@kici-dev/orchestrator 0.1.23 → 0.1.25

package/dist/cluster/cluster-identity.d.ts

@@ -29,6 +29,17 @@ export interface ClusterIdentityDeps {
      */
     skipSentinelValidation?: boolean;
 }
+/**
+ * Default cache-storage S3 prefix (mirrors the orchestrator config
+ * `cacheStorageS3Prefix` default). Empty means the cache blobs and the
+ * cluster-identity sentinel live at the bucket root — the bucket already scopes
+ * the cluster. Every place that resolves a sentinel prefix (the orchestrator
+ * runtime, the `kici-admin cluster reconcile-identity` CLI, and the staging
+ * deploy's self-heal step) MUST fall back to THIS value when no explicit prefix
+ * is set, otherwise they compute divergent sentinel keys and crash-loop the
+ * orchestrator boot on a spurious "Cluster identity mismatch".
+ */
+export declare const DEFAULT_CACHE_STORAGE_S3_PREFIX = "";
 /**
  * Build the S3 key for the cluster identity sentinel under an optional prefix.
  * Strips any trailing slash from the prefix so callers can pass either form.

package/dist/cluster/reconcile-identity.d.ts

@@ -0,0 +1,50 @@
+import type { IdempotentStep } from '@kici-dev/shared/idempotency';
+export type ReconcileDirection = 'db-from-sentinel' | 'sentinel-from-db';
+export interface ReconcileS3Config {
+    bucket: string;
+    /**
+     * Optional storage prefix (mirrors `KICI_STORAGE_PREFIX`). The sentinel lives
+     * at `<prefix>/.kici-cluster-id`; must match the prefix the orchestrator boots
+     * with. When omitted, `clusterSentinelKey` resolves the bucket root — the same
+     * as the orchestrator's `DEFAULT_CACHE_STORAGE_S3_PREFIX` (empty) default.
+     */
+    prefix?: string;
+    region?: string;
+    endpoint?: string;
+    forcePathStyle?: boolean;
+    accessKeyId: string;
+    secretAccessKey: string;
+}
+export interface IdentityDrift {
+    dbClusterId: string | null;
+    sentinelClusterId: string | null;
+    direction: ReconcileDirection;
+}
+declare function readClusterIdFromDb(databaseUrl: string): Promise<string | null>;
+declare function writeClusterIdToDb(databaseUrl: string, clusterId: string): Promise<void>;
+declare function readSentinel(s3: ReconcileS3Config): Promise<string | null>;
+declare function writeSentinel(s3: ReconcileS3Config, clusterId: string): Promise<void>;
+/**
+ * Indirection object for the DB + S3 reads/writes, so the unit test can stub
+ * the I/O without an ESM partial-mock dance. `buildReconcileStep` calls every
+ * reader/writer through this object; the test overrides its members directly.
+ */
+export declare const reconcileIo: {
+    readClusterIdFromDb: typeof readClusterIdFromDb;
+    writeClusterIdToDb: typeof writeClusterIdToDb;
+    readSentinel: typeof readSentinel;
+    writeSentinel: typeof writeSentinel;
+};
+/**
+ * Build the idempotent step that reconciles the cluster identity in the given
+ * direction. `check()` returns drift when the two sides disagree (or null when
+ * in sync); `apply()` performs the single write that brings them into
+ * agreement. Run it through `runIdempotentStep` (`@kici-dev/core/idempotency`).
+ */
+export declare function buildReconcileStep(deps: {
+    databaseUrl: string;
+    s3: ReconcileS3Config;
+    direction: ReconcileDirection;
+}): IdempotentStep<IdentityDrift>;
+export {};
+//# sourceMappingURL=reconcile-identity.d.ts.map

package/dist/cold-store/load-access-log-range.d.ts

@@ -52,6 +52,10 @@ export interface LoadAccessLogRangeArgs {
          * `009_access_log_trigram.ts`. Min ~3 chars for the index to help.
          */
         q?: string;
+        /** Exact-match filter on the agent provenance label (`agent_label` column). */
+        agentLabel?: string;
+        /** When true, return only agent-attributed rows (`agent_label IS NOT NULL`). */
+        agentOnly?: boolean;
     };
     limit: number;
     cursor?: string;

