
+ * Backend-qualified scope routing.
+ *
+ * A secret scope travels over the wire in *qualified* form -- `<backend>:<path>`
+ * -- while every `SecretStore` implementation is addressed with the bare
+ * `<path>`. This module owns the single split between the two forms so the two
+ * write planes (the dashboard WebSocket handler and the HTTP admin API) can
+ * never drift apart on where the qualifier is stripped.
+ *
+ * The registered-backend map IS the whitelist: a head before the first `:` is a
+ * backend qualifier only when it names a registered backend. Anything else --
+ * an unregistered head, a leading `:`, no `:` at all -- stays whole and is
+ * routed to the default store, where the ordinary scope-name validation
+ * rejects it if it is malformed. That is what keeps routing keys
+ * (`<provider>:<id>`) out of the secret-scope namespace: `github:42` names no
+ * backend, so it stays whole and is rejected as a scope path.
+ */
+/**
+ * The subset of `SecretStore` a scope-taking route or WS handler needs.
+ *
+ * Deliberately narrower than the full `SecretStore` from `@kici-dev/engine`:
+ * routing only needs the scope-addressed methods, so a caller may pass a
+ * partial store (the degraded store below, a unit-test fake) without
+ * implementing value resolution.
+ */
+export interface ScopedSecretStore {
+    listScopes(orgId: string): Promise<string[]>;
+    listKeys(orgId: string, scope: string): Promise<string[]>;
+    setSecret(orgId: string, scope: string, key: string, value: string): Promise<void>;
+    deleteSecret(orgId: string, scope: string, key: string): Promise<void>;
+    createScope?(orgId: string, scope: string): Promise<void>;
+    renameScope?(orgId: string, oldScope: string, newScope: string): Promise<void>;
+    deleteScope?(orgId: string, scope: string): Promise<void>;
+}
+/**
+ * Raised when a secret write is issued against an orchestrator that has no
+ * secret store configured.
+ *
+ * The message is operator-facing: the dashboard write planes relay it verbatim
+ * as the `error` on their response, so it names the deployment condition rather
+ * than the internal cause.
+ */
+export declare class SecretsUnavailableError extends Error {
+    constructor();
+}
+/**
+ * The store an orchestrator serves the dashboard from when it has no secret
+ * store configured.
+ *
+ * The read/write asymmetry is deliberate. `listScopes` / `listKeys` return
+ * empty because "this deployment holds no secrets" is true and complete.
+ * `setSecret` / `deleteSecret` reject, because a write that resolved here would
+ * be discarded while the dashboard reported the secret as stored -- and a
+ * delete that resolved would leave a credential the operator believes is
+ * revoked. The optional scope methods stay unimplemented: the write planes
+ * already refuse a scope operation a store does not support.
+ */
+export declare function createUnavailableSecretStore(): ScopedSecretStore;
+/** Backend name assumed when a wire scope carries no recognised qualifier. */
+export declare const DEFAULT_BACKEND_NAME = "pg";
+/** Outcome of resolving a wire-form scope against the registered backends. */
+export interface ResolvedScope<S> {
+    /** The store the operation must be issued against. */
+    store: S;
+    /** The backend the scope resolved to (the default name when unqualified). */
+    backendName: string;
+    /** The bare scope path to pass to the store -- never carries a qualifier. */
+    path: string;
+    /** True when the wire scope carried a recognised `<backend>:` qualifier. */
+    qualified: boolean;
+}
+/**
+ * The one method of the secret-backend registry that store loading needs.
+ *
+ * Structural on purpose: keeping the concrete registry out of this module lets
+ * both write planes -- and their unit tests -- supply their own loader without
+ * dragging a database-backed registry into a pure routing module.
+ */
+export interface BackendStoreRegistry<S, L> {
+    loadAllStores(auditLogger: L): Promise<Map<string, S>>;
+}
+/**
+ * Load the registered secret backends for one operation.
+ *
+ * Never cache the result: a backend's credentials can rotate, and a backend can
+ * be added or removed, between operations -- a stale store would write to the
+ * wrong place. A registry failure propagates rather than degrading to the
+ * default store, because a misrouted secret write is worse than a failed one.
