@kindgi/api 0.1.4-rc.1 → 0.1.4-rc.3

package/dist/publish-refused.d.ts

@@ -0,0 +1,18 @@
+import type { AgentRegistryBinding } from './agent-binding.js';
+import type { FlowRegistryBinding } from './flow-binding.js';
+import type { GuardrailRegistryBinding } from './guardrail-binding.js';
+import type { ToolRegistryBinding } from './tool-binding.js';
+/**
+ * A deploy's primitive came back from its registry with an outcome other
+ * than `ok` or `already-registered` (e.g. `project-not-found`): the deploy
+ * stops, what it published is rolled back, and the route answers with
+ * that outcome's own status and code (T205). Before, such an outcome was
+ * skipped, and the deployment was recorded without that primitive.
+ */
+export declare class PublishRefused extends Error {
+    readonly primitive: 'tool' | 'guardrail' | 'agent' | 'flow';
+    readonly id: string;
+    readonly code: Exclude<Awaited<ReturnType<ToolRegistryBinding['publish']>>['kind'] | Awaited<ReturnType<GuardrailRegistryBinding['register']>>['kind'] | Awaited<ReturnType<AgentRegistryBinding['publish']>>['kind'] | Awaited<ReturnType<FlowRegistryBinding['publish']>>['kind'], 'ok' | 'already-registered'>;
+    constructor(primitive: 'tool' | 'guardrail' | 'agent' | 'flow', id: string, code: Exclude<Awaited<ReturnType<ToolRegistryBinding['publish']>>['kind'] | Awaited<ReturnType<GuardrailRegistryBinding['register']>>['kind'] | Awaited<ReturnType<AgentRegistryBinding['publish']>>['kind'] | Awaited<ReturnType<FlowRegistryBinding['publish']>>['kind'], 'ok' | 'already-registered'>);
+}
+//# sourceMappingURL=publish-refused.d.ts.map

package/dist/publish-refused.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-refused.d.ts","sourceRoot":"","sources":["../src/publish-refused.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE7D;;;;;;GAMG;AACH,qBAAa,cAAe,SAAQ,KAAK;IAErC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM;IAC3D,QAAQ,CAAC,EAAE,EAAE,MAAM;IACnB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAClB,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAC3D,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GACjE,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAC5D,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAC7D,IAAI,GAAG,oBAAoB,CAC5B;gBARQ,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,EAClD,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAClB,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAC3D,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GACjE,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAC5D,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAC7D,IAAI,GAAG,oBAAoB,CAC5B;CAKJ"}

package/dist/publish-refused.js

@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * A deploy's primitive came back from its registry with an outcome other
+ * than `ok` or `already-registered` (e.g. `project-not-found`): the deploy
+ * stops, what it published is rolled back, and the route answers with
+ * that outcome's own status and code (T205). Before, such an outcome was
+ * skipped, and the deployment was recorded without that primitive.
+ */
+export class PublishRefused extends Error {
+    primitive;
+    id;
+    code;
+    constructor(primitive, id, code) {
+        super(`The ${primitive} ${id} wasn't published: ${code}`);
+        this.primitive = primitive;
+        this.id = id;
+        this.code = code;
+        this.name = 'PublishRefused';
+    }
+}
+//# sourceMappingURL=publish-refused.js.map

package/dist/publish-refused.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-refused.js","sourceRoot":"","sources":["../src/publish-refused.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAOjC;;;;;;GAMG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IAE5B;IACA;IACA;IAHX,YACW,SAAkD,EAClD,EAAU,EACV,IAMR;QAED,KAAK,CAAC,OAAO,SAAS,IAAI,EAAE,sBAAsB,IAAI,EAAE,CAAC,CAAC;QAVjD,cAAS,GAAT,SAAS,CAAyC;QAClD,OAAE,GAAF,EAAE,CAAQ;QACV,SAAI,GAAJ,IAAI,CAMZ;QAGD,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF"}

