@kici-dev/orchestrator 0.0.0 → 0.1.2

package/dist/db/migrations/003_access_log.d.ts

@@ -0,0 +1,26 @@
+import { type Kysely } from 'kysely';
+/**
+ * Access log: one row per read or orchestrator-admin mutation attributable
+ * to an ActorPrincipal (dashboard user, api_key, service_account, platform
+ * operator break-glass, or system). Backs:
+ *
+ * - dashboard "Data access" tab (dashboard.access-log.list message)
+ * - orchestrator admin HTTP route GET /api/v1/admin/access-log
+ * - kici-admin `access-log` CLI subcommand
+ *
+ * Covers reads + orchestrator-admin mutations uniformly. `secret_audit_log`
+ * stays the source of truth for secret *mutation* events (kept separate for
+ * historical reasons and different retention expectations); access_log
+ * records secret *reveals* with full actor attribution.
+ *
+ * `source` distinguishes platform_proxy vs admin_http vs admin_cli entry
+ * points. `actor_meta` captures the variant-specific extras that don't fit
+ * in the flat (actor_type, actor_id) columns — ownerSub for api_key,
+ * reason for platform_operator.
+ *
+ * Retention is TTL-based via expires_at; packages/orchestrator/src/queue/
+ * cleanup.ts picks up the prune pass.
+ */
+export declare function up(db: Kysely<any>): Promise<void>;
+export declare function down(db: Kysely<any>): Promise<void>;
+//# sourceMappingURL=003_access_log.d.ts.map

package/dist/db/migrations/004_rename_bundle_to_source.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Rename `dispatch_queue.bundle_url` / `bundle_hash` → `source_tar_url` /
+ * `source_tar_hash`.
+ *
+ * The cached build artifact changed from a Rolldown-bundled `.compiled.mjs`
+ * (keyed under `bundles/{contentHash}.js` in S3) to a raw `.kici/` source
+ * tarball (keyed under `source/{contentHash}.tar.gz`). The agent extracts it
+ * and imports the workflow via the shared oxc-transform ESM loader hook
+ * instead of running Rolldown at runtime.
+ *
+ * Pre-release rename: no data preservation needed. Any rows referencing the
+ * old bundle URLs will fail their contentHash lookup once the new SCHEMA_V4
+ * cache prefix lands, and the orchestrator will schedule a fresh build job —
+ * same as any other cache miss.
+ */
+import type { Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=004_rename_bundle_to_source.d.ts.map

package/dist/db/migrations/005_cold_store_chunk_counter.d.ts

@@ -0,0 +1,19 @@
+import { type Kysely } from 'kysely';
+/**
+ * Cold-store chunk counter table.
+ *
+ * Tracks per-(db, table, tenant) archived-chunk metadata so the
+ * `cold_store_chunks_total` Prometheus gauge and the
+ * `kici-admin cold-store list-chunks` CLI can report totals without
+ * issuing S3 LIST calls (expensive + rate-limited).
+ *
+ * Phase A creates the table empty; the cold-store archiver
+ * (Phase B+) updates it transactionally with every successful chunk
+ * write via `INSERT ... ON CONFLICT (db, table_name, tenant_id) DO
+ * UPDATE SET chunk_count = chunk_count + EXCLUDED.chunk_count, ...`.
+ *
+ * sections 5 and 8.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=005_cold_store_chunk_counter.d.ts.map