+ *
+ * The default-backend entry is ALWAYS `defaultStore`, overriding whatever the
+ * registry returned. The registry builds its own `PgSecretStore` for the seeded
+ * `pg` row, and that instance carries none of the orchestrator's configuration:
+ * `customerSecretsEnabled` defaults to true (so it would ignore an operator's
+ * `pgCustomerSecrets: false`), its key version is hardcoded to 1, and it has no
+ * old-master-key fallback (so it cannot decrypt rows written before a
+ * rotation). Overriding only when the registry omitted the entry is dead code
+ * -- the default row is seeded at startup -- and would let `pg:<path>` and
+ * `<path>` behave differently, which is the very defect this routing exists to
+ * fix.
+ *
+ * @param registry - Backend registry, or undefined when none is configured.
+ * @param auditLogger - Audit logger handed to the registry's store factory.
+ * @param defaultStore - Configured store for the default backend.
+ * @param defaultBackendName - Name the default store is registered under.
+ */
+export declare function loadRoutableStores<S, L>(registry: BackendStoreRegistry<S, L> | undefined, auditLogger: L, defaultStore: S, defaultBackendName?: string): Promise<Map<string, S>>;
+/**
+ * Split a wire-form scope into the store that owns it and the bare path.
+ *
+ * Pure: takes the already-loaded store map rather than loading it, so both
+ * planes can unit-test routing without a database.
+ *
+ * @param wireScope - Scope as supplied by the caller, possibly `<backend>:<path>`.
+ * @param stores - Registered backends, keyed by backend name.
+ * @param defaultStore - Store used when the scope carries no recognised qualifier.
+ * @param defaultBackendName - Backend name reported for an unqualified scope.
+ */
+export declare function resolveScope<S>(wireScope: string, stores: Map<string, S>, defaultStore: S, defaultBackendName?: string): ResolvedScope<S>;
+/**
+ * Join a backend name and a bare path back into wire form.
+ *
+ * Used for audit records and cross-backend listings, so an operator reading the
+ * audit log sees the same qualified string the caller sent.
+ */
+export declare function toWireScope(backendName: string, path: string): string;
+//# sourceMappingURL=scope-routing.d.ts.map

package/dist/secrets/secret-resolver.d.ts

@@ -1,13 +1,13 @@
 /**
  * Secret resolver for dispatch-time secret resolution.
  *
- * Uses environment bindings + scope resolver to match secrets from multiple backends.
- * When a job dispatches with an environment name, the resolver:
- * 1. Looks up the environment by name
- * 2. Gets bindings for that environment
+ * Uses context bindings + scope resolver to match secrets from multiple backends.
+ * When a job dispatches with a context name, the resolver:
+ * 1. Looks up the context by name
+ * 2. Gets bindings for that context
  * 3. Queries ALL registered backend stores for secrets
  * 4. Prefixes each secret's scope with the backend name (e.g., pg:aws/prod)
- * 5. Uses resolveSecretsForEnvironment to match bindings against prefixed secrets
+ * 5. Uses resolveSecretsWithProvenance to match bindings against prefixed secrets
  * 6. Returns a flat decrypted key-value map
  *
  * unreachable backends cause job failure (not silent skip).
@@ -15,13 +15,13 @@
  * longest-path-wins uses scope path after stripping backend prefix.
  * audit log includes backend name.
  */
-import { type EnvironmentBinding, type HostFacts, type ScopedSecret } from '@kici-dev/engine';
+import { type ContextBinding, type HostFacts, type ScopedSecret } from '@kici-dev/engine';
 import type { Logger } from '@kici-dev/shared';
 import type { AuditLogger } from './audit-logger.js';
 /**
- * Minimal environment store interface (subset needed by resolver).
+ * Minimal context store interface (subset needed by resolver).
  */
-export interface EnvironmentStoreLike {
+export interface ContextStoreLike {
     getByName(orgId: string, name: string): Promise<{
         id: string;
         name: string;
@@ -32,7 +32,7 @@ export interface EnvironmentStoreLike {
  * Minimal binding store interface (subset needed by resolver).
  */
 export interface BindingStoreLike {
-    getByEnvironmentId(environmentId: string): Promise<EnvironmentBinding[]>;
+    getByContextId(contextId: string): Promise<ContextBinding[]>;
 }
 /**
  * Minimal secret store interface (subset needed by resolver).
@@ -49,7 +49,7 @@ export interface SecretStoreLike {
  * Dependencies for the SecretResolver.
