@kindgi/api 0.1.4-rc.0 → 0.1.4-rc.2

package/dist/publish-refused.d.ts

@@ -0,0 +1,18 @@
+import type { AgentRegistryBinding } from './agent-binding.js';
+import type { FlowRegistryBinding } from './flow-binding.js';
+import type { GuardrailRegistryBinding } from './guardrail-binding.js';
+import type { ToolRegistryBinding } from './tool-binding.js';
+/**
+ * A deploy's primitive came back from its registry with an outcome other
+ * than `ok` or `already-registered` (e.g. `project-not-found`): the deploy
+ * stops, what it published is rolled back, and the route answers with
+ * that outcome's own status and code (T205). Before, such an outcome was
+ * skipped, and the deployment was recorded without that primitive.
+ */
+export declare class PublishRefused extends Error {
+    readonly primitive: 'tool' | 'guardrail' | 'agent' | 'flow';
+    readonly id: string;
+    readonly code: Exclude<Awaited<ReturnType<ToolRegistryBinding['publish']>>['kind'] | Awaited<ReturnType<GuardrailRegistryBinding['register']>>['kind'] | Awaited<ReturnType<AgentRegistryBinding['publish']>>['kind'] | Awaited<ReturnType<FlowRegistryBinding['publish']>>['kind'], 'ok' | 'already-registered'>;
+    constructor(primitive: 'tool' | 'guardrail' | 'agent' | 'flow', id: string, code: Exclude<Awaited<ReturnType<ToolRegistryBinding['publish']>>['kind'] | Awaited<ReturnType<GuardrailRegistryBinding['register']>>['kind'] | Awaited<ReturnType<AgentRegistryBinding['publish']>>['kind'] | Awaited<ReturnType<FlowRegistryBinding['publish']>>['kind'], 'ok' | 'already-registered'>);
+}
+//# sourceMappingURL=publish-refused.d.ts.map

package/dist/publish-refused.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-refused.d.ts","sourceRoot":"","sources":["../src/publish-refused.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE7D;;;;;;GAMG;AACH,qBAAa,cAAe,SAAQ,KAAK;IAErC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM;IAC3D,QAAQ,CAAC,EAAE,EAAE,MAAM;IACnB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAClB,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAC3D,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GACjE,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAC5D,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAC7D,IAAI,GAAG,oBAAoB,CAC5B;gBARQ,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,EAClD,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAClB,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAC3D,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GACjE,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAC5D,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAC7D,IAAI,GAAG,oBAAoB,CAC5B;CAKJ"}

package/dist/publish-refused.js

@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * A deploy's primitive came back from its registry with an outcome other
+ * than `ok` or `already-registered` (e.g. `project-not-found`): the deploy
+ * stops, what it published is rolled back, and the route answers with
+ * that outcome's own status and code (T205). Before, such an outcome was
+ * skipped, and the deployment was recorded without that primitive.
+ */
+export class PublishRefused extends Error {
+    primitive;
+    id;
+    code;
+    constructor(primitive, id, code) {
+        super(`The ${primitive} ${id} wasn't published: ${code}`);
+        this.primitive = primitive;
+        this.id = id;
+        this.code = code;
+        this.name = 'PublishRefused';
+    }
+}
+//# sourceMappingURL=publish-refused.js.map

package/dist/publish-refused.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-refused.js","sourceRoot":"","sources":["../src/publish-refused.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAOjC;;;;;;GAMG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IAE5B;IACA;IACA;IAHX,YACW,SAAkD,EAClD,EAAU,EACV,IAMR;QAED,KAAK,CAAC,OAAO,SAAS,IAAI,EAAE,sBAAsB,IAAI,EAAE,CAAC,CAAC;QAVjD,cAAS,GAAT,SAAS,CAAyC;QAClD,OAAE,GAAF,EAAE,CAAQ;QACV,SAAI,GAAJ,IAAI,CAMZ;QAGD,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF"}

package/dist/registry-read-only.d.ts

@@ -0,0 +1,32 @@
+import type { Context, MiddlewareHandler } from 'hono';
+import type { AppEnv } from './types.js';
+/**
+ * A registry that takes no writes: it serves its definitions from
+ * somewhere else (under `kindgi dev`, the pack's files). A binding that
+ * sets it has every write refused before the binding is called:
+ * publish, unregister and reinstate (and, for agents, deriving a
+ * version), and a deploy that would publish into it. The refusal is
+ * `409 registry-read-only` with `reason` as its message.
+ */
+export interface RegistryReadOnly {
+    /** Why, and what to do instead, in plain words: the refusal's message. */
+    readonly reason: string;
+}
+/** The refusal of a write to a read-only registry. */
+export declare function refuseReadOnly(c: Context<AppEnv>, readOnly: RegistryReadOnly): Response & import("hono").TypedResponse<{
+    readonly error: {
+        readonly code: string;
+        readonly message: string;
+        readonly details?: {
+            readonly [x: string]: import("hono/utils/types").JSONValue;
+        } | undefined;
+        readonly requestId: string;
+    };
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">;
+/**
+ * A router's writes (every method but GET and HEAD) are refused while
+ * its registry is read-only. Read at request time, so a binding can
+ * become writable without a restart.
+ */
+export declare function refuseWritesWhenReadOnly(readOnly: () => RegistryReadOnly | undefined): MiddlewareHandler<AppEnv>;
+//# sourceMappingURL=registry-read-only.d.ts.map

