@kici-dev/orchestrator 0.1.26 → 0.2.0

package/dist/cli/commands/environment.d.ts

@@ -1,25 +0,0 @@
-/**
- * Environment management CLI commands for kici-admin.
- *
- *   environment create         — upsert an environment
- *   environment bind           — bind a scope pattern to an environment
- *   environment set-policy     — update policy fields (branch, reviewers, timers, trust)
- *   environment list           — list environments for an org
- *   environment show           — show a single environment with variables + bindings
- *   environment delete         — delete an environment (cascades bindings, variables, overrides; held-run history survives; pending held runs block with a clear error, resolved holds do not)
- *   environment create-template — create/update an environment template + its seed variables
- *
- * Each command supports two modes (stage-4 pattern from `maintenance.ts`):
- *
- *   HTTP mode (default): requires `--url` + `--token`, routes through the
- *   orchestrator admin HTTP API at /api/v1/admin/environments.
- *
- *   Direct-DB mode: activated when `--database-url` is passed (or
- *   KICI_DATABASE_URL / DATABASE_URL is set). Opens its own pool and runs the
- *   SQL directly via *Direct helpers in @kici-dev/shared. Used by E2E
- *   `globalSetup` helpers that need to seed envs before the orchestrator is up.
- */
-import type { Command } from 'commander';
-import type { AdminApiClient } from '../api-client.js';
-export declare function registerEnvironmentCommands(program: Command, getClient: () => AdminApiClient): void;
-//# sourceMappingURL=environment.d.ts.map

package/dist/environments/binding-store.d.ts

@@ -1,36 +0,0 @@
-/**
- * Binding store -- scope-to-environment binding CRUD.
- *
- * Bindings map scope patterns (e.g. 'aws/prod/**') to environments,
- * controlling which scoped secrets are available in each environment.
- */
-import type { Kysely } from 'kysely';
-import type { Database, EnvironmentBinding } from '../db/types.js';
-/**
- * A scope→environment binding with its host selector. `hostPattern` defaults to
- * `'**'` (all hosts) when omitted.
- */
-export interface BindingInput {
-    scopePattern: string;
-    hostPattern?: string;
-}
-/**
- * Data access layer for environment bindings.
- */
-export declare class BindingStore {
-    private readonly db;
-    constructor(db: Kysely<Database>);
-    /** List all bindings for an environment. */
-    list(orgId: string, environmentId: string): Promise<EnvironmentBinding[]>;
-    /**
-     * Replace all bindings for an environment in a transaction.
-     *
-     * Deletes existing bindings and inserts the new set atomically. Each binding
-     * carries a `scopePattern` and an optional `hostPattern` (defaulting to
-     * `'**'`). Pass an empty array to clear all bindings.
-     */
-    set(orgId: string, environmentId: string, bindings: BindingInput[]): Promise<void>;
-    /** Find bindings for an environment (alias for list, used by secret resolver). */
-    findBindingsForEnvironment(orgId: string, environmentId: string): Promise<EnvironmentBinding[]>;
-}
-//# sourceMappingURL=binding-store.d.ts.map