  */
 export interface SecretResolverDeps {
-    environmentStore: EnvironmentStoreLike;
+    contextStore: ContextStoreLike;
     bindingStore: BindingStoreLike;
     /** Map of backend name to store. Replaces single secretStore. */
     backendStores: Map<string, SecretStoreLike>;
@@ -69,16 +69,16 @@ export interface ResolvedSecretMeta {
  * can flow through `ProcessingDeps.secretResolver`.
  */
 export interface SecretResolverApi {
-    resolveForJob(orgId: string, environmentName: string, hostCtx?: HostFacts): Promise<Record<string, string>>;
+    resolveForJob(orgId: string, contextName: string, hostCtx?: HostFacts): Promise<Record<string, string>>;
     resolveNamed(orgId: string, scope: string, key: string, opts?: {
         store?: string;
         runId?: string;
         jobId?: string;
     }): Promise<string | null>;
-    resolveForJobWithMeta(orgId: string, environmentName: string, hostCtx?: HostFacts): Promise<Record<string, ResolvedSecretMeta>>;
+    resolveForJobWithMeta(orgId: string, contextName: string, hostCtx?: HostFacts): Promise<Record<string, ResolvedSecretMeta>>;
 }
 /**
- * Resolves secrets for a job by matching environment bindings against scoped secrets
+ * Resolves secrets for a job by matching context bindings against scoped secrets
  * from multiple backends.
  *
  * All backend stores are queried. Each secret's scope is prefixed with the backend
@@ -87,7 +87,7 @@ export interface SecretResolverApi {
  * stripping the backend prefix.
  */
 export declare class SecretResolver implements SecretResolverApi {
-    private readonly environmentStore;
+    private readonly contextStore;
     private readonly bindingStore;
     private readonly backendStores;
     private readonly auditLogger;
@@ -97,17 +97,17 @@ export declare class SecretResolver implements SecretResolverApi {
      * Resolve secrets for a job dispatch.
      *
      * @param orgId - Organization ID
-     * @param environmentName - Environment name to resolve secrets for
+     * @param contextName - Context name to resolve secrets for
      * @param hostCtx - Optional fan-out child identity for per-host resolution.
      *   When supplied, each binding is gated by its `host_pattern` and its
      *   `scope_pattern` is templated per-child; when omitted, only fleet-wide
      *   (`'**'`) non-templated bindings contribute.
      * @returns Flat map of decrypted secret key-value pairs
      */
-    resolveForJob(orgId: string, environmentName: string, hostCtx?: HostFacts): Promise<Record<string, string>>;
+    resolveForJob(orgId: string, contextName: string, hostCtx?: HostFacts): Promise<Record<string, string>>;
     /**
      * Resolve a single named secret by (orgId, scope, key), optionally scoped to
-     * a specific backend. Bypasses environment bindings — this is a direct
+     * a specific backend. Bypasses context bindings — this is a direct
      * lookup used for source-scoped credentials (e.g. universal-git PAT/SSH
      * keys stored under `__source__/<sourceId>`).
      *
@@ -130,7 +130,7 @@ export declare class SecretResolver implements SecretResolverApi {
      *
      * Returns the secret value along with which backend and scope provided it.
      */
-    resolveForJobWithMeta(orgId: string, environmentName: string, hostCtx?: HostFacts): Promise<Record<string, ResolvedSecretMeta>>;
+    resolveForJobWithMeta(orgId: string, contextName: string, hostCtx?: HostFacts): Promise<Record<string, ResolvedSecretMeta>>;
     /**
      * Collect all secrets from all backend stores, prefixing scopes.
      * Per /: unreachable backends are tracked but not fatal here.
@@ -142,24 +142,11 @@ export declare class SecretResolver implements SecretResolverApi {
      */
     private buildDecryptFn;
     /**
-     * Check if any failed backend could affect the job's environment bindings.
+     * Check if any failed backend could affect the job's context bindings.
      * throw when a failed backend's scopes could match a binding and
      * no healthy backend already satisfies that binding.
      * jobs referencing only healthy backends succeed normally.
      */
     private checkScopedFailure;
-    /**
-     * Find the winning secret for a given key, mirroring the engine scope
-     * resolver's host-aware matching and `(host specificity, scope depth)`
-     * precedence so the enriched metadata reports the same secret the flat
-     * resolution selected.
