@kici-dev/orchestrator 0.0.0 → 0.1.1

package/dist/db/types.d.ts

@@ -0,0 +1,1266 @@
+import type { ColumnType, Generated, Insertable, Selectable, Updateable } from 'kysely';
+/**
+ * PostgreSQL-only database types.
+ * Column names use snake_case matching the actual database column names.
+ */
+export interface Database {
+    dispatch_queue: DispatchQueueTable;
+    dedup_cache: DedupCacheTable;
+    ip_allocations: IpAllocationTable;
+    execution_runs: ExecutionRunTable;
+    execution_jobs: ExecutionJobTable;
+    execution_steps: ExecutionStepTable;
+    raft_state: RaftStateTable;
+    secret_audit_log: SecretAuditLogTable;
+    environments: EnvironmentsTable;
+    scoped_secrets: ScopedSecretsTable;
+    environment_bindings: EnvironmentBindingsTable;
+    environment_variables: EnvironmentVariablesTable;
+    environment_source_overrides: EnvironmentSourceOverridesTable;
+    held_runs: HeldRunsTable;
+    admin_tokens: AdminTokenTable;
+    agent_tokens: AgentTokenTable;
+    config_versions: ConfigVersionTable;
+    kici_events: KiciEventTable;
+    generic_webhook_sources: GenericWebhookSourceTable;
+    cross_repo_trust: CrossRepoTrustTable;
+    test_uploads: TestUploadsTable;
+    workflow_registrations: WorkflowRegistrationsTable;
+    registry_versions: RegistryVersionsTable;
+    cron_last_fired: CronLastFiredTable;
+    run_ephemeral_keys: RunEphemeralKeysTable;
+    run_secret_outputs: RunSecretOutputsTable;
+    concurrency_groups: ConcurrencyGroupsTable;
+    sources: SourcesTable;
+    cluster_meta: ClusterMetaTable;
+    join_tokens: JoinTokenTable;
+    org_settings: OrgSettingsTable;
+    execution_job_needs: ExecutionJobNeedsTable;
+    pending_job_contexts: PendingJobContextsTable;
+    event_log: EventLogTable;
+    access_log: AccessLogTable;
+    cold_store_chunk_counts: ColdStoreChunkCountsTable;
+    cold_store_chunks: ColdStoreChunksTable;
+}
+/**
+ * Cluster metadata table
+ * Key-value store for cluster-wide configuration (e.g. cluster_id).
+ */
+export interface ClusterMetaTable {
+    /** Key identifier (primary key) */
+    key: string;
+    /** Value */
+    value: string;
+    /** When this entry was created */
+    created_at: Generated<Date>;
+}
+export type ClusterMeta = Selectable<ClusterMetaTable>;
+export type NewClusterMeta = Insertable<ClusterMetaTable>;
+/**
+ * Join tokens table
+ * Stores hashed join tokens for zero-knowledge cluster bootstrap.
+ * Tokens are one-time use (consumed_at set after validation).
+ */
+export interface JoinTokenTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** SHA-256 hash of the token secret (for lookup) */
+    token_hash: string;
+    /** Routing info embedded in the token (orgId, routingKey, expiry) */
+    routing_info: string;
+    /** Who created this token */
+    created_by: string;
+    /** When this token was created */
+    created_at: Generated<Date>;
+    /** When this token expires */
+    expires_at: Date;
+    /** When this token was consumed (null = unused) */
+    consumed_at: Date | null;
+    /** Who consumed this token (null = unused) */
+    consumed_by: string | null;
+}
+export type JoinToken = Selectable<JoinTokenTable>;
+export type NewJoinToken = Insertable<JoinTokenTable>;
+/**
+ * Dispatch queue table
+ * Holds jobs waiting to be dispatched to agents.
+ */
+export interface DispatchQueueTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** Unique run identifier for this execution */
+    run_id: string;
+    /** Workflow name from lock file */
+    workflow_name: string;
+    /** Job name within the workflow */
+    job_name: string;
+    /** JSONB array of runs-on labels for agent matching.
+     *  Insert: JSON.stringify(labels), Select: auto-parsed by pg driver. */
+    runs_on_labels: string;
+    /** JSON-encoded Record of the full job configuration */
+    job_config: string;
+    /** Repository clone URL */
+    repo_url: string;
+    /** Git ref (branch/tag) */
+    ref: string;
+    /** Git commit SHA */
+    sha: string;
+    /** Job status: pending | dispatched | expired | failed */
+    status: Generated<string>;
+    /** When this job was queued */
+    created_at: Generated<Date>;
+    /** When this job expires (null = wait indefinitely) */
+    expires_at: Date | null;
+    /** Webhook delivery ID for tracing */
+    delivery_id: string;
+    /** Provider type (e.g., "github", "gitlab") */
+    provider: Generated<string>;
+    /** JSON-encoded provider-specific context (e.g., {"installationId": 42}) */
+    provider_context: Generated<string>;
+    /** Pre-packed `.kici/` source tarball URL (from cache). Nullable. */
+    source_tar_url: string | null;
+    /** SHA-256 hash of the source tarball bytes for integrity verification. Nullable. */
+    source_tar_hash: string | null;
+    /** Pre-built dependency tarball URL (from dep cache). Nullable. */
+    deps_url: string | null;
+    /** SHA-256 hash of the dependency tarball. Nullable. */
+    deps_hash: string | null;
+    /** Request trace ID for cross-tier correlation. Nullable for background ops. */
+    request_id: string | null;
+    /** JSONB array of exclusion labels. Default '[]'. */
+    exclude_labels: Generated<string>;
+    /** Routing key (e.g. "github:12345") so dispatch can pick the right
+     *  per-app provider bundle in multi-app setups. Required (NOT NULL). */
+    routing_key: string;
+}
+/**
+ * Deduplication cache table
+ * Tracks recently processed webhook delivery IDs to prevent reprocessing.
+ */
+export interface DedupCacheTable {
+    /** Webhook delivery ID (primary key) */
+    delivery_id: string;
+    /** When this delivery was first received */
+    received_at: Generated<Date>;
+    /** When this cache entry expires (24h TTL) */
+    expires_at: Date;
+}
+export type DispatchQueueItem = Selectable<DispatchQueueTable>;
+export type NewDispatchQueueItem = Insertable<DispatchQueueTable>;
+export type DispatchQueueItemUpdate = Updateable<DispatchQueueTable>;
+/**
+ * IP allocation table for Firecracker VM networking.
+ * Tracks assigned IPs from the CIDR pool. DB-backed to survive restarts.