package/dist/config.d.ts

@@ -27,6 +27,7 @@ declare const configSchema: z.ZodObject<{
     platformUrl: z.ZodOptional<z.ZodString>;
     platformToken: z.ZodOptional<z.ZodString>;
     dashboardUrl: z.ZodOptional<z.ZodString>;
+    provenanceIssuer: z.ZodOptional<z.ZodString>;
     webhookPublicUrl: z.ZodOptional<z.ZodString>;
     databaseUrl: z.ZodDefault<z.ZodString>;
     lockfileCacheMax: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -99,6 +100,7 @@ declare const configSchema: z.ZodObject<{
     eventRouterRetryScanIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     testMode: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<boolean, string>>;
     testEventFailFirstN: z.ZodOptional<z.ZodString>;
+    testMintDeferAudience: z.ZodOptional<z.ZodString>;
     eventLogMaxPayloadBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     logLevel: z.ZodDefault<z.ZodEnum<{
         error: "error";
@@ -248,6 +250,7 @@ export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
     platformUrl?: string | undefined;
     platformToken?: string | undefined;
     dashboardUrl?: string | undefined;
+    provenanceIssuer?: string | undefined;
     webhookPublicUrl?: string | undefined;
     cacheStorageType?: "s3" | "filesystem" | undefined;
     cacheStoragePath?: string | undefined;
@@ -272,6 +275,7 @@ export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
     bootstrapAdminToken?: string | undefined;
     orchestratorHostAgentId?: string | undefined;
     testEventFailFirstN?: string | undefined;
+    testMintDeferAudience?: string | undefined;
     otelExporterOtlpEndpoint?: string | undefined;
     clusterName?: string | undefined;
 }>;