package/dist/registry-read-only.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-read-only.d.ts","sourceRoot":"","sources":["../src/registry-read-only.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,sDAAsD;AACtD,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,gBAAgB;;;;;;;;;kEAK5E;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,gBAAgB,GAAG,SAAS,GAC3C,iBAAiB,CAAC,MAAM,CAAC,CAM3B"}

package/dist/registry-read-only.js

@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { statusFor, toWireError } from './errors.js';
+/** The refusal of a write to a read-only registry. */
+export function refuseReadOnly(c, readOnly) {
+    c.status(statusFor('registry-read-only'));
+    return c.json(toWireError({ code: 'registry-read-only', message: readOnly.reason }, c.get('requestId')));
+}
+/**
+ * A router's writes (every method but GET and HEAD) are refused while
+ * its registry is read-only. Read at request time, so a binding can
+ * become writable without a restart.
+ */
+export function refuseWritesWhenReadOnly(readOnly) {
+    return async (c, next) => {
+        const marker = readOnly();
+        if (marker === undefined || c.req.method === 'GET' || c.req.method === 'HEAD')
+            return next();
+        return refuseReadOnly(c, marker);
+    };
+}
+//# sourceMappingURL=registry-read-only.js.map

package/dist/registry-read-only.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-read-only.js","sourceRoot":"","sources":["../src/registry-read-only.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAIjC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAgBrD,sDAAsD;AACtD,MAAM,UAAU,cAAc,CAAC,CAAkB,EAAE,QAA0B;IAC3E,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAU,CAAC,CAAC;IACnD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAC1F,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAA4C;IAE5C,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC1B,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,EAAE,CAAC;QAC7F,OAAO,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC,CAAC;AACJ,CAAC"}

package/dist/retention-binding.d.ts

@@ -29,9 +29,12 @@ export interface RetentionBinding {
 export interface RetentionScheduledInput {
     readonly tenantId: TenantId;
     readonly domain?: RetentionDomain;
+    /** Rows per domain at most: each domain is read up to `limit`. */
     readonly limit: number;
     readonly pastGraceOnly?: boolean;
     readonly now?: Date;
+    /** Where a previous page stopped (its `nextCursor`, the runtime's own encoding). */
+    readonly cursor?: string;
 }
 export interface RetentionScheduledItem {
     readonly domain: RetentionDomain;
@@ -49,6 +52,30 @@ export interface RetentionScheduledPage {
     readonly domainsMissingAdapter: readonly RetentionDomain[];
     /** Domains that have an adapter but no matching policy — tombstones sit forever. */
     readonly unpolicedDomains: readonly RetentionDomain[];
+    /** Domains more than one retention policy covers (see `RetentionPolicyConflict`). */
+    readonly conflicts?: readonly RetentionPolicyConflict[];
+    /**
+     * More rows are scheduled than this page holds: some domain stopped at
+     * `limit`. A runtime that doesn't say leaves it out, and the route then
+     * reports `true` when some domain's rows fill `limit` (there may be more).
+     */
+    readonly hasMore?: boolean;
+    /** Pass as `cursor` to continue where this page stopped. Absent: nothing more, or no way to continue. */
+    readonly nextCursor?: string;
+}
+/**
+ * A domain more than one retention policy covers. Publishing refuses a
+ * second policy for a domain (`409 policy-scope-taken`), so only policies
+ * stored before that rule can do this. The one whose latest version is
+ * highest applies, and on equal versions the lower policy id; unregister
+ * the others.
+ */
+export interface RetentionPolicyConflict {
+    readonly domain: RetentionDomain;
+    /** Every policy id that covers the domain, sorted. */
+    readonly policyIds: readonly string[];
+    /** The one of them that applies. */
+    readonly appliedPolicyId: string;
 }
 export interface RetentionSweepInput {
     readonly tenantId: TenantId;
@@ -65,5 +92,7 @@ export interface RetentionSweepResult {
         readonly missingAdapter?: true;
     }[];
     readonly totalPurged: number;
+    /** Domains more than one retention policy covers (see `RetentionPolicyConflict`). */
+    readonly conflicts?: readonly RetentionPolicyConflict[];
 }
 //# sourceMappingURL=retention-binding.d.ts.map