+ */
+export interface IpAllocationTable {
+    /** Allocated IP address (primary key), e.g. "10.0.0.5" */
+    ip: string;
+    /** Firecracker VM ID (= agentId) */
+    vm_id: string;
+    /** Which scaler backend owns this allocation */
+    scaler_name: string;
+    /** TAP device name on the host */
+    tap_device: string;
+    /** Guest MAC address */
+    mac_address: string;
+    /** When this IP was allocated */
+    allocated_at: Generated<Date>;
+}
+/**
+ * Execution run table
+ * Top-level workflow runs (one per webhook trigger).
+ * Stores status, timing, and trigger decision metadata.
+ */
+export interface ExecutionRunTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** Unique run identifier matching runId in protocol messages */
+    run_id: string;
+    /** Routing key (e.g. github:appId) for Platform StaleOrchDetector when sharing DB */
+    routing_key: string | null;
+    /** Workflow name from lock file */
+    workflow_name: string;
+    /** Run status: running | success | failed | cancelled */
+    status: Generated<string>;
+    /** Provider type (e.g. "github", "gitlab") */
+    provider: string;
+    /** Repository identifier (e.g. "owner/repo") */
+    repo_identifier: string;
+    /** Git ref (branch/tag) */
+    ref: string;
+    /** Git commit SHA */
+    sha: string;
+    /** Webhook delivery ID for tracing */
+    delivery_id: string | null;
+    /** Serialized WorkflowDecision (trigger decision trace) */
+    trigger_decision: string | null;
+    /** When the run started */
+    started_at: Generated<Date>;
+    /** When the run completed */
+    completed_at: Date | null;
+    /** Total execution duration in milliseconds */
+    duration_ms: number | null;
+    /**
+     * Total raw log bytes accumulated across all jobs of this run. Sum of the
+     * agent-side `LogStreamer.getTotalBytes()` reported on terminal
+     * `step.status` for every step in every job. Default 0 for pre-migration
+     * rows. Powers the operator-side `kici_org_log_bytes` capacity-planning
+     * gauge on the Platform. Postgres BIGINT — pg returns string; cast at
+     * read sites.
+     */
+    log_bytes: Generated<number>;
+    /** Provider-specific context (e.g. {"installationId": 42}) */
+    provider_context: Generated<string>;
+    /** Whether this is a CLI-initiated test run */
+    is_test_run: Generated<boolean>;
+    /** Fixture ID for test runs (null for real webhook runs) */
+    fixture_id: string | null;
+    /** Parent run ID for re-run lineage (null for original runs). */
+    parent_run_id: string | null;
+    /** Root ancestor run ID for re-run lineage (null for original runs). Always points to the first run in the chain. */
+    original_run_id: string | null;
+    /** User identity that triggered this re-run (null for webhook-triggered). Format: "user:email" or "key:name". */
+    triggered_by: string | null;
+    /** User identity that cancelled this run (null for non-cancelled). */
+    cancelled_by: string | null;
+    /** Environment name for this run (null if no environment applies) */
+    environment: string | null;
+    /** Trust tier of the contributor for PR runs (null for non-PR events) */
+    trust_tier: string | null;
+    /** Lock file source: 'head' or 'base' (null for non-PR events) */
+    lock_file_source: string | null;
+    /** Username of the contributor (null for non-PR events) */
+    contributor_username: string | null;
+    /** Human-readable reason why the run failed (null for non-failed runs). */
+    failure_reason: string | null;
+    /** When this record was created */
+    created_at: Generated<Date>;
+    /**
+     * Set inside the cold-store archive transaction before the row is
+     * DELETEd. Survivors carry NULL. Exists so a future
+     * "promote-chunk-back-into-PG" path (Phase F) can restore rows with
+     * their original archive pointer.
+     */
+    archived_at: Date | null;
+    /** S3 object key of the chunk that carried this row; see `archived_at`. */
+    archive_object_key: string | null;
+}
+/**
+ * Execution job table
+ * Individual jobs within a run (including matrix expansions).
+ */
+export interface ExecutionJobTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** References execution_runs.run_id */
+    run_id: string;
+    /** Job identifier from dispatch */
+    job_id: string;
+    /** Job name (e.g. "test", "test[node-18]") */
+    job_name: string;
+    /** Job status: pending | running | success | failed | cancelled | skipped */
+    status: Generated<string>;
+    /** Matrix values JSON (e.g. {"node": "18"}) */
+    matrix_values: string | null;
+    /** Agent ID that ran this job */
+    agent_id: string | null;
+    /** When the job started */
+    started_at: Date | null;
+    /** When the job completed */
+    completed_at: Date | null;
+    /** Job execution duration in milliseconds */
+    duration_ms: number | null;
+    /**
+     * Total raw log bytes accumulated across all steps of this job. Sum of the
+     * agent-side `LogStreamer.getTotalBytes()` reported on terminal
+     * `step.status` for every step. Default 0 for pre-migration rows.
+     * Postgres BIGINT — pg returns string; cast at read sites.
+     */
+    log_bytes: Generated<number>;
+    /** Error info if failed */
+    error_message: string | null;
+    /** Labels used for agent routing (e.g. ["kici:os:linux", "kici:arch:x64"]). JSONB. */
+    runs_on_labels: string | null;
+    /** Last heartbeat received from agent (for stale run detection) */
+    last_heartbeat_at: Date | null;
+    /** JSON array of secret context names dispatched with this job */
+    dispatched_contexts: Generated<string>;
+    /** Aggregated step outputs JSONB (step-keyed map of outputs). Populated on job success. */
+    outputs: string | null;
+    /** Whether all upstream needs edges are satisfied (dispatch gate). */
+    needs_satisfied: Generated<boolean>;
+    /** Timestamp when needs_satisfied first flipped to true. */
+    ready_at: Date | null;
+    /** Dynamic group membership tag (NULL for static jobs). */
+    group_name: string | null;
+    /** When this record was created */
+    created_at: Generated<Date>;
+    /**
+     * Denormalized routing_key copied from execution_runs at insert time.
+     * Used by cold-store as the partition tenant. NULLable for safety —
+     * if an insert site doesn't populate it, the cold-store adapter
+     * skips the row.
+     */
+    routing_key: string | null;
+    /** Cold-store archive marker — see ExecutionRunTable.archived_at. */
+    archived_at: Date | null;
+    /** S3 object key of the chunk that carried this row. */
+    archive_object_key: string | null;
+}
+/**
+ * Execution step table
+ * Individual steps within a job.