package/dist/db/migrations/006_runs_jobs_steps_archived_at.d.ts

@@ -0,0 +1,38 @@
+import { type Kysely } from 'kysely';
+/**
+ * `execution_runs` / `execution_jobs` / `execution_steps` cold-store
+ * schema additions.
+ *
+ * Phase C of the cold-storage archival system. See
+ *
+ * Each table gets `archived_at TIMESTAMPTZ NULL` and
+ * `archive_object_key TEXT NULL` (set inside the archive tx before the
+ * DELETE; survivors carry NULL — same pattern as Phase B's migration
+ * 004 for `run_events`).
+ *
+ * Tenant column denormalization: the orchestrator side partitions by
+ * `routing_key`, but only `execution_runs` carries the column today.
+ * `execution_jobs` and `execution_steps` reference the run by `run_id`
+ * and would otherwise need a 3-table JOIN at every archive cycle. We
+ * denormalize `routing_key` onto both tables and backfill from the
+ * existing run rows. Backfill is one-shot inside this migration. New
+ * inserts must populate the column going forward (enforced at the
+ * application layer in the same phase).
+ *
+ * The denormalized column is left NULLable for safety: if an insert
+ * site is missed in the rollout, the row still lands in PG; the
+ * cold-store adapter's `listEligiblePartitions` skips NULLs (no
+ * tenant ⇒ no archive). A follow-up migration may tighten to NOT NULL
+ * once we're confident every insert site is updated.
+ *
+ * Composite indexes added for the archiver's
+ * `listEligiblePartitions` discovery query
+ * (`GROUP BY routing_key, DATE(created_at)`):
+ *
+ *   - `idx_execution_runs_routing_key_created  (routing_key, created_at)`
+ *   - `idx_execution_jobs_routing_key_created  (routing_key, created_at)`
+ *   - `idx_execution_steps_routing_key_created (routing_key, created_at)`
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=006_runs_jobs_steps_archived_at.d.ts.map

package/dist/db/migrations/007_audit_logs_archived_at.d.ts

@@ -0,0 +1,42 @@
+import { type Kysely } from 'kysely';
+/**
+ * `secret_audit_log` and `access_log` cold-store schema additions, plus
+ * the removal of `access_log`'s `expires_at`-based hard delete.
+ *
+ * Phase D of the cold-storage archival system. See
+ *
+ * Both tables get the same `archived_at TIMESTAMPTZ NULL` /
+ * `archive_object_key TEXT NULL` pair that Phase B added to `run_events`
+ * (`packages/platform/src/db/migrations/004_run_events_archived_at.ts`)
+ * and Phase C added to `execution_runs` / `execution_jobs` /
+ * `execution_steps` (`006_runs_jobs_steps_archived_at.ts`). Set inside
+ * the archive transaction before the DELETE; survivors carry NULL.
+ *
+ * `secret_audit_log` gets a composite
+ * `idx_secret_audit_log_routing_timestamp (routing_key, timestamp)` so
+ * the archiver's per-tenant scan can use a single index. The existing
+ * `idx_secret_audit_log_timestamp` is single-column and would force a
+ * filter step.
+ *
+ * `access_log` already has `access_log_org_created_idx (org_id,
+ * created_at DESC)`, which is sufficient for the per-tenant scan
+ * (range scans use either direction).
+ *
+ * Drops `access_log.expires_at` column and `access_log_expires_idx`.
+ * Until Phase D, `expires_at` powered a 90-day hard-delete sweep in
+ * `packages/orchestrator/src/audit/access-log.ts:cleanup` (called from
+ * `packages/orchestrator/src/queue/cleanup.ts:runCleanup` step 5). With
+ * cold-store, `access_log` rows older than 30 days are archived rather
+ * than deleted, so the TTL becomes effectively "forever". Keeping the
+ * column would mean either (a) double-evicting rows or (b) silently
+ * mismatching the new contract. Drop it.
+ *
+ * Per the project's "no backward compatibility (pre-release)" rule,
+ * `down()` recreates `expires_at` with a default of `now() + 90 days`
+ * — best effort; rows inserted between `up()` and a hypothetical
+ * `down()` would not have meaningful retention bounds. Acceptable for
+ * staging.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=007_audit_logs_archived_at.d.ts.map