package/dist/environments/environment-store.d.ts

@@ -1,87 +0,0 @@
-import { type Kysely } from 'kysely';
-import type { Environment as EngineEnvironment } from '@kici-dev/engine';
-import type { Database, Environment } from '../db/types.js';
-/** Thrown by `delete` when pending held runs reference the environment. */
-export declare class EnvironmentDeleteBlockedError extends Error {
-    readonly pendingCount: number;
-    constructor(pendingCount: number);
-}
-/**
- * Map a DB environment row (snake_case) to the engine Environment type (camelCase).
- *
- * Kysely returns JSONB columns as strings; this function parses them into arrays.
- */
-export declare function toEnvironment(row: Environment): EngineEnvironment;
-/** Fields accepted when creating an environment. */
-export interface EnvironmentCreateInput {
-    name: string;
-    type?: 'fixed' | 'glob';
-    globPattern?: string | null;
-    branchRestrictions?: string[];
-    triggerTypeFilters?: string[];
-    repoPatterns?: string[];
-    concurrencyLimit?: number | null;
-    concurrencyStrategy?: 'queue' | 'cancel-pending';
-    concurrencyTimeoutMs?: number;
-    requiredReviewers?: string[] | null;
-    waitTimerSeconds?: number | null;
-    holdExpirySeconds?: number;
-    minimumTrust?: 'known' | 'trusted' | null;
-    allowLocalExecution?: boolean;
-    enabled?: boolean;
-    createdBy?: string | null;
-}
-/** Fields accepted when updating an environment. */
-export interface EnvironmentUpdateInput {
-    name?: string;
-    type?: 'fixed' | 'glob';
-    globPattern?: string | null;
-    branchRestrictions?: string[];
-    triggerTypeFilters?: string[];
-    repoPatterns?: string[];
-    concurrencyLimit?: number | null;
-    concurrencyStrategy?: 'queue' | 'cancel-pending';
-    concurrencyTimeoutMs?: number;
-    requiredReviewers?: string[] | null;
-    waitTimerSeconds?: number | null;
-    holdExpirySeconds?: number;
-    minimumTrust?: 'known' | 'trusted' | null;
-    allowLocalExecution?: boolean;
-    enabled?: boolean;
-}
-/**
- * Data access layer for environments.
- */
-export declare class EnvironmentStore {
-    private readonly db;
-    constructor(db: Kysely<Database>);
-    /** List all environments for an org, ordered by name. */
-    list(orgId: string): Promise<Environment[]>;
-    /** Get a single environment by org + id. Returns null if not found. */
-    get(orgId: string, id: string): Promise<Environment | null>;
-    /** Get a single environment by org + name. Returns null if not found. */
-    getByName(orgId: string, name: string): Promise<Environment | null>;
-    /** Create a new environment. Returns the created row. */
-    create(orgId: string, data: EnvironmentCreateInput): Promise<Environment>;
-    /** Update an environment. Returns the updated row, or null if not found. */
-    update(orgId: string, id: string, updates: EnvironmentUpdateInput): Promise<Environment | null>;
-    /**
-     * Delete an environment.
-     *
-     * Bindings, variables, and source overrides cascade away via their FK.
-     * Terminal held-run history survives with a null `environment_id` (the FK
-     * uses ON DELETE SET NULL). Pending held runs still reference the
-     * environment, so deletion is blocked with `EnvironmentDeleteBlockedError`
-     * until they are approved or rejected.
-     */
-    delete(orgId: string, id: string): Promise<boolean>;
-    /**
-     * Match an environment name against org environments.
-     *
-     * First tries exact name match (for fixed environments).
-     * If no exact match, scans glob-type environments and uses picomatch.
-     * Returns the first matching environment or null.
-     */
-    matchEnvironment(orgId: string, name: string): Promise<Environment | null>;
-}
-//# sourceMappingURL=environment-store.d.ts.map