+ */
+export interface ExecutionStepTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** References execution_runs.run_id */
+    run_id: string;
+    /** Job identifier */
+    job_id: string;
+    /** Step index within the job (0-based) */
+    step_index: number;
+    /** Step name */
+    step_name: string;
+    /** Step status: pending | running | success | failed | skipped */
+    status: Generated<string>;
+    /** When the step started */
+    started_at: Date | null;
+    /** When the step completed */
+    completed_at: Date | null;
+    /** Step execution duration in milliseconds */
+    duration_ms: number | null;
+    /** Process exit code */
+    exit_code: number | null;
+    /** Error info if failed */
+    error_message: string | null;
+    /** Path in storage backend (e.g. "executions/{runId}/job-test/step-0.log") */
+    log_path: string | null;
+    /** Step type: 'step' for regular steps, 'hook:onCancel', 'hook:cleanup', etc. for hooks */
+    step_type: Generated<string>;
+    /** JSON array of secret context names accessed by this step. NULL = tracking not available (old runs). */
+    secrets_accessed: string | null;
+    /** When this record was created */
+    created_at: Generated<Date>;
+    /**
+     * Denormalized routing_key copied from execution_runs at insert time.
+     * Used by cold-store as the partition tenant. NULLable for safety.
+     */
+    routing_key: string | null;
+    /** Cold-store archive marker — see ExecutionRunTable.archived_at. */
+    archived_at: Date | null;
+    /** S3 object key of the chunk that carried this row. */
+    archive_object_key: string | null;
+}
+export type ExecutionRun = Selectable<ExecutionRunTable>;
+export type NewExecutionRun = Insertable<ExecutionRunTable>;
+export type ExecutionRunUpdate = Updateable<ExecutionRunTable>;
+export type ExecutionJob = Selectable<ExecutionJobTable>;
+export type NewExecutionJob = Insertable<ExecutionJobTable>;
+export type ExecutionJobUpdate = Updateable<ExecutionJobTable>;
+export type ExecutionStep = Selectable<ExecutionStepTable>;
+export type NewExecutionStep = Insertable<ExecutionStepTable>;
+export type ExecutionStepUpdate = Updateable<ExecutionStepTable>;
+/**
+ * Execution job needs edge table.
+ * One row per concrete dependency edge within a run.
+ * Static-to-static edges inserted at run start; group edges after resolution.
+ */
+export interface ExecutionJobNeedsTable {
+    /** References execution_runs.run_id */
+    run_id: string;
+    /** Downstream job name (the job that depends on the upstream) */
+    job_name: string;
+    /** Upstream job name (the job that must complete first) */
+    upstream_name: string;
+    /** Per-edge failure policy: 'skip' (default) or 'run' */
+    if_failed: Generated<string>;
+}
+export type ExecutionJobNeeds = Selectable<ExecutionJobNeedsTable>;
+export type NewExecutionJobNeeds = Insertable<ExecutionJobNeedsTable>;
+/**
+ * Raft consensus state table
+ * Persistent state for Raft leader election across orchestrator cluster.
+ * Single row per cluster (default cluster_id = 'default').
+ */
+export interface RaftStateTable {
+    /** Cluster identifier (primary key). Default 'default'. */
+    cluster_id: Generated<string>;
+    /** Current Raft term */
+    current_term: Generated<number>;
+    /** Instance ID this node voted for in the current term */
+    voted_for: string | null;
+    /** Current known leader instance ID */
+    leader_id: string | null;
+    /** When this state was last updated */
+    updated_at: Generated<Date>;
+}
+export type RaftState = Selectable<RaftStateTable>;
+export type RaftStateUpdate = Updateable<RaftStateTable>;
+/**
+ * Environments table
+ * Named deployment environments with concurrency, branch restrictions, and approval rules.
+ * Scoped to an organization.
+ */
+export interface EnvironmentsTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** Organization ID */
+    org_id: string;
+    /** Environment name (unique within org) */
+    name: string;
+    /** Environment type: 'fixed' | 'dynamic' */
+    type: Generated<string>;
+    /** Glob pattern for dynamic environments (null for fixed) */
+    glob_pattern: string | null;
+    /** JSONB array of branch restriction patterns */
+    branch_restrictions: Generated<string>;
+    /** JSONB array of trigger type filters */
+    trigger_type_filters: Generated<string>;
+    /** JSONB array of repo patterns */
+    repo_patterns: Generated<string>;
+    /** Max concurrent runs (null = unlimited) */
+    concurrency_limit: number | null;
+    /** Strategy when concurrency exceeded: 'queue' | 'cancel-pending' */
+    concurrency_strategy: Generated<string>;
+    /** Timeout for queued runs in milliseconds */
+    concurrency_timeout_ms: Generated<number>;
+    /** JSONB array of required reviewer identities (null = no approval required) */
+    required_reviewers: string | null;
+    /** Seconds to wait before deploying (null = no wait timer) */
+    wait_timer_seconds: number | null;
+    /** Seconds before a held run expires */
+    hold_expiry_seconds: Generated<number>;
+    /** Minimum trust tier required for CI execution (null = no trust requirement) */
+    minimum_trust: string | null;
+    /** Whether this environment allows local (no-remote) executions. Default false. */
+    allow_local_execution: Generated<boolean>;
+    /** Whether this environment is active */
+    enabled: Generated<boolean>;
+    /** When this environment was created */
+    created_at: Generated<Date>;
+    /** When this environment was last updated */
+    updated_at: Generated<Date>;
+    /** Who created this environment */
+    created_by: string | null;
+}
+export type Environment = Selectable<EnvironmentsTable>;
+export type NewEnvironment = Insertable<EnvironmentsTable>;
+export type EnvironmentUpdate = Updateable<EnvironmentsTable>;
+/**
+ * Scoped secrets table
+ * Encrypted key-value pairs scoped to org + scope (e.g. environment name, repo pattern).
+ */
+export interface ScopedSecretsTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** Organization ID */
+    org_id: string;
+    /** Scope identifier (e.g. environment name, repo pattern) */
+    scope: string;
+    /** Secret key name */
+    key: string;
+    /** Encrypted secret value */
+    encrypted_value: string;
+    /** Backend type for secret storage (e.g. 'pg', 'vault') */
+    backend_type: Generated<string>;
+    /** Version of the encryption key used */
+    key_version: Generated<number>;
+    /** When this secret was created */
+    created_at: Generated<Date>;
+    /** When this secret was last updated */
+    updated_at: Generated<Date>;
+}
+export type ScopedSecret = Selectable<ScopedSecretsTable>;
+export type NewScopedSecret = Insertable<ScopedSecretsTable>;
+export type ScopedSecretUpdate = Updateable<ScopedSecretsTable>;
+/**
+ * Environment bindings table
+ * Links environments to scope patterns (e.g. workflow names, repo identifiers).