package/dist/retention-binding.d.ts

@@ -29,9 +29,12 @@ export interface RetentionBinding {
 export interface RetentionScheduledInput {
     readonly tenantId: TenantId;
     readonly domain?: RetentionDomain;
+    /** Rows per domain at most: each domain is read up to `limit`. */
     readonly limit: number;
     readonly pastGraceOnly?: boolean;
     readonly now?: Date;
+    /** Where a previous page stopped (its `nextCursor`, the runtime's own encoding). */
+    readonly cursor?: string;
 }
 export interface RetentionScheduledItem {
     readonly domain: RetentionDomain;
@@ -49,6 +52,30 @@ export interface RetentionScheduledPage {
     readonly domainsMissingAdapter: readonly RetentionDomain[];
     /** Domains that have an adapter but no matching policy — tombstones sit forever. */
     readonly unpolicedDomains: readonly RetentionDomain[];
+    /** Domains more than one retention policy covers (see `RetentionPolicyConflict`). */
+    readonly conflicts?: readonly RetentionPolicyConflict[];
+    /**
+     * More rows are scheduled than this page holds: some domain stopped at
+     * `limit`. A runtime that doesn't say leaves it out, and the route then
+     * reports `true` when some domain's rows fill `limit` (there may be more).
+     */
+    readonly hasMore?: boolean;
+    /** Pass as `cursor` to continue where this page stopped. Absent: nothing more, or no way to continue. */
+    readonly nextCursor?: string;
+}
+/**
+ * A domain more than one retention policy covers. Publishing refuses a
+ * second policy for a domain (`409 policy-scope-taken`), so only policies
+ * stored before that rule can do this. The one whose latest version is
+ * highest applies, and on equal versions the lower policy id; unregister
+ * the others.
+ */
+export interface RetentionPolicyConflict {
+    readonly domain: RetentionDomain;
+    /** Every policy id that covers the domain, sorted. */
+    readonly policyIds: readonly string[];
+    /** The one of them that applies. */
+    readonly appliedPolicyId: string;
 }
 export interface RetentionSweepInput {
     readonly tenantId: TenantId;
@@ -65,5 +92,7 @@ export interface RetentionSweepResult {
         readonly missingAdapter?: true;
     }[];
     readonly totalPurged: number;
+    /** Domains more than one retention policy covers (see `RetentionPolicyConflict`). */
+    readonly conflicts?: readonly RetentionPolicyConflict[];
 }
 //# sourceMappingURL=retention-binding.d.ts.map

package/dist/retention-binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retention-binding.d.ts","sourceRoot":"","sources":["../src/retention-binding.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,SAAS,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAE3E;;;;OAIG;IACH,KAAK,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACjD,wFAAwF;IACxF,QAAQ,CAAC,qBAAqB,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3D,oFAAoF;IACpF,QAAQ,CAAC,gBAAgB,EAAE,SAAS,eAAe,EAAE,CAAC;CACvD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS;QAC3B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;QACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC;KAChC,EAAE,CAAC;IACJ,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B"}
+{"version":3,"file":"retention-binding.d.ts","sourceRoot":"","sources":["../src/retention-binding.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,SAAS,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAE3E;;;;OAIG;IACH,KAAK,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IACpB,oFAAoF;IACpF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACjD,wFAAwF;IACxF,QAAQ,CAAC,qBAAqB,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3D,oFAAoF;IACpF,QAAQ,CAAC,gBAAgB,EAAE,SAAS,eAAe,EAAE,CAAC;IACtD,qFAAqF;IACrF,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,yGAAyG;IACzG,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,oCAAoC;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS;QAC3B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;QACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC;KAChC,EAAE,CAAC;IACJ,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;CACzD"}