package/dist/dashboard/attestation-filters.d.ts

@@ -0,0 +1,131 @@
+import { type Kysely } from 'kysely';
+import type { AttestationListFilters } from '@kici-dev/engine';
+import type { Database } from '../db/types.js';
+/**
+ * The org-wide attestations base query: joins `attestations` to `execution_jobs`
+ * (for the job name) and `execution_runs` (for repository / workflow context).
+ *
+ * `attestations.run_id` / `job_id` are TEXT (P1.5 schema) while the
+ * `execution_*` keys are `uuid`; Postgres won't compare `uuid = text` implicitly,
+ * so the join casts the uuid side to text — mirroring `resolveAttestationsForRun`.
+ * The `execution_runs` join is a LEFT join so a row with no matching run still
+ * lists (repository / workflow come back null).
+ */
+export declare function baseAttestationsQuery(db: Kysely<Database>): import("kysely").SelectQueryBuilder<{
+    cluster_meta: import("../db/types.js").ClusterMetaTable;
+    environments: import("../db/types.js").EnvironmentsTable;
+    host_roster: import("../db/types.js").HostRosterTable;
+    dispatch_queue: import("../db/types.js").DispatchQueueTable;
+    dedup_cache: import("../db/types.js").DedupCacheTable;
+    ip_allocations: import("../db/types.js").IpAllocationTable;
+    execution_runs: import("kysely").Nullable<import("../db/types.js").ExecutionRunTable>;
+    execution_jobs: import("../db/types.js").ExecutionJobTable;
+    execution_steps: import("../db/types.js").ExecutionStepTable;
+    raft_state: import("../db/types.js").RaftStateTable;
+    secret_audit_log: import("../db/types.js").SecretAuditLogTable;
+    scoped_secrets: import("../db/types.js").ScopedSecretsTable;
+    environment_bindings: import("../db/types.js").EnvironmentBindingsTable;
+    environment_variables: import("../db/types.js").EnvironmentVariablesTable;
+    environment_source_overrides: import("../db/types.js").EnvironmentSourceOverridesTable;
+    held_runs: import("../db/types.js").HeldRunsTable;
+    held_run_approvals: import("../db/types.js").HeldRunApprovalsTable;
+    admin_tokens: import("../db/types.js").AdminTokenTable;
+    agent_tokens: import("../db/types.js").AgentTokenTable;
+    config_versions: import("../db/types.js").ConfigVersionTable;
+    kici_events: import("../db/types.js").KiciEventTable;
+    generic_webhook_sources: import("../db/types.js").GenericWebhookSourceTable;
+    cross_repo_trust: import("../db/types.js").CrossRepoTrustTable;
+    test_uploads: import("../db/types.js").TestUploadsTable;
+    workflow_registrations: import("../db/types.js").WorkflowRegistrationsTable;
+    registry_versions: import("../db/types.js").RegistryVersionsTable;
+    cron_last_fired: import("../db/types.js").CronLastFiredTable;
+    run_ephemeral_keys: import("../db/types.js").RunEphemeralKeysTable;
+    run_secret_outputs: import("../db/types.js").RunSecretOutputsTable;
+    concurrency_groups: import("../db/types.js").ConcurrencyGroupsTable;
+    sources: import("../db/types.js").SourcesTable;
+    join_tokens: import("../db/types.js").JoinTokenTable;
+    org_settings: import("../db/types.js").OrgSettingsTable;
+    execution_job_needs: import("../db/types.js").ExecutionJobNeedsTable;
+    pending_job_contexts: import("../db/types.js").PendingJobContextsTable;
+    pending_workflow_contexts: import("../db/types.js").PendingWorkflowContextsTable;
+    event_log: import("../db/types.js").EventLogTable;
+    access_log: import("../db/types.js").AccessLogTable;
+    cold_store_chunk_counts: import("../db/types.js").ColdStoreChunkCountsTable;
+    cold_store_chunks: import("../db/types.js").ColdStoreChunksTable;
+    check_run_tracking: import("../db/types.js").CheckRunTrackingTable;
+    scaler_spawning_agents: import("../db/types.js").ScalerSpawningAgentsTable;
+    scaler_agent_jobs: import("../db/types.js").ScalerAgentJobsTable;
+    scaler_reservations: import("../db/types.js").ScalerReservationsTable;
+    attestations: import("../db/types.js").AttestationsTable;
+    pending_attestations: import("../db/types.js").PendingAttestationsTable;
+    remote_sources: import("../db/types.js").RemoteSourcesTable;
+}, "execution_runs" | "execution_jobs" | "attestations", {}>;
+export type AttestationsBaseQuery = ReturnType<typeof baseAttestationsQuery>;
+/**
+ * Base query for the deferred-attestation outbox (`pending_attestations`),
+ * joined to `execution_jobs` (job name) and `execution_runs` (repo / workflow
