@kici-dev/orchestrator 0.1.27 → 0.3.0

package/dist/security/trust-policy-store.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Cache of the Platform-owned org trust policy.
+ *
+ * The Platform is the authority for a Platform-attached org and pushes the
+ * policy on `trust_policy.update`; this store persists it so the policy survives
+ * a restart instead of being unknown until the next push. In independent mode
+ * there is no Platform, so the operator writes the same row via
+ * `kici-admin trust-policy set` and `source` records which wrote it.
+ */
+import { Kysely, type Transaction } from 'kysely';
+import { z } from 'zod';
+import type { TrustPolicy } from '@kici-dev/engine';
+import type { Database } from '../db/types.js';
+/** Who wrote the cached policy row. */
+export declare const TrustPolicySource: z.ZodEnum<{
+    local: "local";
+    platform: "platform";
+}>;
+export type TrustPolicySource = z.infer<typeof TrustPolicySource>;
+/**
+ * The strictest documented defaults. Used to fill gaps on a local merge; the
+ * fail-closed policy an unknown org resolves to lives in `trust-policy-gate.ts`.
+ */
+export declare const DEFAULT_TRUST_POLICY: TrustPolicy;
+/** A policy as stored, with its provenance. */
+export interface StoredTrustPolicy extends TrustPolicy {
+    source: TrustPolicySource;
+    updatedAt: Date;
+}
+export declare class TrustPolicyStore {
+    private readonly db;
+    constructor(db: Kysely<Database>);
+    /** `executor` lets a caller read inside its own transaction. */
+    get(orgId: string, executor?: Kysely<Database> | Transaction<Database>): Promise<StoredTrustPolicy | null>;
+    /**
+     * Needs no lock, unlike `upsertLocal`: a push carries every field, so there
+     * is no read-merge to lose and concurrent pushes correctly settle on the
+     * last one. The two writers also never overlap — `upsertLocal` is reachable
+     * only in independent mode, where no Platform pushes.
+     */
+    upsertFromPlatform(orgId: string, policy: TrustPolicy): Promise<void>;
+    /**
+     * Write an operator-supplied policy. Only reachable in independent mode — the
+     * admin route refuses on a Platform-attached orchestrator, because the next
+     * push would clobber the write.
+     *
+     * The read-merge-write is serialised per org by a transaction-scoped
+     * advisory lock. The transaction alone would NOT give that: under READ
+     * COMMITTED two concurrent PATCHes both read the pre-existing row, and the
+     * second `ON CONFLICT DO UPDATE` then overwrites every column from its own
+     * stale merge — silently dropping the first operator's change (a tightened
+     * `unknownContributorPolicy` reverting to whatever the second caller last
+     * saw). The lock releases on commit or rollback, so there is no unlock to
+     * leak.
+     *
+     * `onWrite` receives the same transaction and the merged result, so an audit
+     * row written there commits or rolls back with the policy itself — a
+     * loosened `forkPolicy` can never land unattributed.
+     *
+     * Returns the merged policy so the caller does not need a second read (which
+     * would be outside the transaction and could observe a later write).
+     */
+    upsertLocal(orgId: string, patch: Partial<TrustPolicy>, onWrite?: (trx: Transaction<Database>, merged: TrustPolicy) => Promise<void>): Promise<TrustPolicy>;
+    private write;
+}
+/**
+ * Build a TrustPolicyStore backed by its own connection pool to the given
+ * orchestrator database URL. Mirrors `createHeldRunStoreFromUrl`; consumed by
+ * E2E tests that assert the pushed policy is persisted in the real deployed
+ * orchestrator DB rather than held in process memory.
+ */
+export declare function createTrustPolicyStoreFromUrl(databaseUrl: string, opts?: {
+    maxConnections?: number;
+}): {
+    store: TrustPolicyStore;
+    dispose: () => Promise<void>;
+};
+//# sourceMappingURL=trust-policy-store.d.ts.map