+ */
+export interface EnvironmentBindingsTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** Organization ID */
+    org_id: string;
+    /** Environment ID (FK to environments.id, cascade delete) */
+    environment_id: string;
+    /** Scope pattern for matching (e.g. workflow name glob, repo pattern) */
+    scope_pattern: string;
+    /** When this binding was created */
+    created_at: Generated<Date>;
+}
+export type EnvironmentBinding = Selectable<EnvironmentBindingsTable>;
+export type NewEnvironmentBinding = Insertable<EnvironmentBindingsTable>;
+/**
+ * Environment variables table
+ * Non-secret key-value pairs attached to an environment.
+ */
+export interface EnvironmentVariablesTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** Organization ID */
+    org_id: string;
+    /** Environment ID (FK to environments.id, cascade delete) */
+    environment_id: string;
+    /** Variable key name */
+    key: string;
+    /** Variable value */
+    value: string;
+    /** Whether this variable is locked (cannot be overridden by workflow) */
+    locked: Generated<boolean>;
+    /** When this variable was created */
+    created_at: Generated<Date>;
+    /** When this variable was last updated */
+    updated_at: Generated<Date>;
+}
+export type EnvironmentVariable = Selectable<EnvironmentVariablesTable>;
+export type NewEnvironmentVariable = Insertable<EnvironmentVariablesTable>;
+export type EnvironmentVariableUpdate = Updateable<EnvironmentVariablesTable>;
+/**
+ * Environment source overrides table
+ * Per-source (routing key) variable overrides within an environment.
+ */
+export interface EnvironmentSourceOverridesTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** Organization ID */
+    org_id: string;
+    /** Environment ID (FK to environments.id, cascade delete) */
+    environment_id: string;
+    /** Routing key for the source */
+    routing_key: string;
+    /** Override key name */
+    key: string;
+    /** Override value */
+    value: string;
+    /** When this override was created */
+    created_at: Generated<Date>;
+    /** When this override was last updated */
+    updated_at: Generated<Date>;
+}
+export type EnvironmentSourceOverride = Selectable<EnvironmentSourceOverridesTable>;
+export type NewEnvironmentSourceOverride = Insertable<EnvironmentSourceOverridesTable>;
+export type EnvironmentSourceOverrideUpdate = Updateable<EnvironmentSourceOverridesTable>;
+/**
+ * Held runs table
+ * Tracks runs waiting for approval, wait timer, or concurrency slot.
+ */
+export interface HeldRunsTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** Organization ID */
+    org_id: string;
+    /** Run ID (references execution_runs) */
+    run_id: string;
+    /** Job ID within the run */
+    job_id: string;
+    /** Environment ID (FK to environments.id) */
+    environment_id: string;
+    /** Hold type: 'approval' | 'wait_timer' | 'concurrency' */
+    hold_type: string;
+    /** Hold status: 'pending' | 'approved' | 'rejected' | 'expired' | 'released' */
+    status: Generated<string>;
+    /** Queue type: 'environment' | 'security' */
+    queue_type: Generated<string>;
+    /** Reason for hold or resolution */
+    reason: string | null;
+    /** Who approved/rejected this hold */
+    approved_by: string | null;
+    /** When this hold was created */
+    created_at: Generated<Date>;
+    /** When this hold expires */
+    expires_at: Date;
+    /** When this hold was resolved */
+    resolved_at: Date | null;
+}
+export type HeldRun = Selectable<HeldRunsTable>;
+export type NewHeldRun = Insertable<HeldRunsTable>;
+export type HeldRunUpdate = Updateable<HeldRunsTable>;
+/**
+ * Secret audit log table
+ * Immutable log of secret access and denial events.
+ */
+export interface SecretAuditLogTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** When the event occurred */
+    timestamp: Generated<Date>;
+    /** The action performed (e.g., 'getSecrets', 'setSecret') */
+    action: string;
+    /** The context name involved */
+    context_name: string;
+    /** Routing key scope */
+    routing_key: string | null;
+    /** Secret keys involved (JSON array) */
+    secret_keys: string | null;
+    /** Whether the operation was allowed or denied */
+    outcome: string;
+    /** CI run ID if applicable */
+    run_id: string | null;
+    /** Job ID if applicable */
+    job_id: string | null;
+    /** User ID if applicable */
+    user_id: string | null;
+    /** User role if applicable */
+    role: string | null;
+    /** Additional metadata (JSON) */
+    metadata: string | null;
+    /**
+     * Set inside the archive transaction before the row is DELETEd.
+     * Survivors carry NULL. See cold-storage Phase D notes.
+     */
+    archived_at: Date | null;
+    /** S3 object key of the chunk that carried this row; see `archived_at`. */
+    archive_object_key: string | null;
+}
+export type SecretAuditLogRow = Selectable<SecretAuditLogTable>;
+export type NewSecretAuditLogRow = Insertable<SecretAuditLogTable>;
+/**
+ * Access log table.
+ * One row per read or orchestrator-admin mutation attributable to an
+ * ActorPrincipal (user / api_key / service_account / platform_operator /
+ * system). TTL-pruned via expires_at by the cleanup job.
+ */
+export interface AccessLogTable {
+    id: Generated<string>;
+    org_id: string | null;
+    routing_key: string | null;
+    actor_type: string;
+    actor_id: string;
+    actor_meta: ColumnType<Record<string, unknown> | null, unknown, unknown>;
+    action: string;
+    target_type: string | null;
+    target_id: string | null;
+    request_id: string | null;
+    source: string;
+    outcome: string;
+    error_message: string | null;
+    created_at: Generated<Date>;
+    /**
+     * Set inside the archive transaction before the row is DELETEd.
+     * Survivors carry NULL. See cold-storage Phase D notes.
+     * Phase D removed the previous `expires_at`-based TTL — rows older
+     * than 30 days are archived to S3 instead of hard-deleted.
+     */
+    archived_at: Date | null;
+    /** S3 object key of the chunk that carried this row; see `archived_at`. */
+    archive_object_key: string | null;
+}
+export type AccessLogRow = Selectable<AccessLogTable>;
+export type NewAccessLogRow = Insertable<AccessLogTable>;
+/**
+ * Admin tokens table
+ * Hashed tokens for admin API authentication with role-based access.
+ */
+export interface AdminTokenTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** SHA-256 hash of the token */
+    token_hash: string;
+    /** Human-readable label */
+    label: string;
+    /** Role (e.g. 'admin', 'reader') */
+    role: string;
+    /** Routing key scope (null = all) */
+    routing_key: string | null;
+    /** When this token was created */
+    created_at: Generated<Date>;
+    /** When this token expires (null = never) */
+    expires_at: Date | null;
+    /** When this token was last used */
+    last_used_at: Date | null;
+    /** Whether this token has been revoked */
+    revoked: Generated<boolean>;
+}
+export type AdminTokenRow = Selectable<AdminTokenTable>;
+export type NewAdminTokenRow = Insertable<AdminTokenTable>;
+/**
+ * Agent tokens table
+ * Hashed tokens for agent authentication (PSK-based).