+ * context) for the org-wide list's pending summaries.
+ *
+ * Same uuid/text mismatch as `baseAttestationsQuery`: `pending_attestations`
+ * `run_id` / `job_id` are TEXT while the `execution_*` keys are `uuid`, and
+ * Postgres won't compare `uuid = text` implicitly — so the joins cast the uuid
+ * side to text. Both joins are LEFT joins so a pending row with no matching
+ * run / job still lists (repository / workflow / job name come back null).
+ */
+export declare function basePendingAttestationsQuery(db: Kysely<Database>): import("kysely").SelectQueryBuilder<{
+    cluster_meta: import("../db/types.js").ClusterMetaTable;
+    environments: import("../db/types.js").EnvironmentsTable;
+    host_roster: import("../db/types.js").HostRosterTable;
+    dispatch_queue: import("../db/types.js").DispatchQueueTable;
+    dedup_cache: import("../db/types.js").DedupCacheTable;
+    ip_allocations: import("../db/types.js").IpAllocationTable;
+    execution_runs: import("kysely").Nullable<import("../db/types.js").ExecutionRunTable>;
+    execution_jobs: import("kysely").Nullable<import("../db/types.js").ExecutionJobTable>;
+    execution_steps: import("../db/types.js").ExecutionStepTable;
+    raft_state: import("../db/types.js").RaftStateTable;
+    secret_audit_log: import("../db/types.js").SecretAuditLogTable;
+    scoped_secrets: import("../db/types.js").ScopedSecretsTable;
+    environment_bindings: import("../db/types.js").EnvironmentBindingsTable;
+    environment_variables: import("../db/types.js").EnvironmentVariablesTable;
+    environment_source_overrides: import("../db/types.js").EnvironmentSourceOverridesTable;
+    held_runs: import("../db/types.js").HeldRunsTable;
+    held_run_approvals: import("../db/types.js").HeldRunApprovalsTable;
+    admin_tokens: import("../db/types.js").AdminTokenTable;
+    agent_tokens: import("../db/types.js").AgentTokenTable;
+    config_versions: import("../db/types.js").ConfigVersionTable;
+    kici_events: import("../db/types.js").KiciEventTable;
+    generic_webhook_sources: import("../db/types.js").GenericWebhookSourceTable;
+    cross_repo_trust: import("../db/types.js").CrossRepoTrustTable;
+    test_uploads: import("../db/types.js").TestUploadsTable;
+    workflow_registrations: import("../db/types.js").WorkflowRegistrationsTable;
+    registry_versions: import("../db/types.js").RegistryVersionsTable;
+    cron_last_fired: import("../db/types.js").CronLastFiredTable;
+    run_ephemeral_keys: import("../db/types.js").RunEphemeralKeysTable;
+    run_secret_outputs: import("../db/types.js").RunSecretOutputsTable;
+    concurrency_groups: import("../db/types.js").ConcurrencyGroupsTable;
+    sources: import("../db/types.js").SourcesTable;
+    join_tokens: import("../db/types.js").JoinTokenTable;
+    org_settings: import("../db/types.js").OrgSettingsTable;
+    execution_job_needs: import("../db/types.js").ExecutionJobNeedsTable;
+    pending_job_contexts: import("../db/types.js").PendingJobContextsTable;
+    pending_workflow_contexts: import("../db/types.js").PendingWorkflowContextsTable;
+    event_log: import("../db/types.js").EventLogTable;
+    access_log: import("../db/types.js").AccessLogTable;
+    cold_store_chunk_counts: import("../db/types.js").ColdStoreChunkCountsTable;
+    cold_store_chunks: import("../db/types.js").ColdStoreChunksTable;
+    check_run_tracking: import("../db/types.js").CheckRunTrackingTable;
+    scaler_spawning_agents: import("../db/types.js").ScalerSpawningAgentsTable;
+    scaler_agent_jobs: import("../db/types.js").ScalerAgentJobsTable;
+    scaler_reservations: import("../db/types.js").ScalerReservationsTable;
+    attestations: import("../db/types.js").AttestationsTable;
+    pending_attestations: import("../db/types.js").PendingAttestationsTable;
+    remote_sources: import("../db/types.js").RemoteSourcesTable;
+}, "execution_runs" | "execution_jobs" | "pending_attestations", {}>;
+/**
+ * Apply org-wide attestation filters to the base query. Digest is exact-match;
+ * name is an ILIKE substring; status / repository / workflow / job are equality;
+ * created_at gets `>=` / `<=` bounds for the date range. Absent filters are
+ * skipped.
+ */
+export declare function applyAttestationFilters(qb: AttestationsBaseQuery, filters: AttestationListFilters): AttestationsBaseQuery;
+//# sourceMappingURL=attestation-filters.d.ts.map