package/dist/db/migrations/008_event_log_archived_at.d.ts

@@ -0,0 +1,40 @@
+import { type Kysely } from 'kysely';
+/**
+ * `event_log` cold-store schema additions plus removal of the
+ * `expires_at`-based 30-day hard delete.
+ *
+ * Phase E of the cold-storage archival system. See
+ *  §10
+ * Phase E.
+ *
+ * Adds the same `archived_at TIMESTAMPTZ NULL` /
+ * `archive_object_key TEXT NULL` pair Phase D added on this side
+ * (`007_audit_logs_archived_at.ts`). Set inside the archive
+ * transaction before the DELETE; survivors carry NULL.
+ *
+ * Adds `idx_event_log_routing_received` on `(routing_key, received_at)`
+ * because the orchestrator-side cold-store partitions `event_log` by
+ * `routing_key` (NOT NULL on this table; no synthetic-tenant fallback
+ * is needed). The existing `event_log_org_received_idx` is keyed by
+ * `org_id`, fine for dashboard queries but not the per-tenant
+ * archiver scan.
+ *
+ * Drops `event_log.expires_at` and the matching
+ * `event_log_expires_at_idx` index. Until Phase E, `expires_at`
+ * powered the 30-day hard-delete sweep in
+ * `packages/orchestrator/src/webhook/event-log.ts:cleanup`, called
+ * from `packages/orchestrator/src/queue/cleanup.ts:runCleanup` step 4
+ * (which also deleted the per-row `payload_key` blob from object
+ * storage). With cold-store, rows older than 30 days are archived
+ * rather than deleted; the per-row `payload_key` blob is retained
+ * indefinitely so the dashboard delivery-detail page can still load
+ * the body for archived deliveries.
+ *
+ * Per the project's "no backward compatibility (pre-release)" rule,
+ * `down()` recreates `expires_at` with a default of `now() + 30 days`
+ * — best effort; rows inserted between `up()` and a hypothetical
+ * `down()` would not have meaningful retention bounds.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=008_event_log_archived_at.d.ts.map

package/dist/db/migrations/009_access_log_trigram.d.ts

@@ -0,0 +1,15 @@
+import { type Kysely } from 'kysely';
+/**
+ * Trigram (pg_trgm) index on access_log.error_message for the federated
+ * Activity page's full-text search (`q` parameter).
+ *
+ * Matches the Platform counterpart in `008_audit_log_trigram.ts` which
+ * indexes `audit_log.details::text`.
+ *
+ * Idempotent: `CREATE EXTENSION IF NOT EXISTS` and `CREATE INDEX IF NOT
+ * EXISTS` are both safe to re-run. No CONCURRENTLY because Kysely runs
+ * migrations inside a transaction; the lock is brief on a sampled table.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=009_access_log_trigram.d.ts.map

package/dist/db/migrations/010_cold_store_chunks.d.ts

@@ -0,0 +1,34 @@
+import { type Kysely } from 'kysely';
+/**
+ * Cold-store chunk index — Phase 2 (cold-store purge).
+ *
+ * One row per archived chunk that the GC sweep can later purge from S3.
+ * Inserted inside the same transaction as `markArchivedAndDelete` so a
+ * chunk is either fully recorded (S3 + index + rollup + audit) or fully
+ * absent (no orphan rows).
+ *
+ * Schema notes:
+ *
+ * - `chunk_id` is the deterministic 16-hex chunk filename stem; primary
+ *   key is `(db, table_name, chunk_id)` so the framework can `DELETE`
+ *   without scanning. The `db` column matches `cold_store_chunk_counts`
+ *   (always `'orchestrator'` here, included for shape parity with the
+ *   Platform-side migration).
+ * - `bucket` is the S3 prefix segment (`'30d'` / `'180d'` / `'1y'` /
+ *   `'2y'` / `'forever'`). Carried for `cold-store list-chunks` /
+ *   `list-purgeable` filtering.
+ * - `max_cold_days` is the row-level retention horizon — TEXT to
+ *   accommodate both numeric values and the literal `'forever'`. The
+ *   GC sweep checks `max_cold_days != 'forever' AND now() > archived_at
+ *   + (max_cold_days || ' days')::interval`.
+ * - `object_key` is the full S3 key of the data chunk; the GC sweep
+ *   uses this to issue `DeleteObject` directly without recomputing the
+ *   key from the prefix.
+ *
+ * Pre-Phase-2 chunks (v1 manifest) are NOT in this table — they live
+ * forever. Adapters that don't opt into per-bucket archival via
+ * `coldTtlDays` don't insert here either.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=010_cold_store_chunks.d.ts.map

package/dist/db/migrations/011_drop_source_secrets_notify.d.ts

@@ -0,0 +1,21 @@
+import { type Kysely } from 'kysely';
+/**
+ * Drop the `source_secrets_change_trigger` and the
+ * `notify_source_secrets_change()` plpgsql function.
+ *
+ * Both were used by the (now removed) `WebhookSecretManager` which
+ * subscribed via LISTEN/NOTIFY to detect changes to webhook secret rows in
+ * `scoped_secrets` and pushed them to the multi-tenant Platform via the
+ * `source.secrets` WS message. After the chunked-relay cutover the
+ * orchestrator never pushes secret material to Platform -- Platform asks
+ * the orchestrator to verify each inbound webhook on demand and the
+ * verifier reads secrets directly from `PgSecretStore` -- so the trigger
+ * is dead code and only emits NOTIFY traffic that nobody listens to.
+ *
+ * `down` re-creates the function + trigger as they were originally defined
+ * in `001_initial.ts`. They wake up no consumer until the `WebhookSecretManager`
+ * is restored, so this migration is safe to roll back.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=011_drop_source_secrets_notify.d.ts.map