package/dist/environments/protection/aggregate.d.ts

@@ -1,43 +0,0 @@
-import { EnvGateRejectReason, type Environment } from '@kici-dev/engine';
-import type { JobDispatchContext } from './pipeline.js';
-/** A single environment's rejection under all-must-pass aggregation. */
-export interface EnvGateRejection {
-    environment: string;
-    reason: EnvGateRejectReason;
-    detail: string;
-}
-/** Effective protection parameters after most-restrictive aggregation. */
-export interface EffectiveProtection {
-    minimumTrust?: 'known' | 'trusted';
-    requiredReviewers: string[];
-    waitTimerSeconds: number | null;
-    holdExpirySeconds: number;
-    concurrencyLimit: number | null;
-    concurrencyStrategy: 'queue' | 'cancel-pending';
-}
-/**
- * Evaluate each environment's hard reject gates against the run context. A name
- * with no `Environment` record yields an `env_not_found` rejection. Returns all
- * rejections (empty = every environment passed the reject gates).
- */
-export declare function evaluateMultiEnvGates(envs: ReadonlyArray<{
-    name: string;
-    env: Environment | undefined;
-}>, ctx: JobDispatchContext): EnvGateRejection[];
-/**
- * Aggregate hold/wait/queue parameters across all bound environments, most
- * restrictive wins: trust = max tier, reviewers = sorted dedup union, wait timer
- * = max, hold expiry = min, concurrency limit = min (tightest). The concurrency
- * strategy follows the primary (first) environment.
- */
-export declare function aggregateProtectionParams(envs: ReadonlyArray<Environment>): EffectiveProtection;
-/**
- * Build a synthetic `Environment` carrying the aggregated protection parameters,
- * so the existing per-rule gate functions (trust/concurrency/reviewer/wait) can
- * evaluate the all-must-pass holds in one pass. Branch/trigger/repo/enabled are
- * already handled by `evaluateMultiEnvGates`, so they are neutralized here.
- */
-export declare function buildEffectiveEnvironment(primary: Environment, eff: EffectiveProtection): Environment;
-/** Format a human-readable rejection reason naming the env(s) and rule(s). */
-export declare function formatMultiEnvRejection(rejections: ReadonlyArray<EnvGateRejection>): string;
-//# sourceMappingURL=aggregate.d.ts.map

package/dist/environments/protection/branch-gate.d.ts

@@ -1,5 +0,0 @@
-import type { Environment, ProtectionGateResult } from '@kici-dev/engine';
-import type { JobDispatchContext } from './pipeline.js';
-/** Evaluate branch restrictions, trigger type filters, and repo patterns. */
-export declare function evaluateBranchGate(env: Environment, ctx: JobDispatchContext): ProtectionGateResult;
-//# sourceMappingURL=branch-gate.d.ts.map

package/dist/environments/protection/concurrency-gate.d.ts

@@ -1,7 +0,0 @@
-/**
- * Concurrency gate -- checks concurrency limits.
- */
-import type { Environment, ProtectionGateResult } from '@kici-dev/engine';
-/** Evaluate concurrency limits for the environment. */
-export declare function evaluateConcurrencyGate(env: Environment, currentRunningCount: number, _concurrencyGroup: string): ProtectionGateResult;
-//# sourceMappingURL=concurrency-gate.d.ts.map

package/dist/environments/protection/reviewer-gate.d.ts

@@ -1,7 +0,0 @@
-/**
- * Reviewer gate -- checks required reviewers.
- */
-import type { Environment, ProtectionGateResult } from '@kici-dev/engine';
-/** Evaluate reviewer requirements for the environment. */
-export declare function evaluateReviewerGate(env: Environment): ProtectionGateResult;
-//# sourceMappingURL=reviewer-gate.d.ts.map

package/dist/environments/protection/trust-gate.d.ts

@@ -1,7 +0,0 @@
-/**
- * Trust gate -- checks contributor trust tier against environment minimumTrust.
- */
-import type { Environment, ProtectionGateResult, TrustTier } from '@kici-dev/engine';
-/** Evaluate minimumTrust requirements for the environment. */
-export declare function evaluateTrustGate(env: Environment, trustTier: TrustTier | undefined): ProtectionGateResult;
-//# sourceMappingURL=trust-gate.d.ts.map

package/dist/environments/protection/wait-timer-gate.d.ts

@@ -1,7 +0,0 @@
-/**
- * Wait timer gate -- checks wait timer configuration.
- */
-import type { Environment, ProtectionGateResult } from '@kici-dev/engine';
-/** Evaluate wait timer for the environment. */
-export declare function evaluateWaitTimerGate(env: Environment): ProtectionGateResult;
-//# sourceMappingURL=wait-timer-gate.d.ts.map