package/dist/dashboard/handler.d.ts

@@ -13,7 +13,7 @@
  */
 import { type Kysely } from 'kysely';
 import { type ColdStore } from '@kici-dev/shared';
-import type { DashboardRunDetailRequest, DashboardRunsListRequest, DashboardRunsListResponse, DashboardRunsFiltersRequest, DashboardRunsFiltersResponse, DashboardSourcesListRequest, DashboardSourcesListResponse, DashboardStepLogsRequest, DashboardAttestationsListRequest, DashboardPayloadRequest, DashboardOrchLogsRequest, DashboardEventLogListRequest, DashboardEventLogDetailRequest, DashboardEventLogPayloadStreamRequest, DashboardAccessLogListRequest, DashboardEventDlqListRequest, DashboardEventDlqCountRequest, DashboardEventDlqRetryRequest, DashboardEventDlqDiscardRequest, RunRerunRequest, RunCancelRequest, ManualScheduleRequest } from '@kici-dev/engine';
+import type { DashboardRunDetailRequest, DashboardRunsListRequest, DashboardRunsListResponse, DashboardRunsFiltersRequest, DashboardRunsFiltersResponse, DashboardSourcesListRequest, DashboardSourcesListResponse, DashboardStepLogsRequest, DashboardAttestationsListRequest, DashboardAttestationsListAllRequest, DashboardAttestationGetRequest, DashboardAttestationRetryRequest, DashboardPayloadRequest, DashboardOrchLogsRequest, DashboardEventLogListRequest, DashboardEventLogDetailRequest, DashboardEventLogPayloadStreamRequest, DashboardAccessLogListRequest, DashboardEventDlqListRequest, DashboardEventDlqCountRequest, DashboardEventDlqRetryRequest, DashboardEventDlqDiscardRequest, RunRerunRequest, RunCancelRequest, ManualScheduleRequest, DashboardRunStructuredRequest } from '@kici-dev/engine';
 import type { Database } from '../db/types.js';
 import type { LogStorage } from '../reporting/log-storage.js';
 import type { CacheStorage } from '../storage/types.js';
@@ -31,6 +31,17 @@ interface DashboardHandlerDeps {
      * (the same one P1.5 writes bundles to).
      */
     provenanceStorage?: CacheStorage | null;
+    /**
+     * Drain the deferred-attestation outbox on demand (mints in this process,
+     * which owns the Platform WS). Backs `dashboard.attestation.retry`. Optional —
+     * absent on orchestrators without the retrier wired.
+     */
+    retryAttestations?: (opts: {
+        runId?: string;
+    }) => Promise<{
+        minted: number;
+        stillPending: number;
+    }>;
     /** Send a response message back to Platform over the WS connection. */
     send: (msg: unknown) => void;
     /** This orchestrator's instance ID, included in job detail responses. */
@@ -59,7 +70,7 @@ interface DashboardHandlerDeps {
      * compat with mixed deploys; absent means the orchestrator falls
      * back to the legacy "no PG row → throw" path.
      */
-    onRerun: (runId: string, triggeredBy: string | null, routingKey?: string) => Promise<{
+    onRerun: (runId: string, triggeredBy: string | null, triggeredByAgentLabel: string | null, routingKey?: string) => Promise<{
         newRunId: string;
     }>;
     /**
@@ -67,14 +78,14 @@ interface DashboardHandlerDeps {
      * Returns { cancelledJobs } on success or throws on failure.
      * The force flag indicates whether to force-cancel (SIGKILL, skip hooks).
      */
-    onCancel: (runId: string, cancelledBy: string | null, force?: boolean) => Promise<{
+    onCancel: (runId: string, cancelledBy: string | null, cancelledByAgentLabel: string | null, force?: boolean) => Promise<{
         cancelledJobs: number;
     }>;
     /**
      * Callback for handling manual schedule trigger requests.
      * Returns { newRunId } on success or throws on failure.
      */
-    onManualSchedule: (registrationId: string, triggeredBy: string | null) => Promise<{
+    onManualSchedule: (registrationId: string, triggeredBy: string | null, triggeredByAgentLabel: string | null) => Promise<{
         newRunId: string;
     }>;
     /**
@@ -99,6 +110,7 @@ export declare class DashboardHandler {
     private readonly onManualSchedule;
     private readonly coldStore;
     private readonly eventStore;
+    private readonly retryAttestations;
     constructor(deps: DashboardHandlerDeps);
     /**
      * Update the bound orgId + routingKey. Called from server.ts after resolving
@@ -166,6 +178,14 @@ export declare class DashboardHandler {
      * builds a nested job/step tree, and sends the response.
      */
     handleRunDetail(msg: DashboardRunDetailRequest): Promise<void>;
+    /**
+     * Handle a dashboard.run.structured request — the user-plane equivalent of
+     * the orchestrator-admin `/runs/:id/structured` endpoint. Reuses the Phase-1
+     * aggregator + provenance mapper so the result is byte-identical to the admin
+     * surface; emits an `access_log` `run.structured.read` row (carrying the
+     * agent label when the actor came through an agent PAT).
+     */
+    handleRunStructured(msg: DashboardRunStructuredRequest): Promise<void>;
     /**
      * Resolve every routing key owned by an org by unioning both source
      * tables. The orchestrator is single-org but multi-routing-key: one org
@@ -275,6 +295,38 @@ export declare class DashboardHandler {
      * skipped (best-effort) rather than failing the whole list.
      */
     handleAttestationsList(msg: DashboardAttestationsListRequest): Promise<void>;
+    /**
+     * Fetch + parse one attestation bundle from object storage. Returns the full
+     * detail item, or null when the bundle is missing or not valid JSON (logged).
+     * Shared by `handleAttestationsList` (per-run) and `handleAttestationGet`.
+     */
+    private inlineBundle;
+    /**
+     * Org-wide attestations query: one page of metadata-only summaries (no bundle
+     * fetch) plus the total matching count. Filters/pagination/sort applied via
+     * the shared filter builder.
+     */
+    private resolveAttestationsListAll;
+    /** Map the deferred-attestation outbox into pending list summaries (page 1). */
+    private resolvePendingAttestationSummaries;
+    /**
+     * Handle a dashboard.attestations.list.all request: org-wide, paginated,
+     * filtered list of attestation summaries (metadata only). Access-logged
+     * against the `attestation` target.
+     */
+    handleAttestationsListAll(msg: DashboardAttestationsListAllRequest): Promise<void>;
+    /**
+     * Handle a dashboard.attestation.retry request: drain the deferred-attestation
+     * outbox (optionally scoped to one run) and reply with the mint counts. The
+     * mint happens in this orchestrator process, which owns the Platform WS.
+     */
+    handleAttestationRetry(msg: DashboardAttestationRetryRequest): Promise<void>;
+    /**
+     * Handle a dashboard.attestation.get request: a single attestation by id with
+     * its bundle inlined for the detail page. Resolves the run-owning org for the
+     * access-log row, then logs against the `attestation` target.
+     */
+    handleAttestationGet(msg: DashboardAttestationGetRequest): Promise<void>;
     /**
      * Handle a dashboard.payload request.
      * Reads the webhook payload from log storage for the given runId.