package/dist/db/migrations/012_peer_credentials_active_uniq.d.ts

@@ -0,0 +1,28 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add a partial unique index on `peer_credentials (instance_id) WHERE
+ * revoked_at IS NULL` so two ACTIVE rows for the same `instance_id` become a
+ * database-level impossibility.
+ *
+ * Background: `PeerCredentialStore.save()` historically ran an `UPDATE …
+ * SET revoked_at = NOW()` followed by an `INSERT` without a transaction or
+ * unique constraint. When a joining peer fanned out N peer-clients in
+ * parallel (one per coordinator), each coordinator's `save()` could run its
+ * `UPDATE` before the others' `INSERT`s committed — both `UPDATE`s revoked
+ * nothing and both `INSERT`s succeeded, leaving 2+ ACTIVE rows for the same
+ * `instance_id`. The peer's local credential file then ended up holding a
+ * hash that a later concurrent `save()` had revoked, causing an endless
+ * "Peer HMAC proof invalid" loop. See
+ *  for the
+ * full incident write-up (DB rows + log evidence from real staging deploys).
+ *
+ * The `up()` first dedupes any pre-existing duplicates (revoke all but the
+ * newest active row per `instance_id`) — required because earlier migrations
+ * predate the constraint and existing staging DBs already have the dupes.
+ *
+ * `down()` only drops the index; it does NOT undo the dedupe (there's no
+ * safe way to recreate revoked rows, and the dedupe is monotonic).
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=012_peer_credentials_active_uniq.d.ts.map

package/dist/db/migrations/013_execution_log_bytes.d.ts

@@ -0,0 +1,21 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `log_bytes BIGINT NOT NULL DEFAULT 0` columns to `execution_runs` and
+ * `execution_jobs` so the orchestrator can persist the per-job and per-run
+ * raw log byte totals reported by agents on terminal `step.status`.
+ *
+ * Used by the operator-side `kici_org_log_bytes` capacity-planning gauge on
+ * the Platform (Platform mirrors these columns via WS replication and runs
+ * the aggregation query — same DB-derived pattern as
+ * `kici_org_executions_count` and `kici_org_agent_minutes`).
+ *
+ * Default 0 keeps existing rows valid without a backfill: pre-existing runs
+ * predate this column and report as zero log-bytes, which is the correct
+ * operator-visibility value (we never had the agent telemetry to compute a
+ * real total for them).
+ *
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`).
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=013_execution_log_bytes.d.ts.map

package/dist/db/migrations/014_kici_events_lease_retry.d.ts

@@ -0,0 +1,36 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add lease + retry + DLQ columns to `kici_events` so the EventRouter can
+ * deliver events at-least-once with bounded retries and a visible
+ * dead-letter queue.
+ *
+ * Before this migration, EventRouter used `claimForProcessing` (UPDATE
+ * processed=true WHERE processed=false RETURNING *) and dispatched after
+ * the row was already marked processed. If `onEventMatched` threw, the
+ * event was silently lost. Same loss surface for cron fires, since
+ * `tryClaimFire` and `eventStore.write` were two separate transactions:
+ * a crash between them advanced `cron_last_fired.last_fired_at` without
+ * persisting the event row.
+ *
+ * After this migration:
+ *  - `claimed_at`, `claimed_by`: lease-based claim. Replaces the
+ *    "flip processed=true upfront" pattern. A lease is taken on dispatch,
+ *    released on success (processed=true) or failure (cleared + retry scheduled).
+ *  - `attempts`: incremented on each lease attempt. Enables bounded retry.
+ *  - `last_error`: most recent dispatch failure message (truncated by
+ *    application code to 4 KB).
+ *  - `next_retry_at`: earliest moment the leader-only retry scanner should
+ *    re-publish `pg_notify` for this event.
+ *  - `dlq_at`, `dlq_reason`: terminal DLQ marker. Once `dlq_at IS NOT NULL`
+ *    the row is no longer eligible for lease/retry. Surfaced in the
+ *    dashboard admin DLQ page.
+ *
+ * Partial indexes keep these new lookups cheap without blowing up the index
+ * size on the hot path (most rows are processed=true and irrelevant to the
+ * scanner).
+ *
+ * Idempotent (`ADD COLUMN IF NOT EXISTS` + `CREATE INDEX IF NOT EXISTS`).
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=014_kici_events_lease_retry.d.ts.map