+ * Supports static (long-lived, CLI-created) and ephemeral (scaler-issued, TTL-bound) tokens.
+ */
+export interface AgentTokenTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** SHA-256 hash of the token */
+    token_hash: string;
+    /** Token prefix for identification (e.g. "kat_a1b2c3d4") */
+    token_prefix: string;
+    /** JSON-encoded string[] of agent labels (null = any) */
+    labels: string | null;
+    /** Token type: 'ephemeral' (scaler-issued) or 'static' (CLI-created) */
+    agent_type: string;
+    /** When this token was created */
+    created_at: Generated<Date>;
+    /** When this token was last used for authentication */
+    last_seen_at: Date | null;
+    /** Who/what created this token (e.g. "cli:admin", "scaler:container-linux-x64") */
+    created_by: string | null;
+    /** When this token was revoked (null = active) */
+    revoked_at: Date | null;
+    /** When this token expires (null = never, static tokens) */
+    expires_at: Date | null;
+}
+export type AgentTokenRow = Selectable<AgentTokenTable>;
+export type NewAgentTokenRow = Insertable<AgentTokenTable>;
+/**
+ * Config versions table
+ * Stores versioned JSONB config snapshots with audit trail.
+ * Each config change creates a new version with auto-incrementing version number.
+ * Sensitive fields are encrypted and tracked via encrypted_paths array.
+ */
+export interface ConfigVersionTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** Auto-incrementing version number (SERIAL) */
+    version: Generated<number>;
+    /** Full config snapshot as JSONB */
+    config: string;
+    /** When this version was created */
+    created_at: Generated<Date>;
+    /** Who created this version (e.g. "cli:seed", "api:set", "api:rollback") */
+    created_by: string;
+    /** Human-readable description of the change */
+    description: string | null;
+    /** JSONB paths that contain encrypted values */
+    encrypted_paths: Generated<string[]>;
+    /**
+     * Master-key generation used to encrypt this row's sensitive fields.
+     * Bumped atomically by `kici-admin rotate-key`; decrypt path accepts
+     * both the current and the previous generation during a grace window.
+     */
+    key_version: Generated<number>;
+}
+export type ConfigVersionRow = Selectable<ConfigVersionTable>;
+export type NewConfigVersionRow = Insertable<ConfigVersionTable>;
+/**
+ * Internal events table (kici_events)
+ * Persists internal events (system + custom) for routing, circuit-breaking, and audit.
+ * Events have a TTL-based expiry for automatic cleanup.
+ */
+export interface KiciEventTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** Event name (e.g. 'deploy-complete', '__workflow_complete', '__job_complete') */
+    event_name: string;
+    /** Event payload (JSONB) */
+    payload: string;
+    /** Source repo identifier (null for non-repo events) */
+    source_repo: string | null;
+    /** Source routing key */
+    source_routing_key: string | null;
+    /** Run ID that emitted this event */
+    source_run_id: string | null;
+    /** Job ID that emitted this event */
+    source_job_id: string | null;
+    /** Event chain depth for circuit breaker (0 = original, incremented at each hop) */
+    chain_depth: Generated<number>;
+    /** Whether all subscribers have processed this event */
+    processed: Generated<boolean>;
+    /** When this event was created */
+    created_at: Generated<Date>;
+    /** When this event expires (TTL-based cleanup) */
+    expires_at: Date;
+    /** Optional target repos for cross-repo event targeting (JSONB string[] or null) */
+    target_repos: string | null;
+    /** When the current lease was taken (NULL = unleased / available for claim) */
+    claimed_at: Date | null;
+    /** Node id holding the current lease (for diagnostics; not part of the lease check) */
+    claimed_by: string | null;
+    /** Number of times this event has been leased for processing */
+    attempts: Generated<number>;
+    /** Most recent dispatch failure message (truncated to 4 KB by application code) */
+    last_error: string | null;
+    /** Earliest moment the leader-only retry scanner should re-publish pg_notify */
+    next_retry_at: Date | null;
+    /** When the event entered the DLQ (NULL = not in DLQ) */
+    dlq_at: Date | null;
+    /** Short DLQ reason: 'exhausted_retries' | 'non_retryable' */
+    dlq_reason: string | null;
+}
+export type KiciEvent = Selectable<KiciEventTable>;
+export type NewKiciEvent = Insertable<KiciEventTable>;
+export type KiciEventUpdate = Updateable<KiciEventTable>;
+/**
+ * Generic webhook sources table (generic_webhook_sources)
+ * Stores per-source verification config, event extraction rules, and rate limits
+ * for non-GitHub webhook sources.
+ */
+export interface GenericWebhookSourceTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** Customer/tenant identifier */
+    customer_id: string;
+    /** Human-readable source name (unique within customer when not deleted) */
+    name: string;
+    /** Routing key for this source (e.g. 'generic:<customer_id>:<source_id>') */
+    routing_key: string;
+    /** Verification method: 'hmac_sha256' | 'bearer_token' | 'ip_allowlist' | 'none' */
+    verification_method: Generated<string>;
+    /** Verification config (JSONB): { secret, algorithm } | { token } | { allowlist } | {} */
+    verification_config: Generated<string>;
+    /** Header name to extract event type from (default: 'X-Event-Type') */
+    event_type_header: string | null;
+    /** JSONPath expression to extract event type from payload body */
+    event_type_path: string | null;
+    /** Header name for idempotency key */
+    idempotency_key_header: string | null;
+    /** JSONPath expression for idempotency key from body */
+    idempotency_key_path: string | null;
+    /** Dedup window in seconds (default: 300 = 5 min) */
+    dedup_window_seconds: Generated<number>;
+    /** Maximum payload size in bytes (default: 1048576 = 1MB) */
+    max_payload_bytes: Generated<number>;
+    /** JSON array of allowed event types (null = all) */
+    allowed_events: string | null;
+    /** JSON array of sensitive headers to strip (default: auth-related headers) */
+    strip_headers: Generated<string>;
+    /** Whether this source is active */
+    enabled: Generated<boolean>;
+    /** Token bucket rate limit: requests per minute */
+    rate_limit_rpm: Generated<number>;
+    /** When this source was created */
+    created_at: Generated<Date>;
+    /** When this source was last updated */
+    updated_at: Generated<Date>;
+    /** Soft-delete marker (null = active) */
+    deleted_at: Date | null;
+    /** Provider implementation to route this source through.
+     *  'generic' (default) → GenericWebhookNormalizer (Stripe-shaped payloads).