package/dist/db/migrations/054_local_working_tree.d.ts

@@ -0,0 +1,15 @@
+import { type Kysely } from 'kysely';
+/**
+ * Mark runs that executed an uploaded local working tree (`kici run remote`):
+ *
+ * - `execution_runs.local_working_tree boolean NOT NULL DEFAULT false` — true
+ *   for runs that ran a developer's local working tree from the CLI (inline
+ *   lock file). The dashboard renders a "Local machine" badge for these runs
+ *   and avoids building an external repository link from the repo identifier.
+ *
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive with a default, so staging
+ * data is preserved.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=054_local_working_tree.d.ts.map

package/dist/db/migrations/055_agent_token_mandatory_labels.d.ts

@@ -0,0 +1,18 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add a token-bound mandatory-label taint to agent tokens:
+ *
+ * - `agent_tokens.mandatory_labels text NULL` — a JSON-encoded `string[]` of
+ *   Kubernetes-taint-style gate labels the token authorizes. When a static
+ *   agent registers with this token, the set becomes the agent's registry-entry
+ *   `mandatoryLabels`: the agent only accepts a job when every label here
+ *   appears in the job's required labels. NULL = no taint (the default; the
+ *   agent accepts any job its advertised labels match), so every existing token
+ *   stays unconfined until re-minted.
+ *
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+ * preserved.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=055_agent_token_mandatory_labels.d.ts.map