-     */
-    private findWinningSecret;
-    /**
-     * Resolve the effective scope pattern a binding contributes for a host,
-     * applying the host gate and per-child scope templating. Mirrors the engine
-     * scope resolver's `bindingScopeForHost`. Returns `null` to skip the binding.
-     */
-    private bindingScopeForHost;
 }
 //# sourceMappingURL=secret-resolver.d.ts.map

package/dist/secrets/token-manager.d.ts

@@ -16,15 +16,19 @@ export declare class TokenManager {
      * @param label - Human-readable label for this token.
      * @param role - Role to assign (owner, admin, auditor).
      * @param routingKey - Optional routing key scope (null = all).
+     * @param expiresAt - Optional absolute expiry. When omitted the token
+     *   never expires (null); `validate()` already enforces the column.
      * @returns The plaintext token (shown once) and the row ID.
      */
-    generateToken(label: string, role: Role, routingKey?: string | null): Promise<{
+    generateToken(label: string, role: Role, routingKey?: string | null, expiresAt?: Date | null): Promise<{
         token: string;
         id: string;
     }>;
     /**
      * Validate a plaintext token against stored hashes.
      *
+     * On success, fires a non-blocking update to last_used_at.
+     *
      * @param token - The plaintext token to validate.
      * @returns Token info if valid, null if invalid/expired/revoked.
      */

package/dist/security/comment-handler.d.ts

@@ -5,7 +5,7 @@
  * approval/rejection of security holds. Verifies commenter identity
  * via the trust policy cache and checks ci_trust:write+ before acting.
  */
-import type { HeldRunStore } from '../environments/held-runs.js';
+import type { HeldRunStore } from '../contexts/held-runs.js';
 import { type IdentityLink, type PermissionLevel } from './trust-resolver.js';
 import type { CheckStatusPoster as EngineCheckStatusPoster } from '@kici-dev/engine';
 /** Parsed /kici command from a comment body. */

package/dist/security/contributor-cache.d.ts

@@ -5,18 +5,26 @@
  * Uses a 15-minute TTL and 10,000 max entries.
  */
 import type { ContributorResolver, ContributorInfo } from '@kici-dev/engine';
+import type { ClusterSettingsReader } from '../cluster/cluster-settings-reader.js';
 /**
  * Caches ContributorResolver results in an LRU cache.
  *
  * Cache key format: `{provider}:{repoFullName}:{username}`
- * TTL: 15 minutes (configurable for testing).
+ * TTL: cluster-configurable (`cluster_settings.contributor_cache_ttl_ms`,
+ * default 15 minutes). The TTL is resolved at each `set()` and applied
+ * per-entry, so a live override affects newly-cached entries without a restart.
  */
 export declare class ContributorCache {
     private readonly cache;
+    private readonly clusterSettings?;
+    private readonly defaultTtlMs;
     constructor(options?: {
         ttlMs?: number;
         maxEntries?: number;
+        clusterSettings?: ClusterSettingsReader;
     });
+    /** Resolve the fleet-wide contributor-cache TTL (ms), falling back to the config default. */
+    private ttlMs;
     /**
      * Build the cache key from provider, repo, and username.
      */

package/dist/security/trust-policy-gate.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Org trust-policy gate — turns the Platform-owned policy plus three per-PR
+ * signals into exactly one outcome.
+ *
+ * Pure: no I/O, no DB, no clock. The caller supplies the effective policy (see
+ * `resolveEffectivePolicy`) and the signals; enforcement lives in the dispatch
+ * gate.
+ *
+ * Scope: the caller only invokes this for sources whose provider bundle carries
+ * a `ContributorResolver` (GitHub today). Every other source is trusted by
+ * construction and never reaches here.
+ */
+import { z } from 'zod';
+import type { OrchestratorMode, TrustPolicy, TrustTier } from '@kici-dev/engine';
+import { SecurityHoldReason } from '../contexts/held-runs.js';
+import type { StoredTrustPolicy } from './trust-policy-store.js';
+/**
+ * Which arm of the gate is actually in force for an org — the vocabulary the
+ * admin API reports and `kici-admin trust-policy show` renders.