+     *  'internal' → InternalWebhookNormalizer (github-shaped push/PR payloads
+     *  for E2E tests and the staging smoke test). */
+    provider_type: Generated<string>;
+    /** Universal-git config (JSONB) for sources that also know how to build
+     *  clone URLs, fetch lock files, and issue clone credentials against a
+     *  user-supplied git server (Forgejo / Gitea / Gogs / GitLab repo-webhook /
+     *  plain GitHub repo-webhook). null for legacy generic / internal sources
+     *  that don't drive git operations. Shape validated by
+     *  `UniversalGitConfigSchema` at the application layer. */
+    git_config: ColumnType<string | Record<string, unknown> | null, string | null, string | null>;
+}
+export type GenericWebhookSource = Selectable<GenericWebhookSourceTable>;
+export type NewGenericWebhookSource = Insertable<GenericWebhookSourceTable>;
+export type GenericWebhookSourceUpdate = Updateable<GenericWebhookSourceTable>;
+/**
+ * Cross-repo trust table (cross_repo_trust)
+ * Bidirectional trust relationships for cross-repo event delivery.
+ * Both source and target must declare trust for delivery to proceed.
+ */
+export interface CrossRepoTrustTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** Source repo that is trusted to emit events */
+    source_repo: string;
+    /** Source routing key */
+    source_routing_key: string;
+    /** Target repo that accepts events from source */
+    target_repo: string;
+    /** Target routing key */
+    target_routing_key: string;
+    /** JSON array of event name glob patterns allowed (null = all) */
+    allowed_events: string | null;
+    /** Whether this trust relationship is active */
+    enabled: Generated<boolean>;
+    /** When this trust relationship was created */
+    created_at: Generated<Date>;
+}
+export type CrossRepoTrust = Selectable<CrossRepoTrustTable>;
+export type NewCrossRepoTrust = Insertable<CrossRepoTrustTable>;
+export type CrossRepoTrustUpdate = Updateable<CrossRepoTrustTable>;
+/**
+ * Test uploads table (test_uploads)
+ * Tracks CLI code uploads for remote test runs.
+ * Uploads are temporary (24h TTL) and cleaned up by a periodic job.
+ */
+export interface TestUploadsTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** Client-facing upload ID */
+    upload_id: string;
+    /** Routing key for this upload */
+    routing_key: string;
+    /** Git SHA from the upload */
+    sha: string | null;
+    /** Number of files in the upload */
+    file_count: number | null;
+    /** Compressed size in bytes */
+    compressed_size: number | null;
+    /** S3 object key for the uploaded tarball */
+    storage_key: string;
+    /** Ephemeral private key for decryption (stored encrypted with master key) */
+    encryption_private_key: string | null;
+    /** Upload status: pending | uploaded | dispatched | expired */
+    status: Generated<string>;
+    /** When this upload was created */
+    created_at: Generated<Date>;
+    /** When this upload expires (24h from creation) */
+    expires_at: Date;
+    /** Token identifier of the uploader */
+    created_by: string | null;
+}
+export type TestUpload = Selectable<TestUploadsTable>;
+export type NewTestUpload = Insertable<TestUploadsTable>;
+export type TestUploadUpdate = Updateable<TestUploadsTable>;
+/**
+ * Workflow registrations table
+ * Per-workflow rows with full lock entry and trigger type index.
+ * Each registration is unique per (routing_key, repo, workflow).
+ */
+export interface WorkflowRegistrationsTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** Repository identifier (e.g. "owner/repo") */
+    repo_identifier: string;
+    /** Workflow name from lock file */
+    workflow_name: string;
+    /** Full workflow lock file entry (JSONB) */
+    lock_entry: string;
+    /** Array of trigger type strings for GIN index queries */
+    trigger_types: string[];
+    /** Routing key that created this registration (e.g. "github:42") */
+    routing_key: Generated<string>;
+    /** Provider-specific context captured at registration time (e.g. { installationId }) */
+    provider_context: Generated<string>;
+    /** Whether this workflow registration is disabled (skipped during trigger matching) */
+    disabled: ColumnType<boolean, boolean | undefined, boolean>;
+    /** Git commit SHA from the push that last updated this registration */
+    commit_sha: ColumnType<string | null, string | null | undefined, string | null>;
+    /** Source file path for this workflow (e.g. ".kici/workflows/deploy.ts") */
+    source_file: ColumnType<string | null, string | null | undefined, string | null>;
+    /** Whether this is a global workflow (triggers across all repos under same routing key) */
+    is_global: ColumnType<boolean, boolean | undefined, boolean>;
+    /**
+     * Customer/org ID that owns this registration. Backfilled from the source row
+     * (sources or generic_webhook_sources joined on routing_key) by migration 020,
+     * NOT NULL after backfill. Used by the cross-source webhook lookup index
+     * (RegistrationIndex.byOrgAndEvent) to enforce org isolation.
+     *
+     * Required on insert (no DB default — migration 020 enforces NOT NULL);
+     * Updateable type allows omission so the existing replaceAll UPDATE branch
+     * (which preserves the existing customer_id alongside the rest of the row)
+     * can keep its current shape.
+     */
+    customer_id: ColumnType<string, string, string | undefined>;
+    /** When this registration was created */
+    created_at: Generated<Date>;
+    /** When this registration was last updated */
+    updated_at: Generated<Date>;
+}
+export type WorkflowRegistration = Selectable<WorkflowRegistrationsTable>;
+export type NewWorkflowRegistration = Insertable<WorkflowRegistrationsTable>;
+export type WorkflowRegistrationUpdate = Updateable<WorkflowRegistrationsTable>;
+/**
+ * Registry versions table
+ * Cluster sync version counter. Incremented on registration changes.
+ * Default row with id='default' inserted by migration.
+ */
+export interface RegistryVersionsTable {
+    /** Version identifier (default: 'default') */
+    id: Generated<string>;
+    /** Monotonically increasing version counter */
+    version: Generated<number>;
+    /** When the version was last bumped */
+    updated_at: Generated<Date>;
+}
+export type RegistryVersion = Selectable<RegistryVersionsTable>;
+export type RegistryVersionUpdate = Updateable<RegistryVersionsTable>;
+/**
+ * Cron last-fired table
+ * Tracks the last time each cron-triggered workflow registration fired.
+ * Used for fire-once-on-recovery after orchestrator restart.
+ */
+export interface CronLastFiredTable {
+    /** References workflow_registrations.id (cascade delete) */
+    registration_id: string;
+    /** When this cron trigger last fired */
+    last_fired_at: Date;
+    /** When this record was last updated */
+    updated_at: Generated<Date>;
+}
+export type CronLastFired = Selectable<CronLastFiredTable>;
+export type NewCronLastFired = Insertable<CronLastFiredTable>;
+export type CronLastFiredUpdate = Updateable<CronLastFiredTable>;
+/**
+ * Run ephemeral keys table (run_ephemeral_keys)
+ * Stores per-run X25519 key pairs for cross-job secret output encryption.