package/dist/db/migrations/015_org_settings_customer_scoped.d.ts

@@ -0,0 +1,30 @@
+import { type Kysely } from 'kysely';
+/**
+ * Org-scope `org_settings` and qualify each glob entry by source.
+ *
+ * `org_settings` was keyed by `routing_key`, meaning each webhook
+ * source had its own independent global-workflow configuration. With multi-
+ * source orgs, the dashboard's per-org settings page only ever showed the
+ * first source it found and silently hid the rest.
+ *
+ * This migration:
+ *
+ *   1. Adds a `customer_id text` column.
+ *   2. Backfills `customer_id` from `sources` / `generic_webhook_sources` by
+ *      `routing_key`. Rows whose `routing_key` cannot be resolved (orphans
+ *      from deleted sources) are dropped — they were already unreachable.
+ *   3. Converts the three repo-list `text[]` columns to `jsonb` arrays of
+ *      `{routingKey?: string, pattern: string}` entries. Each existing entry
+ *      is qualified with its original `routing_key` so semantics are preserved
+ *      verbatim — a glob that previously only saw events on `github:42` still
+ *      only sees events on `github:42`.
+ *   4. Merges rows by `customer_id`. `global_workflows_enabled` collapses with
+ *      logical OR; the three list columns concatenate.
+ *   5. Drops the old `routing_key` column and PK; new PK is `customer_id`.
+ *
+ * Idempotent: a re-run on an already-migrated DB sees `customer_id` exists
+ * and the list columns are already jsonb, so it is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=015_org_settings_customer_scoped.d.ts.map

package/dist/db/migrations/016_org_settings_allow_http_npm.d.ts

@@ -0,0 +1,15 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `org_settings.allow_http_npm_registries boolean NOT NULL DEFAULT false`.
+ *
+ * Operators flip this on a per-org basis to permit `http://` (non-HTTPS)
+ * registry URLs in workflow `registries:` declarations. By default only
+ * `https://` registries are accepted, with an automatic exemption for
+ * loopback / `*.local` / private link-local hosts so dev fixtures
+ * (Verdaccio at `http://verdaccio.local:4873`) keep working.
+ *
+ * Idempotent: a re-run on a DB that already has the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=016_org_settings_allow_http_npm.d.ts.map

package/dist/db/migrations/017_org_id_widen.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=017_org_id_widen.d.ts.map

package/dist/db/migrations/018_org_id_prefix_backfill.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=018_org_id_prefix_backfill.d.ts.map

package/dist/db/migrator.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Auto-migrate module with PostgreSQL advisory lock for HA safety.
+ *
+ * Uses pg_advisory_lock to ensure only one orchestrator instance runs
+ * migrations at a time, preventing conflicts in multi-instance deployments.
+ */
+import { type MigrationResult } from 'kysely/migration';
+import type { Kysely } from 'kysely';
+import type pg from 'pg';
+interface MigrateOptions {
+    db: Kysely<any>;
+    pool: pg.Pool;
+}
+interface MigrationStatusEntry {
+    name: string;
+    status: 'applied' | 'pending';
+    appliedAt?: Date;
+}
+/**
+ * Run all pending migrations with an advisory lock for concurrency safety.
+ *
+ * Acquires pg_advisory_lock before migrating to prevent concurrent
+ * migration attempts from multiple orchestrator instances. The lock
+ * is always released in the finally block, even on error.
+ */
+export declare function runMigrations(opts: MigrateOptions): Promise<MigrationResult[]>;
+/**
+ * Get migration status (applied/pending) without running anything.
+ */
+export declare function getMigrationStatus(opts: MigrateOptions): Promise<MigrationStatusEntry[]>;
+export {};
+//# sourceMappingURL=migrator.d.ts.map