+ *
+ * `policy` means `resolveEffectivePolicy` produced a policy and all three arms
+ * apply; `legacy` means it produced `null`, so only the legacy
+ * workflow-modification rule runs and there are no policy values to report.
+ * Named here, next to the resolver that decides between them, so the route and
+ * the CLI cannot drift apart on a bare string literal.
+ */
+export declare const TrustPolicyEnforcement: z.ZodEnum<{
+    legacy: "legacy";
+    policy: "policy";
+}>;
+export type TrustPolicyEnforcement = z.infer<typeof TrustPolicyEnforcement>;
+/** The per-PR facts the policy is evaluated against. */
+export interface TrustPolicySignals {
+    /** Resolved contributor tier; undefined when trust resolution failed. */
+    tier: TrustTier | undefined;
+    /** The PR's head repo differs from its base repo. */
+    isForkPR: boolean;
+    /** The PR changes `.kici/` workflow definitions. */
+    hasWorkflowModifications: boolean;
+}
+/**
+ * The reasons the ORG TRUST POLICY itself can raise — its three arms.
+ *
+ * `context_trust` is excluded at the type level rather than merely by
+ * convention: that reason belongs to the per-context minimum-trust gate, which
+ * holds an individual job under its real name. Narrowing here is what lets
+ * `SECURITY_HOLD_JOB_IDS` drop its phantom `context_trust` sentinel — a value
+ * that existed only to satisfy a `Record<SecurityHoldReason, ...>` and was never
+ * written to a single row.
+ */
+export type TrustPolicyHoldReason = Exclude<SecurityHoldReason, 'context_trust'>;
+export type TrustPolicyOutcome = {
+    action: 'pass';
+} | {
+    action: 'hold';
+    reason: TrustPolicyHoldReason;
+    message: string;
+    /**
+     * Hours the resulting hold stays approvable, taken from the SAME policy
+     * that produced this verdict. `null` in independent mode, where there is
+     * no upstream policy and therefore no operator-set window.
+     *
+     * Carried on the outcome rather than re-read at the hold site: a second,
+     * independent read bypassed `resolveEffectivePolicy`, so it was both a
+     * TOCTOU (the policy could change between deciding and sizing) and a
+     * divergence — independent mode got the 72h default where the decision
+     * path deliberately has no policy at all.
+     */
+    approvalExpiryHours: number | null;
+} | {
+    action: 'reject';
+    reason: TrustPolicyHoldReason;
+    message: string;
+};
+/**
+ * The policy a Platform-attached orchestrator applies when it has no stored
+ * row. Every arm holds — a hold is recoverable by approval, and these are the
+ * documented org defaults, so an org that never changed its policy gets the
+ * behavior its dashboard shows.
+ *
+ * This is NOT necessarily a brief transient. The Platform sends
+ * `trust_policy.update` only when the org has a `trust_policies` row, and that
+ * row is created lazily on a dashboard read — so an org that has never opened
+ * Settings > CI trust receives no push at all and stays on these values
+ * indefinitely. The expiry is therefore the generous documented default rather
+ * than a short one: a short window would auto-fail legitimate runs.
+ */
+export declare const FAIL_CLOSED_POLICY: TrustPolicy;
+/**
+ * Pick the policy to evaluate. A stored row always wins. Without one, a
+ * Platform-attached orchestrator fails closed (a push is imminent); an
+ * independent orchestrator has no upstream authority at all, so it gets `null`
+ * and the evaluator applies only the legacy rule — which is what keeps this
+ * change from silently gating existing independent deployments on upgrade.
+ *
+ * `PLATFORM_CONNECTED_MODES` is the shared definition of "expects a Platform
+ * push", so a mode added there is fail-closed here without a second edit.
+ */
+export declare function resolveEffectivePolicy(stored: StoredTrustPolicy | null, mode: OrchestratorMode): TrustPolicy | null;
+/**
+ * Evaluate the policy.
+ *
+ * Arms are evaluated in a fixed order — workflow_modification, fork_pr,
+ * unknown_contributor — and then any `reject` beats any `hold`, with the first
+ * arm in that order supplying the reason among equals. That makes a PR tripping
+ * several arms produce one outcome with a stable reason rather than a verdict
+ * that depends on evaluation accident.
+ *
+ * An unresolved tier (`undefined`) counts as `unknown`, never as a pass: a
+ * trust resolution that could not be answered is not evidence of trust.