+ * Private keys are encrypted with the orchestrator PSK (AES-256-GCM).
+ */
+export interface RunEphemeralKeysTable {
+    /** Run ID (primary key, references execution_runs.run_id) */
+    run_id: string;
+    /** Base64-encoded AES-256-GCM encrypted private key */
+    encrypted_private_key: string;
+    /** Base64-encoded DER public key (X25519 SPKI format) */
+    public_key: string;
+    /** When this key pair was created */
+    created_at: Generated<Date>;
+}
+export type RunEphemeralKey = Selectable<RunEphemeralKeysTable>;
+export type NewRunEphemeralKey = Insertable<RunEphemeralKeysTable>;
+/**
+ * Run secret outputs table (run_secret_outputs)
+ * Stores encrypted secret output values produced by jobs for cross-job consumption.
+ * Values are encrypted with the run's ephemeral public key via ECDH + AES-256-GCM.
+ */
+export interface RunSecretOutputsTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** Run ID (references execution_runs.run_id) */
+    run_id: string;
+    /** Job ID that produced this output */
+    job_id: string;
+    /** Output key name */
+    output_key: string;
+    /** Base64-encoded encrypted value (agent-encrypted ECDH envelope) */
+    encrypted_value: string;
+    /** When this output was stored */
+    created_at: Generated<Date>;
+}
+export type RunSecretOutput = Selectable<RunSecretOutputsTable>;
+export type NewRunSecretOutput = Insertable<RunSecretOutputsTable>;
+/**
+ * Concurrency groups table (concurrency_groups)
+ * Tracks active and queued runs per concurrency group for slot management.
+ * Persists across orchestrator restarts; hydrated into in-memory tracker on startup.
+ */
+export interface ConcurrencyGroupsTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** Concurrency group key (e.g. "deploy-main") */
+    group_key: string;
+    /** Run ID that owns this slot or is queued */
+    run_id: string;
+    /** Job ID within the run */
+    job_id: string;
+    /** Routing key for scoping (e.g. "github:42") */
+    routing_key: string;
+    /** Status: 'active' | 'queued' | 'completed' | 'cancelled' */
+    status: Generated<string>;
+    /** When this entry was created */
+    created_at: Generated<Date>;
+    /** When this entry was completed/cancelled */
+    completed_at: Date | null;
+}
+export type ConcurrencyGroup = Selectable<ConcurrencyGroupsTable>;
+export type NewConcurrencyGroup = Insertable<ConcurrencyGroupsTable>;
+export type ConcurrencyGroupUpdate = Updateable<ConcurrencyGroupsTable>;
+/**
+ * Sources table
+ * Stores webhook source configurations (e.g. GitHub Apps) with routing keys.
+ * Secrets (private key, webhook secret) are stored separately in PgSecretStore.
+ */
+export interface SourcesTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** Provider type (e.g. 'github') */
+    provider: string;
+    /** Human-readable source name */
+    name: string;
+    /** Routing key (e.g. 'github:12345') */
+    routing_key: string;
+    /** JSONB config (non-sensitive, e.g. { appId: '12345' }) */
+    config: string;
+    /** Customer/org identifier for secret and environment scoping */
+    customer_id: Generated<string>;
+    /** When this source was created */
+    created_at: Generated<Date>;
+    /** When this source was last updated */
+    updated_at: Generated<Date>;
+}
+export type Source = Selectable<SourcesTable>;
+export type NewSource = Insertable<SourcesTable>;
+export type SourceUpdate = Updateable<SourcesTable>;
+/**
+ * Repo-pattern entry stored inside the three jsonb list columns of
+ * `org_settings`. `routingKey` is optional — when undefined the entry
+ * applies to any source in the org; when set, it qualifies the entry to
+ * one specific webhook source.
+ */
+export interface OrgSettingsRepoPatternEntry {
+    routingKey?: string;
+    pattern: string;
+}
+/**
+ * Org settings table (org_settings)
+ * Per-org (customer_id) global workflow permissions. Each list column
+ * holds a jsonb array of {routingKey?, pattern} entries — entries without
+ * a `routingKey` apply to any source in the org, entries with a routing
+ * key are scoped to that source only.
+ */
+export interface OrgSettingsTable {
+    /** Customer/org identifier (primary key) */
+    customer_id: string;
+    /** Whether global workflows are enabled for this org */
+    global_workflows_enabled: ColumnType<boolean, boolean | undefined, boolean>;
+    /** Repos allowed to author global workflows (null = any repo can author) */
+    global_workflow_allowed_repos: ColumnType<OrgSettingsRepoPatternEntry[] | null, OrgSettingsRepoPatternEntry[] | null | undefined | string, OrgSettingsRepoPatternEntry[] | null | string>;
+    /** Repos with elevated trust for global workflow execution (null = none) */
+    global_workflow_elevated_repos: ColumnType<OrgSettingsRepoPatternEntry[] | null, OrgSettingsRepoPatternEntry[] | null | undefined | string, OrgSettingsRepoPatternEntry[] | null | string>;
+    /**
+     * Repos explicitly denied as event sources for global workflows.
+     * Deny takes precedence over the allow-list (null = no deny patterns).
+     */
+    global_workflow_denied_repos: ColumnType<OrgSettingsRepoPatternEntry[] | null, OrgSettingsRepoPatternEntry[] | null | undefined | string, OrgSettingsRepoPatternEntry[] | null | string>;
+    /**
+     * When true, workflow `registries:` URLs may use plain `http://` to any host.
+     * When false (default), only `https://` and loopback / `*.local` `http://`
+     * URLs are accepted; arbitrary `http://` registries are rejected at dispatch.
+     */
+    allow_http_npm_registries: ColumnType<boolean, boolean | undefined, boolean>;
+    /** When this setting was created */
+    created_at: Generated<Date>;
+    /** When this setting was last updated */
+    updated_at: Generated<Date>;
+}
+export type OrgSettings = Selectable<OrgSettingsTable>;
+export type NewOrgSettings = Insertable<OrgSettingsTable>;
+export type OrgSettingsUpdate = Updateable<OrgSettingsTable>;
+/**
+ * Pending job contexts table
+ * Persists PendingJobContext for crash-recovery of needs-gated jobs.
+ * Keyed by (run_id, job_name) matching the in-memory Map key format.
+ * Rows are created at storePendingJobContext time, deleted on consume or run completion.