package/dist/routes/agent-releases.d.ts

@@ -0,0 +1,40 @@
+import type { Hono } from 'hono';
+import type { LiveScope } from '@kindgi/types';
+import type { ProjectBinding } from '@kindgi/platform';
+import type { AgentRegistryBinding } from '../agent-binding.js';
+import type { EvalRunBinding } from '../eval-run-binding.js';
+import type { AgentReleaseBindings, Promotion } from '../live-version-binding.js';
+import type { AppEnv } from '../types.js';
+/** The routes that change what's live: authorized as `promote` on the agent, not `admin`. */
+export declare function isPromotionWrite(method: string, path: string): boolean;
+/** `POST …/promotions/check` changes nothing: `read` on the agent. */
+export declare function isPromotionCheck(method: string, path: string): boolean;
+/** What the gate reads besides the releases: comparisons, and a project's org. */
+export interface AgentReleaseGateDeps {
+    readonly evalRuns?: EvalRunBinding;
+    readonly projects?: ProjectBinding;
+}
+/**
+ * Live versions of an agent per scope, and the promotions that set them
+ * (evals step 4):
+ *   GET  /:agentId/live            the version a run would use for a project and segment path
+ *   GET  /:agentId/live-versions   every pin
+ *   POST /:agentId/promotions      make a version live for a scope, through its gate
+ *                                    (201 promoted, 202 waiting for approval, 422 gate-failed)
+ *   POST /:agentId/promotions/check  what the gate would say, writing nothing
+ *   GET  /:agentId/gate-policy     the gate policy that applies to a scope
+ *   GET  /:agentId/promotions[/:id]  the history
+ *   POST /:agentId/live/rollback   back to the scope's previous live version
+ *   POST /:agentId/live/unpin      remove the scope's pin (it falls back to the scope above)
+ */
+export declare function mountAgentReleaseRoutes(r: Hono<AppEnv>, registry: AgentRegistryBinding, releases: AgentReleaseBindings, deps?: AgentReleaseGateDeps): void;
+/** `?scopeKind=tenant|org|project|segment&scopeId=…&segment=key:value` for the history filter. */
+export declare function scopeFromQuery(query: (name: string) => string | undefined, segmentValues: readonly string[]): {
+    kind: 'ok';
+    scope?: LiveScope;
+} | {
+    kind: 'err';
+    message: string;
+};
+export declare function serializePromotion(p: Promotion): Record<string, unknown>;
+//# sourceMappingURL=agent-releases.d.ts.map

package/dist/routes/agent-releases.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-releases.d.ts","sourceRoot":"","sources":["../../src/routes/agent-releases.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,MAAM,CAAC;AAG1C,OAAO,KAAK,EAAU,SAAS,EAA6C,MAAM,eAAe,CAAC;AAElG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,OAAO,KAAK,EAAW,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAItE,OAAO,KAAK,EACV,oBAAoB,EAEpB,SAAS,EAEV,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAQ1C,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,sEAAsE;AACtE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;CACpC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,EACf,QAAQ,EAAE,oBAAoB,EAC9B,QAAQ,EAAE,oBAAoB,EAC9B,IAAI,GAAE,oBAAyB,GAC9B,IAAI,CAkRN;AAgMD,kGAAkG;AAClG,wBAAgB,cAAc,CAC5B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,EAC3C,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CA0BtE;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBxE"}