package/dist/environments/variable-store.d.ts

@@ -1,39 +0,0 @@
-/**
- * Variable store -- environment variable CRUD with lock enforcement.
- *
- * Manages org-level environment variables and per-source overrides.
- * Lock enforcement: locked org vars cannot be overridden by source overrides.
- */
-import { type Kysely } from 'kysely';
-import type { Database, EnvironmentVariable, EnvironmentSourceOverride } from '../db/types.js';
-/**
- * Data access layer for environment variables and source overrides.
- */
-export declare class VariableStore {
-    private readonly db;
-    constructor(db: Kysely<Database>);
-    /** List all org-level variables for an environment. */
-    listVars(orgId: string, environmentId: string): Promise<EnvironmentVariable[]>;
-    /** Upsert an org-level variable. */
-    setVar(orgId: string, environmentId: string, key: string, value: string, locked?: boolean): Promise<void>;
-    /** Delete an org-level variable. */
-    deleteVar(orgId: string, environmentId: string, key: string): Promise<void>;
-    /** List source overrides for a specific source (routing key). */
-    listSourceOverrides(orgId: string, environmentId: string, routingKey: string): Promise<EnvironmentSourceOverride[]>;
-    /** Upsert a source override. */
-    setSourceOverride(orgId: string, environmentId: string, routingKey: string, key: string, value: string): Promise<void>;
-    /** Delete a source override. */
-    deleteSourceOverride(orgId: string, environmentId: string, routingKey: string, key: string): Promise<void>;
-    /**
-     * Get resolved variables for an environment, optionally merged with source overrides.
-     *
-     * Merge rules:
-     * - Org-level vars form the base
-     * - Source overrides can add new keys and override unlocked org vars
-     * - Locked org vars are NOT overridden by source overrides
-     *
-     * @param routingKey - If provided, source overrides are merged in
-     */
-    getResolvedVars(orgId: string, environmentId: string, routingKey?: string): Promise<Record<string, string>>;
-}
-//# sourceMappingURL=variable-store.d.ts.map

package/dist/routes/admin-environments.d.ts

@@ -1,47 +0,0 @@
-/**
- * Admin API routes for environment management.
- *
- *   POST   /api/v1/admin/environments                                    — create (upsert)
- *   POST   /api/v1/admin/environments/:name/bind                         — bind a scope pattern
- *   PATCH  /api/v1/admin/environments/:name/policy                       — update policy fields
- *   GET    /api/v1/admin/environments?orgId=<id>                         — list environments
- *   GET    /api/v1/admin/environments/:name?orgId=<id>                   — show env + vars + bindings
- *   DELETE /api/v1/admin/environments/:name?orgId=<id>                   — delete env (cascades bindings/variables/overrides; pending held runs block with 409)
- *   POST   /api/v1/admin/environments/templates                          — create/update a template
- *   GET    /api/v1/admin/environments/:name/variables?orgId=<id>         — list org-level variables
- *   PUT    /api/v1/admin/environments/:name/variables/:key?orgId=<id>    — upsert variable
- *   DELETE /api/v1/admin/environments/:name/variables/:key?orgId=<id>    — delete variable
- *
- * Backs the `kici-admin environment` dual-mode CLI. Offline (direct-DB) mode
- * bypasses this router entirely — the CLI calls `*Direct` helpers from
- * @kici-dev/shared. This HTTP surface exists so tooling with only an admin
- * token (no DB reach) can do the same operations.
- *
- * All routes are protected by the admin auth middleware mounted in admin.ts
- * (at `/api/v1/admin/*`). That middleware sets `role` + `userId` on the
- * context, which we use for RBAC gating here.
- */
-import { Hono } from 'hono';
-import { type Kysely } from 'kysely';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
-export interface AdminEnvironmentRoutesDeps {
-    db: Kysely<any>;
-    rbac: RbacEnforcer;
-}
-/** Hono env type for admin-environments routes with context variables. */
-type AdminEnvEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
-/**
- * Create admin API routes for environment management.
- *
- * @param deps - db (Kysely) + rbac enforcer
- * @returns Hono app mounted at /api/v1/admin
- */
-export declare function createAdminEnvironmentRoutes(deps: AdminEnvironmentRoutesDeps): Hono<AdminEnvEnv>;
-export {};
-//# sourceMappingURL=admin-environments.d.ts.map