+ */
+export interface PendingJobContextsTable {
+    /** Run identifier */
+    run_id: string;
+    /** Job name within the workflow */
+    job_name: string;
+    /** Full QueuedJobInput serialized as JSONB */
+    job_input: ColumnType<Record<string, unknown>, string, string>;
+    /** string[] of labels serialized as JSONB */
+    runs_on_labels: ColumnType<string[], string, string>;
+    /** When this context was stored */
+    created_at: Generated<Date>;
+}
+export type PendingJobContextRow = Selectable<PendingJobContextsTable>;
+export type NewPendingJobContext = Insertable<PendingJobContextsTable>;
+/**
+ * Inbound webhook delivery event log table.
+ * One row per inbound webhook delivery (relay or direct), regardless of
+ * outcome. Joins with the Platform-side `event_log` on `(org_id, delivery_id)`.
+ *
+ * Payload bytes live in object storage (LogStorage) at `payload_key`. When
+ * `payload_omitted=true`, the payload was not stored (size cap or upload
+ * failure) -- the metadata + hash + size are still durable for correlation.
+ *
+ * Retention: 30 days, cleaned by queue/cleanup.ts.
+ */
+export interface EventLogTable {
+    /** UUID primary key */
+    id: Generated<string>;
+    /** Tenant ID (12-char NanoID) */
+    org_id: string;
+    /** Provider delivery ID (unique within org) */
+    delivery_id: string;
+    /** Routing key (e.g. "github:42", "generic:<org>:<src>", "internal:...") */
+    routing_key: string;
+    /** Provider event name (X-GitHub-Event / X-Event-Type / 'default') */
+    event: string;
+    /** payload.action when present */
+    action: string | null;
+    /** Where the delivery arrived: 'relay' (Platform WS) or 'direct' (HTTP) */
+    source: string;
+    /** Provider type ('github' / 'generic' / 'internal') */
+    provider: string;
+    /** owner/repo when extractable */
+    repo_identifier: string | null;
+    /** Best-effort ref/branch */
+    ref: string | null;
+    /** Object-storage key under LogStorage. NULL when payload_omitted=true. */
+    payload_key: string | null;
+    /** True when payload was not stored (size cap or upload failure) */
+    payload_omitted: Generated<boolean>;
+    /** 'size_exceeded' | 'storage_failed' | NULL */
+    payload_omitted_reason: string | null;
+    /** Actual body byte size (pre-gzip) */
+    payload_size_bytes: number;
+    /** SHA-256 of raw body, identical algorithm to Platform event_log.payload_hash */
+    payload_hash: string;
+    /** Workflows matched by trigger evaluation (0 = no match) */
+    matched_count: Generated<number>;
+    /** 'received' | 'processed' | 'duplicate' | 'lockfile_missing' | 'failed' */
+    status: string;
+    /** First run spawned by this delivery (if any) */
+    run_id: string | null;
+    /** Failure reason when status='failed' */
+    error_message: string | null;
+    /** When the delivery was received */
+    received_at: Generated<Date>;
+    /** Phase E cold-store: set inside the archive transaction; NULL for hot rows. */
+    archived_at: Date | null;
+    /** Phase E cold-store: chunk object key when row is archived. */
+    archive_object_key: string | null;
+}
+export type EventLogRow = Selectable<EventLogTable>;
+export type NewEventLogRow = Insertable<EventLogTable>;
+export type EventLogRowUpdate = Updateable<EventLogTable>;
+/**
+ * Cold-store chunk counts table (cold_store_chunk_counts).
+ * Tracks per-(db, table, tenant) archived-chunk metadata so the
+ * `cold_store_chunks_total` gauge and the `kici-admin cold-store list-chunks`
+ * CLI can report totals without S3 LIST calls. Phase A creates the table
+ * empty; Phase B+ populates it transactionally on each chunk write.
+ */
+export interface ColdStoreChunkCountsTable {
+    /** DbKind identifier ('orchestrator' on this side). */
+    db: string;
+    /** Source Postgres table name. */
+    table_name: string;
+    /** org_id for Platform tables, routing_key for Orchestrator tables. */
+    tenant_id: string;
+    /** Number of chunks written for this (db, table, tenant). */
+    chunk_count: Generated<ColumnType<string, string | number, string | number>>;
+    /** Total uncompressed bytes archived. */
+    total_bytes: Generated<ColumnType<string, string | number, string | number>>;
+    /** Total rows archived. */
+    total_rows: Generated<ColumnType<string, string | number, string | number>>;
+    /** Most recent chunk archive time; null until first chunk lands. */
+    last_archived_at: Date | null;
+}
+export type ColdStoreChunkCountsRow = Selectable<ColdStoreChunkCountsTable>;
+export type NewColdStoreChunkCountsRow = Insertable<ColdStoreChunkCountsTable>;
+export type ColdStoreChunkCountsUpdate = Updateable<ColdStoreChunkCountsTable>;
+/**
+ * Cold-store chunk index (cold_store_chunks). Phase 2.
+ *
+ * One row per archived chunk that the GC sweep can later purge from S3.
+ * Inserted inside `markArchivedAndDelete`'s transaction by adapters that
+ * opt into the per-bucket layout via `coldTtlDays(row)`. Pre-Phase-2
+ * (v1) chunks are NOT in this table — they're treated as
+ * `'forever'` and never purged.
+ */
+export interface ColdStoreChunksTable {
+    /** DbKind identifier ('orchestrator' on this side). */
+    db: string;
+    /** Source Postgres table name. */
+    table_name: string;
+    /** org_id for Platform-keyed adapters, routing_key for Orchestrator. */
+    tenant_id: string;
+    /** Deterministic 16-hex chunk filename stem (matches the S3 object). */
+    chunk_id: string;
+    /** S3 prefix segment ('30d' / '180d' / '1y' / '2y' / 'forever'). */
+    bucket: string;
+    /** YYYY-MM-DD partition the chunk's rows came from. */
+    partition_date: ColumnType<Date, string, string>;
+    /** When the chunk landed in S3 + this row was inserted. */
+    archived_at: Generated<Date>;
+    /** Compressed size of the data chunk (bytes). */
+    gzip_bytes: ColumnType<string, string | number, string | number>;
+    /** Number of rows in the chunk. */
+    row_count: ColumnType<string, string | number, string | number>;
+    /**
+     * Row-level cold-retention horizon — TEXT to accommodate both numeric
+     * day-counts and the literal `'forever'`. The GC sweep checks
+     * `max_cold_days != 'forever' AND now() > archived_at + max_cold_days
+     * * INTERVAL '1 day'`.
+     */
+    max_cold_days: string;
+    /** Full S3 key of the data chunk (used by the GC sweep's DeleteObject). */
+    object_key: string;
+}
+export type ColdStoreChunksRow = Selectable<ColdStoreChunksTable>;
+export type NewColdStoreChunksRow = Insertable<ColdStoreChunksTable>;
+export type ColdStoreChunksUpdate = Updateable<ColdStoreChunksTable>;
+//# sourceMappingURL=types.d.ts.map