package/dist/routes/agent-releases.js

@@ -0,0 +1,462 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { statusFor, toWireError } from '../errors.js';
+import { evaluateGate } from '../gate.js';
+import { serializeGatePolicy } from './gate-policy-wire.js';
+import { liveScopeToWire, parseLiveScopeBody } from './live-scope-wire.js';
+import { clampLimit } from './pagination.js';
+import { parseSegmentsQuery } from './segments.js';
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** The routes that change what's live: authorized as `promote` on the agent, not `admin`. */
+export function isPromotionWrite(method, path) {
+    return method === 'POST' && /\/(promotions|live\/rollback|live\/unpin)$/.test(path);
+}
+/** `POST …/promotions/check` changes nothing: `read` on the agent. */
+export function isPromotionCheck(method, path) {
+    return method === 'POST' && path.endsWith('/promotions/check');
+}
+/**
+ * Live versions of an agent per scope, and the promotions that set them
+ * (evals step 4):
+ *   GET  /:agentId/live            the version a run would use for a project and segment path
+ *   GET  /:agentId/live-versions   every pin
+ *   POST /:agentId/promotions      make a version live for a scope, through its gate
+ *                                    (201 promoted, 202 waiting for approval, 422 gate-failed)
+ *   POST /:agentId/promotions/check  what the gate would say, writing nothing
+ *   GET  /:agentId/gate-policy     the gate policy that applies to a scope
+ *   GET  /:agentId/promotions[/:id]  the history
+ *   POST /:agentId/live/rollback   back to the scope's previous live version
+ *   POST /:agentId/live/unpin      remove the scope's pin (it falls back to the scope above)
+ */
+export function mountAgentReleaseRoutes(r, registry, releases, deps = {}) {
+    r.get('/:agentId/live', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const agentId = c.req.param('agentId');
+        const projectId = c.req.query('projectId');
+        if (projectId !== undefined && !UUID_RE.test(projectId)) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: '`projectId` must be a project id (a UUID)' }, requestId));
+        }
+        const segments = parseSegmentsQuery(c.req.queries('segment') ?? []);
+        if (segments.kind === 'err') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: segments.message }, requestId));
+        }
+        if (segments.segments !== undefined && projectId === undefined) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'A `segment` path needs a `projectId`' }, requestId));
+        }
+        const resolved = await releases.live.resolve({
+            tenantId,
+            agentId,
+            ...(projectId !== undefined && { projectId: projectId }),
+            ...(segments.segments !== undefined && { segments: segments.segments }),
+        });
+        if (resolved !== null) {
+            return c.json({
+                agentId,
+                version: resolved.version,
+                via: 'live',
+                liveScope: liveScopeToWire(resolved.scope),
+            });
+        }
+        // Nothing pinned on the way up: what a run gets is the latest registered version.
+        const latest = await registry.get({ tenantId, agentId: agentId });
+        if (latest === null) {
+            c.status(statusFor('agent-not-found'));
+            return c.json(toWireError({ code: 'agent-not-found', message: `No agent "${agentId}" is registered` }, requestId));
+        }
+        return c.json({ agentId, version: latest.version, via: 'latest' });
+    });
+    r.get('/:agentId/live-versions', async (c) => {
+        const tenantId = c.get('tenantId');
+        const pins = await releases.live.list({ tenantId, agentId: c.req.param('agentId') });
+        return c.json({
+            data: pins.map((p) => ({
+                agentId: p.agentId,
+                scope: liveScopeToWire(p.scope),
+                version: p.version,
+                promotionId: p.promotionId,
+                setAt: p.setAt,
+            })),
+        });
+    });
+    r.post('/:agentId/promotions', async (c) => {
+        const requestId = c.get('requestId');
+        const parsed = await readPromotionBody(c);
+        if (parsed.kind === 'err')
+            return badInput(c, requestId, parsed.message);
+        const tenantId = c.get('tenantId');
+        const agentId = c.req.param('agentId');
+        const input = {
+            tenantId,
+            agentId,
+            version: parsed.value.version,
+            scope: parsed.value.scope,
+            requestedBy: actorOf(c),
+            ...(parsed.value.reason !== undefined && { reason: parsed.value.reason }),
+            ...(parsed.value.evalRunId !== undefined && { evalRunId: parsed.value.evalRunId }),
+        };
+        const policy = await policyFor(releases, tenantId, agentId, parsed.value.scope);
+        if (releases.promotions.request === undefined) {
+            if (policy !== null) {
+                c.status(statusFor('promotion-gate-unsupported'));
+                return c.json(toWireError({
+                    code: 'promotion-gate-unsupported',