package/dist/retention-binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retention-binding.d.ts","sourceRoot":"","sources":["../src/retention-binding.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,SAAS,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAE3E;;;;OAIG;IACH,KAAK,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACjD,wFAAwF;IACxF,QAAQ,CAAC,qBAAqB,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3D,oFAAoF;IACpF,QAAQ,CAAC,gBAAgB,EAAE,SAAS,eAAe,EAAE,CAAC;CACvD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS;QAC3B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;QACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC;KAChC,EAAE,CAAC;IACJ,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B"}
+{"version":3,"file":"retention-binding.d.ts","sourceRoot":"","sources":["../src/retention-binding.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,SAAS,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAE3E;;;;OAIG;IACH,KAAK,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IACpB,oFAAoF;IACpF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACjD,wFAAwF;IACxF,QAAQ,CAAC,qBAAqB,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3D,oFAAoF;IACpF,QAAQ,CAAC,gBAAgB,EAAE,SAAS,eAAe,EAAE,CAAC;IACtD,qFAAqF;IACrF,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,yGAAyG;IACzG,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,oCAAoC;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS;QAC3B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;QACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC;KAChC,EAAE,CAAC;IACJ,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;CACzD"}

package/dist/routes/agent-releases.d.ts

@@ -0,0 +1,40 @@
+import type { Hono } from 'hono';
+import type { LiveScope } from '@kindgi/types';
+import type { ProjectBinding } from '@kindgi/platform';
+import type { AgentRegistryBinding } from '../agent-binding.js';
+import type { EvalRunBinding } from '../eval-run-binding.js';
+import type { AgentReleaseBindings, Promotion } from '../live-version-binding.js';
+import type { AppEnv } from '../types.js';
+/** The routes that change what's live: authorized as `promote` on the agent, not `admin`. */
+export declare function isPromotionWrite(method: string, path: string): boolean;
+/** `POST …/promotions/check` changes nothing: `read` on the agent. */
+export declare function isPromotionCheck(method: string, path: string): boolean;
+/** What the gate reads besides the releases: comparisons, and a project's org. */
+export interface AgentReleaseGateDeps {
+    readonly evalRuns?: EvalRunBinding;
+    readonly projects?: ProjectBinding;
+}
+/**
+ * Live versions of an agent per scope, and the promotions that set them
+ * (evals step 4):
+ *   GET  /:agentId/live            the version a run would use for a project and segment path
+ *   GET  /:agentId/live-versions   every pin
+ *   POST /:agentId/promotions      make a version live for a scope, through its gate
+ *                                    (201 promoted, 202 waiting for approval, 422 gate-failed)
+ *   POST /:agentId/promotions/check  what the gate would say, writing nothing
+ *   GET  /:agentId/gate-policy     the gate policy that applies to a scope
+ *   GET  /:agentId/promotions[/:id]  the history
+ *   POST /:agentId/live/rollback   back to the scope's previous live version
+ *   POST /:agentId/live/unpin      remove the scope's pin (it falls back to the scope above)
+ */
+export declare function mountAgentReleaseRoutes(r: Hono<AppEnv>, registry: AgentRegistryBinding, releases: AgentReleaseBindings, deps?: AgentReleaseGateDeps): void;
+/** `?scopeKind=tenant|org|project|segment&scopeId=…&segment=key:value` for the history filter. */
+export declare function scopeFromQuery(query: (name: string) => string | undefined, segmentValues: readonly string[]): {
+    kind: 'ok';
+    scope?: LiveScope;
+} | {
+    kind: 'err';
+    message: string;
+};
+export declare function serializePromotion(p: Promotion): Record<string, unknown>;
+//# sourceMappingURL=agent-releases.d.ts.map

package/dist/routes/agent-releases.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-releases.d.ts","sourceRoot":"","sources":["../../src/routes/agent-releases.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,MAAM,CAAC;AAG1C,OAAO,KAAK,EAAU,SAAS,EAA6C,MAAM,eAAe,CAAC;AAElG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,OAAO,KAAK,EAAW,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAItE,OAAO,KAAK,EACV,oBAAoB,EAEpB,SAAS,EAEV,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAQ1C,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,sEAAsE;AACtE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;CACpC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,EACf,QAAQ,EAAE,oBAAoB,EAC9B,QAAQ,EAAE,oBAAoB,EAC9B,IAAI,GAAE,oBAAyB,GAC9B,IAAI,CAkRN;AAgMD,kGAAkG;AAClG,wBAAgB,cAAc,CAC5B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,EAC3C,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CA0BtE;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBxE"}