+ *
+ * A `null` policy applies only the legacy rule (workflow modifications by a
+ * non-trusted contributor hold), reproducing behavior from before the policy was
+ * enforced.
+ */
+export declare function evaluateTrustPolicy(policy: TrustPolicy | null, signals: TrustPolicySignals): TrustPolicyOutcome;
+//# sourceMappingURL=trust-policy-gate.d.ts.map

package/dist/security/trust-policy-store.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Cache of the Platform-owned org trust policy.
+ *
+ * The Platform is the authority for a Platform-attached org and pushes the
+ * policy on `trust_policy.update`; this store persists it so the policy survives
+ * a restart instead of being unknown until the next push. In independent mode
+ * there is no Platform, so the operator writes the same row via
+ * `kici-admin trust-policy set` and `source` records which wrote it.
+ */
+import { Kysely, type Transaction } from 'kysely';
+import { z } from 'zod';
+import type { TrustPolicy } from '@kici-dev/engine';
+import type { Database } from '../db/types.js';
+/** Who wrote the cached policy row. */
+export declare const TrustPolicySource: z.ZodEnum<{
+    local: "local";
+    platform: "platform";
+}>;
+export type TrustPolicySource = z.infer<typeof TrustPolicySource>;
+/**
+ * The strictest documented defaults. Used to fill gaps on a local merge; the
+ * fail-closed policy an unknown org resolves to lives in `trust-policy-gate.ts`.
+ */
+export declare const DEFAULT_TRUST_POLICY: TrustPolicy;
+/** A policy as stored, with its provenance. */
+export interface StoredTrustPolicy extends TrustPolicy {
+    source: TrustPolicySource;
+    updatedAt: Date;
+}
+export declare class TrustPolicyStore {
+    private readonly db;
+    constructor(db: Kysely<Database>);
+    /** `executor` lets a caller read inside its own transaction. */
+    get(orgId: string, executor?: Kysely<Database> | Transaction<Database>): Promise<StoredTrustPolicy | null>;
+    /**
+     * Needs no lock, unlike `upsertLocal`: a push carries every field, so there
+     * is no read-merge to lose and concurrent pushes correctly settle on the
+     * last one. The two writers also never overlap — `upsertLocal` is reachable
+     * only in independent mode, where no Platform pushes.
+     */
+    upsertFromPlatform(orgId: string, policy: TrustPolicy): Promise<void>;
+    /**
+     * Write an operator-supplied policy. Only reachable in independent mode — the
+     * admin route refuses on a Platform-attached orchestrator, because the next
+     * push would clobber the write.
+     *
+     * The read-merge-write is serialised per org by a transaction-scoped
+     * advisory lock. The transaction alone would NOT give that: under READ
+     * COMMITTED two concurrent PATCHes both read the pre-existing row, and the
+     * second `ON CONFLICT DO UPDATE` then overwrites every column from its own
+     * stale merge — silently dropping the first operator's change (a tightened
+     * `unknownContributorPolicy` reverting to whatever the second caller last
+     * saw). The lock releases on commit or rollback, so there is no unlock to
+     * leak.
+     *
+     * `onWrite` receives the same transaction and the merged result, so an audit
+     * row written there commits or rolls back with the policy itself — a
+     * loosened `forkPolicy` can never land unattributed.
+     *
+     * Returns the merged policy so the caller does not need a second read (which
+     * would be outside the transaction and could observe a later write).
+     */
+    upsertLocal(orgId: string, patch: Partial<TrustPolicy>, onWrite?: (trx: Transaction<Database>, merged: TrustPolicy) => Promise<void>): Promise<TrustPolicy>;
+    private write;
+}
+/**
+ * Build a TrustPolicyStore backed by its own connection pool to the given
+ * orchestrator database URL. Mirrors `createHeldRunStoreFromUrl`; consumed by
+ * E2E tests that assert the pushed policy is persisted in the real deployed
+ * orchestrator DB rather than held in process memory.
+ */
+export declare function createTrustPolicyStoreFromUrl(databaseUrl: string, opts?: {
+    maxConnections?: number;
+}): {
+    store: TrustPolicyStore;
+    dispose: () => Promise<void>;
+};
+//# sourceMappingURL=trust-policy-store.d.ts.map