+                    message: `Gate policy ${policy.id} ${policy.version} applies to this promotion, and this deployment can't record a gated promotion yet.`,
+                }, requestId));
+            }
+            // No gate, and a binding from before gates: promote as before.
+            const outcome = await releases.promotions.promote(input);
+            if (outcome.kind === 'err')
+                return failed(c, requestId, outcome.error);
+            c.status(201);
+            return c.json(serializePromotion(outcome.value));
+        }
+        const gate = await runGate(registry, releases, deps, { ...parsed.value, tenantId, agentId }, policy);
+        if (gate.kind === 'err')
+            return failed(c, requestId, gate.error);
+        const outcome = await releases.promotions.request({
+            ...input,
+            gate: {
+                policy: policy === null ? null : { id: policy.id, version: policy.version },
+                checks: gate.result.checks,
+                passed: gate.result.passed,
+                ...(gate.result.approval !== undefined && { approval: gate.result.approval }),
+                servingVersion: gate.servingVersion,
+            },
+        });
+        if (outcome.kind === 'err')
+            return failed(c, requestId, outcome.error);
+        const promotion = outcome.value;
+        if (promotion.status === 'refused') {
+            const checks = promotion.checks ?? gate.result.checks;
+            c.status(statusFor('gate-failed'));
+            return c.json(toWireError({
+                code: 'gate-failed',
+                message: `The gate refused ${agentId} ${parsed.value.version}: ${checks
+                    .filter((check) => !check.passed)
+                    .map((check) => check.message)
+                    .join(' ')}`,
+                promotionId: promotion.id,
+                policy: promotion.policy ?? null,
+                checks,
+            }, requestId));
+        }
+        c.status(promotion.status === 'pending-approval' ? 202 : 201);
+        return c.json(serializePromotion(promotion));
+    });
+    r.post('/:agentId/promotions/check', async (c) => {
+        const requestId = c.get('requestId');
+        const parsed = await readPromotionBody(c);
+        if (parsed.kind === 'err')
+            return badInput(c, requestId, parsed.message);
+        const tenantId = c.get('tenantId');
+        const agentId = c.req.param('agentId');
+        const policy = await policyFor(releases, tenantId, agentId, parsed.value.scope);
+        const gate = await runGate(registry, releases, deps, { ...parsed.value, tenantId, agentId }, policy);
+        if (gate.kind === 'err')
+            return failed(c, requestId, gate.error);
+        const { result } = gate;
+        return c.json({
+            outcome: !result.passed
+                ? 'gate-failed'
+                : result.approval !== undefined
+                    ? 'needs-approval'
+                    : 'would-promote',
+            policy: policy === null ? null : { id: policy.id, version: policy.version },
+            checks: result.checks,
+            ...(result.approval !== undefined && { approval: result.approval }),
+        });
+    });
+    r.get('/:agentId/gate-policy', async (c) => {
+        const requestId = c.get('requestId');
+        const scope = scopeFromQuery((n) => c.req.query(n), c.req.queries('segment') ?? []);
+        if (scope.kind === 'err')
+            return badInput(c, requestId, scope.message);
+        if (scope.scope === undefined) {
+            return badInput(c, requestId, '`scopeKind` is required: the scope a promotion would be for');
+        }
+        const policy = await policyFor(releases, c.get('tenantId'), c.req.param('agentId'), scope.scope);
+        return c.json({ policy: policy === null ? null : serializeGatePolicy(policy) });
+    });
+    r.get('/:agentId/promotions', async (c) => {
+        const requestId = c.get('requestId');
+        const scope = scopeFromQuery((n) => c.req.query(n), c.req.queries('segment') ?? []);
+        if (scope.kind === 'err')
+            return badInput(c, requestId, scope.message);
+        const cursor = c.req.query('cursor');
+        const page = await releases.promotions.list({
+            tenantId: c.get('tenantId'),
+            agentId: c.req.param('agentId'),
+            limit: clampLimit(c.req.query('limit')),
+            ...(scope.scope !== undefined && { scope: scope.scope }),
+            ...(cursor !== undefined && cursor.length > 0 && { cursor: cursor }),
+        });
+        return c.json({
+            data: page.data.map(serializePromotion),
+            hasMore: page.nextCursor !== undefined,
+            ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor }),
+        });
+    });
+    r.get('/:agentId/promotions/:promotionId', async (c) => {
+        const requestId = c.get('requestId');
+        const found = await releases.promotions.get(c.get('tenantId'), c.req.param('promotionId'));
+        if (found === null || found.agentId !== c.req.param('agentId')) {
+            c.status(statusFor('promotion-not-found'));
