@kici-dev/orchestrator 0.7.0 → 0.9.0

package/dist/security/global-workflow-policy.d.ts

@@ -15,11 +15,9 @@ interface GlobalWorkflowPermission {
  * off — or the cluster row is unreadable, which fails closed — no repo may
  * register or dispatch a global workflow, whatever the per-org lists say.
  *
- * With the switch on, three independent per-org axes apply (each stored as a
+ * With the switch on, two independent per-org axes apply (each stored as a
  * jsonb array of `{routingKey?, pattern}` entries on `org_settings`). A missing
- * `org_settings` row means "no per-org restrictions" for the repo and source
- * axes, not a denial; elevated access still requires an explicit list, so a
- * missing row grants none.
+ * `org_settings` row means "no per-org restrictions", not a denial.
  *
  * - Workflow-repo allow-list (`global_workflow_allowed_repos`): which repos
  *   may author global workflows. null/empty = any repo. Checked at
@@ -31,9 +29,6 @@ interface GlobalWorkflowPermission {
  *   untrusted contrib repos). Checked at dispatch time against the EVENT's
  *   repo (the repo that emitted the webhook).
  *
- * - Elevated access (`global_workflow_elevated_repos`): which workflow-
- *   authoring repos can read source-repo secrets during execution.
- *
  * Each entry can optionally pin a `routingKey`, restricting the entry to
  * one webhook source. An entry without a routing key applies to any source
  * in the org. An entry whose routing key no longer matches any current
@@ -53,7 +48,7 @@ export declare class GlobalWorkflowPolicy {
      * The fleet-wide master gate, consulted before any per-org list.
      *
      * Returns `undefined` when the gate passes, or the denial to return
-     * verbatim when it does not — so all three axes share one decision and one
+     * verbatim when it does not — so both axes share one decision and one
      * pair of reasons.
      *
      * Fails closed on `{ ok: false }`. That case is a database fault, not an
@@ -86,26 +81,6 @@ export declare class GlobalWorkflowPolicy {
      *    key AND whose pattern matches the source repo → not allowed.
      */
     isSourceRepoAllowed(eventRoutingKey: string, sourceRepoIdentifier: string, customerId: string): Promise<GlobalWorkflowPermission>;
-    /**
-     * Check whether a workflow-authoring repository is on the elevated-access
-     * list. The workflow's routing key is matched against each entry's optional
-     * `routingKey` qualifier. Returns false if no org_settings row or the
-     * elevated list is null/empty.
-     *
-     * @deprecated Not enforced, and not enforceable in this shape. It was meant
-     * to gate a global workflow's job reading the *source* repository's secrets,
-     * but the organization-wide dispatch path resolves no secrets at all — it
-     * binds no secret contexts, and writes no secret material into a job config
-     * (asserted by `pipeline/process-webhook-globals-secrets.test.ts`). So there
-     * is no injection for a grant to widen, and this method has no caller.
-     *
-     * Granting it would not be a matter of calling this from the dispatch path:
-     * secrets are stored `(org_id, scope, key)` with no repository dimension, so
-     * "the source repository's secrets" is not a set the orchestrator can name
-     * today. The list, its admin route, its CLI mutators and its wire field are
-     * deprecated pending removal at v1.0.0 (`docs/user/deprecations.md`).
-     */
-    isElevatedAccessAllowed(workflowRoutingKey: string, repoIdentifier: string, customerId: string): Promise<boolean>;
     private getSettings;
 }
 export {};

package/dist/security/identity-link.d.ts

@@ -40,7 +40,7 @@ export interface IdentityLink {
  * the answer is unambiguous; when they disagree there is no way to tell here
  * which provider serves the commit, so this answers undefined rather than
  * naming the wrong account. Undefined is a safe answer at every call site: the
- * attribution is simply omitted, never replaced by the raw subject id.
+ * attribution is omitted, never replaced by the raw subject id.
  */
 export declare function resolveLinkedUsername(identityLinks: IdentityLink[], userId: string): string | undefined;
 /**

package/dist/security/lock-source.d.ts

@@ -18,7 +18,7 @@ import type { TrustTier } from '@kici-dev/engine';
  * Select which branch's lock file to fetch.
  *
  * Invariant (customer-isolation): for any pull-request event, an
- * untrusted ref (`tier === 'unknown' | 'known' | undefined`) MUST NOT
+ * untrusted ref (`tier === 'unknown' | undefined`) MUST NOT
  * have its HEAD lock file evaluated by the orchestrator. The
  * base-branch lock — controlled by the project's trusted maintainers —
  * is the source of truth for trigger evaluation, trust-tier-based

package/dist/security/trust-directory-store.d.ts

@@ -64,7 +64,7 @@ import type { Database } from '../db/types.js';
  * What it does not pin: the field *set*. A fourth directory field added to
  * `trustPolicyUpdateSchema` is not picked up here, and `server.ts` hand-builds
  * the value it passes to `upsertFromPlatform`, so nothing would fail — the new
- * field would simply go unpersisted. Adding one means extending this object and
+ * field would go unpersisted. Adding one means extending this object and
  * that literal together.
  */
 export declare const trustDirectorySchema: z.ZodObject<{

package/dist/security/trust-policy-gate.d.ts

@@ -22,20 +22,6 @@ import { ForkPolicy } from '@kici-dev/engine';
 import type { OrchestratorMode, TrustPolicy, TrustTier } from '@kici-dev/engine';
 import { SecurityHoldReason } from '../contexts/held-runs.js';
 import type { StoredTrustPolicy } from './trust-policy-store.js';
-/**
- * The enforcement vocabulary the admin API reports and `kici-admin
- * trust-policy show` renders.
- *
- * @deprecated The route reports `policy` unconditionally: `resolveEffectivePolicy`
- * returns a policy for every input, so there is no state left in which the
- * values are absent. The field and this enum stay so an older `kici-admin`
- * binary keeps parsing the response. Removed at v1.0.0.
- */
-export declare const TrustPolicyEnforcement: z.ZodEnum<{
-    legacy: "legacy";
-    policy: "policy";
-}>;
-export type TrustPolicyEnforcement = z.infer<typeof TrustPolicyEnforcement>;
 /** The per-PR facts the fork switch is evaluated against. */
 export interface TrustPolicySignals {
     /** Resolved contributor tier; undefined when no tier was resolved. */

package/dist/security/trust-policy-store.d.ts

@@ -52,9 +52,8 @@ export declare class TrustPolicyStore {
      * COMMITTED two concurrent PATCHes both read the pre-existing row, and the
      * second `ON CONFLICT DO UPDATE` then overwrites every column from its own
      * stale merge — silently dropping the first operator's change (a tightened
-     * `unknownContributorPolicy` reverting to whatever the second caller last
-     * saw). The lock releases on commit or rollback, so there is no unlock to
-     * leak.
+     * `forkPolicy` reverting to whatever the second caller last saw). The lock
+     * releases on commit or rollback, so there is no unlock to leak.
      *
      * `onWrite` receives the same transaction and the merged result, so an audit
      * row written there commits or rolls back with the policy itself — a

package/dist/security/trust-resolver.d.ts

@@ -7,8 +7,7 @@
  * provider API call, no identity lookup.
  *
  * The stored/wire tier vocabulary keeps 'unknown' as the name for
- * "untrusted" and 'trusted' for "trusted"; 'known' is legacy vocabulary
- * that is no longer produced.
+ * "untrusted" and 'trusted' for "trusted".
  */
 import type { TrustTier } from '@kici-dev/engine';
 /** Result of ref-based trust resolution, with the reason recorded for audit. */