+            return c.json(toWireError({ code: 'promotion-not-found', message: 'No such promotion for this agent' }, requestId));
+        }
+        return c.json(serializePromotion(found));
+    });
+    r.post('/:agentId/live/rollback', async (c) => {
+        const requestId = c.get('requestId');
+        const body = await readBody(c);
+        if (body === undefined)
+            return badJson(c, requestId);
+        const scope = parseLiveScopeBody(body.scope);
+        if (scope.kind === 'err')
+            return badInput(c, requestId, scope.message);
+        if (body.toVersion !== undefined &&
+            (typeof body.toVersion !== 'string' || body.toVersion === '')) {
+            return badInput(c, requestId, '`toVersion` must be a version when supplied');
+        }
+        const text = optionalText(body, ['reason']);
+        if (text.kind === 'err')
+            return badInput(c, requestId, text.message);
+        const outcome = await releases.promotions.rollback({
+            tenantId: c.get('tenantId'),
+            agentId: c.req.param('agentId'),
+            scope: scope.scope,
+            requestedBy: actorOf(c),
+            ...(typeof body.toVersion === 'string' && { toVersion: body.toVersion }),
+            ...text.value,
+        });
+        if (outcome.kind === 'err')
+            return failed(c, requestId, outcome.error);
+        return c.json(serializePromotion(outcome.value));
+    });
+    r.post('/:agentId/live/unpin', async (c) => {
+        const requestId = c.get('requestId');
+        const body = await readBody(c);
+        if (body === undefined)
+            return badJson(c, requestId);
+        const scope = parseLiveScopeBody(body.scope);
+        if (scope.kind === 'err')
+            return badInput(c, requestId, scope.message);
+        const text = optionalText(body, ['reason']);
+        if (text.kind === 'err')
+            return badInput(c, requestId, text.message);
+        const outcome = await releases.promotions.unpin({
+            tenantId: c.get('tenantId'),
+            agentId: c.req.param('agentId'),
+            scope: scope.scope,
+            requestedBy: actorOf(c),
+            ...text.value,
+        });
+        if (outcome.kind === 'err')
+            return failed(c, requestId, outcome.error);
+        return c.json(serializePromotion(outcome.value));
+    });
+}
+async function readBody(c) {
+    try {
+        const body = await c.req.json();
+        return body !== null && typeof body === 'object' && !Array.isArray(body)
+            ? body
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function badJson(c, requestId) {
+    return badInput(c, requestId, 'Request body must be a JSON object');
+}
+function badInput(c, requestId, message) {
+    c.status(statusFor('bad-input'));
+    return c.json(toWireError({ code: 'bad-input', message }, requestId));
+}
+function failed(c, requestId, error) {
+    c.status(statusFor(error.code));
+    return c.json(toWireError(error, requestId));
+}
+/** Optional short strings (`reason`, `evalRunId`): absent, or a non-empty string. */
+function optionalText(body, fields) {
+    const value = {};
+    for (const field of fields) {
+        const v = body[field];
+        if (v === undefined)
+            continue;
+        if (typeof v !== 'string' || v.trim() === '' || v.length > 2000) {
+            return { kind: 'err', message: `\`${field}\` must be a non-empty string when supplied` };
+        }
+        value[field] = v;
+    }
+    return { kind: 'ok', value };
+}
+/** The promotion body: `{version, scope, evalRunId?, reason?}`. */
+async function readPromotionBody(c) {
+    const body = await readBody(c);
+    if (body === undefined)
+        return { kind: 'err', message: 'Request body must be a JSON object' };
+    const scope = parseLiveScopeBody(body.scope);
+    if (scope.kind === 'err')
+        return scope;
+    if (typeof body.version !== 'string' || body.version.length === 0) {
+        return { kind: 'err', message: '`version` is required: the agent version to make live' };
+    }
+    const text = optionalText(body, ['reason', 'evalRunId']);
+    if (text.kind === 'err')
+        return text;
+    return {
+        kind: 'ok',
+        value: { version: body.version, scope: scope.scope, ...text.value },
+    };
+}
+/** The gate policy for a promotion of `agentId` for `scope`; `null` when none applies. */
+async function policyFor(releases, tenantId, agentId, scope) {
+    return releases.gatePolicies === undefined
+        ? null
+        : releases.gatePolicies.resolve({ tenantId, agentId, scope });
+}
+/** The scope's coordinates, as a run in it would resolve its version. */
+function coordinatesOf(scope) {
+    switch (scope.kind) {
+        case 'tenant':
+            return {};
+        case 'org':
+            return { orgId: scope.orgId };
+        case 'project':
+            return { projectId: scope.projectId };
+        case 'segment':
+            return { projectId: scope.projectId, segments: scope.path };
+    }
+}
+/** A finished comparison's summary, or `null` for any other eval run. */
+function summaryOf(run) {
+    const summary = run.result?.summary;
+    return run.kind === 'judged' && summary !== null && typeof summary === 'object'
+        ? summary
+        : null;
+}
+/**
+ * The gate for a promotion request: what serves the scope now, the
+ * comparison it names, and the policy's checks against them. With no
+ * policy there's nothing to check.
+ */
+async function runGate(registry, releases, deps, req, policy) {
+    const { tenantId, agentId } = req;
+    const err = (code, message) => ({
+        kind: 'err',
+        error: { code, message },
+    });
+    const promoted = await registry.getVersion({
+        tenantId,
+        agentId: agentId,
+        version: req.version,
+    });
+    if (promoted === null || promoted.unregisteredAt !== undefined) {
+        return err('agent-version-not-found', `${agentId} has no active version ${req.version}`);
+    }
+    const live = await releases.live.resolve({ tenantId, agentId, ...coordinatesOf(req.scope) });
+    let servingVersion = live?.version;
+    if (servingVersion === undefined) {
+        const latest = await registry.get({ tenantId, agentId: agentId });
+        if (latest === null)
+            return err('agent-not-found', `No agent "${agentId}" is registered`);
+        servingVersion = latest.version;
+    }
+    if (policy === null)
+        return { kind: 'ok', result: { checks: [], passed: true }, servingVersion };
+    let summary = null;
+    if (req.evalRunId !== undefined) {
+        const run = deps.evalRuns === undefined
+            ? null
+            : await deps.evalRuns.get({ tenantId, runId: req.evalRunId });
+        if (run === null)
+            return err('eval-run-not-found', `No eval run ${req.evalRunId}`);
+        summary = summaryOf(run);
+        if (summary === null) {
+            return err('bad-input', `Eval run ${req.evalRunId} isn't a finished comparison: it has no comparison summary`);
+        }
+    }
+    let summaryProjectOrgId;
+    const judgedIn = summary?.scope.projectId;
+    if (req.scope.kind === 'org' && judgedIn !== undefined && deps.projects !== undefined) {
+        const project = await deps.projects.get(tenantId, judgedIn);
+        summaryProjectOrgId = project?.orgId;
+    }
+    const result = evaluateGate({
+        spec: policy.spec,
+        promotion: {
+            agentId,
+            version: req.version,
+            pinsDigest: promoted.pinsDigest ?? null,
+            scope: req.scope,
+        },
+        summary,
+        servingVersion,
+        ...(summaryProjectOrgId !== undefined && { summaryProjectOrgId }),
+        now: new Date(),
+    });
+    return { kind: 'ok', result, servingVersion };
+}
+/** Who asked, from the request's principal. */
+function actorOf(c) {
+    const actor = c.get('principal')?.actor;
+    if (actor === undefined)
+        return { kind: 'service', id: 'unknown' };
+    return { kind: actor.kind === 'user' ? 'user' : 'service', id: actor.id };
+}
+/** `?scopeKind=tenant|org|project|segment&scopeId=…&segment=key:value` for the history filter. */
+export function scopeFromQuery(query, segmentValues) {
+    const kind = query('scopeKind');
+    const id = query('scopeId');
+    if (kind === undefined || kind === '') {
+        return id === undefined
+            ? { kind: 'ok' }
+            : { kind: 'err', message: '`scopeId` needs `scopeKind`' };
+    }
+    if (kind === 'tenant')
+        return { kind: 'ok', scope: { kind: 'tenant' } };
+    if (id === undefined || !UUID_RE.test(id)) {
+        return { kind: 'err', message: '`scopeId` must be an org or project id (a UUID)' };
+    }
+    if (kind === 'org')
+        return { kind: 'ok', scope: { kind: 'org', orgId: id } };
+    if (kind === 'project')
+        return { kind: 'ok', scope: { kind: 'project', projectId: id } };
+    if (kind === 'segment') {
+        const path = parseSegmentsQuery(segmentValues);
+        if (path.kind === 'err')
+            return path;
+        if (path.segments === undefined)
+            return { kind: 'err', message: 'A segment scope needs `segment`' };
+        return {
+            kind: 'ok',
+            scope: { kind: 'segment', projectId: id, path: path.segments },
+        };
+    }
+    return { kind: 'err', message: '`scopeKind` must be one of tenant, org, project, segment' };
+}
+export function serializePromotion(p) {
+    return {
+        id: p.id,
+        agentId: p.agentId,
+        scope: liveScopeToWire(p.scope),
+        action: p.action,
+        fromVersion: p.fromVersion,
+        toVersion: p.toVersion,
+        requestedBy: p.requestedBy,
+        ...(p.reason !== undefined && { reason: p.reason }),
+        ...(p.evalRunId !== undefined && { evalRunId: p.evalRunId }),
+        createdAt: p.createdAt,
+        ...(p.status !== undefined && { status: p.status }),
+        ...(p.policy !== undefined && { policy: p.policy }),
+        ...(p.checks !== undefined && { checks: p.checks }),
+        ...(p.approvalId !== undefined && { approvalId: p.approvalId }),
+        ...(p.resolvedAt !== undefined && { resolvedAt: p.resolvedAt }),
+    };
+}
+//# sourceMappingURL=agent-releases.js.map