package/dist/db/migrations/056_execution_jobs_environments.d.ts

@@ -0,0 +1,17 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add a per-job bound deployment-environment list to `execution_jobs`:
+ *
+ * - `execution_jobs.environments text NULL` — a JSON-encoded `string[]` of the
+ *   ordered environment names a job binds (`environments: [...]`), in merge
+ *   order. Written at dispatch with the statically-resolved names (impure
+ *   dynamic elements as a `(dynamic)` placeholder), then overwritten with the
+ *   fully-resolved list when a deferred-init agent eval resolves dynamic
+ *   elements. NULL = the job binds no environment.
+ *
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+ * preserved.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=056_execution_jobs_environments.d.ts.map

package/dist/db/migrations/057_step_concurrency.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=057_step_concurrency.d.ts.map

package/dist/db/migrations/058_access_log_agent_label.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=058_access_log_agent_label.d.ts.map

package/dist/db/migrations/059_attestation_verdict.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=059_attestation_verdict.d.ts.map

package/dist/db/migrations/060_run_trigger_actor.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=060_run_trigger_actor.d.ts.map

package/dist/db/migrations/061_execution_runs_environment_id.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=061_execution_runs_environment_id.d.ts.map

package/dist/db/migrations/062_execution_runs_agent_label.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=062_execution_runs_agent_label.d.ts.map

package/dist/db/migrations/063_access_log_agent_label_index.d.ts

@@ -0,0 +1,10 @@
+import { type Kysely } from 'kysely';
+/**
+ * Index `access_log.agent_label` (column added by migration 058) so the
+ * operator-facing agent filter (`kici-admin access-log list --agent-label`,
+ * the dashboard "agent name" filter) does an indexed exact-match lookup
+ * instead of a scan. Idempotent.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=063_access_log_agent_label_index.d.ts.map

package/dist/db/migrations/064_execution_jobs_skipped_environments.d.ts

@@ -0,0 +1,17 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add the test-run skipped-environment columns to `execution_jobs`:
+ *
+ * - `execution_jobs.skipped_environments text NULL` — a JSON-encoded `string[]`
+ *   of the bound environment names dropped on a test/local run because they
+ *   disallow local execution (`allowLocalExecution=false`) or are unconfigured.
+ *   NULL = nothing skipped.
+ * - `execution_jobs.env_warning text NULL` — the user-visible warning naming the
+ *   skipped environments, surfaced on the dashboard run view. NULL = no warning.
+ *
+ * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so staging data is
+ * preserved.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=064_execution_jobs_skipped_environments.d.ts.map

package/dist/db/migrations/065_pending_attestations.d.ts

@@ -0,0 +1,22 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add the `pending_attestations` deferred-attestation outbox and an idempotency
+ * unique index on `attestations`.
+ *
+ * When a build's provenance mint fails transiently, the agent freezes and
+ * DSSE-signs the statement at build time; the orchestrator records the frozen
+ * envelope here instead of failing the job. A Raft-leader-only retrier later
+ * mints the deferred token, attaches it, uploads the bundle, and records one
+ * `attestations` row — deleting the pending row. The unique index on
+ * `attestations (run_id, job_id, subject_digest)` makes that fulfilment
+ * idempotent across a cluster (ON CONFLICT DO NOTHING).
+ *
+ * `origin_kind` holds the non-`live` `AttestationOrigin` values
+ * (`deferred` / `offline-backfill`); the `created_at` default anchors the true
+ * build time so temporal honesty survives a later mint.
+ *
+ * Idempotent: guarded on table existence.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=065_pending_attestations.d.ts.map

package/dist/db/migrations/066_pending_attestations_rejected.d.ts

@@ -0,0 +1,13 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `rejected_at` to `pending_attestations`: the terminal-rejection marker for
+ * a deferred attestation the Platform definitively cannot mint (run/job absent).
+ * NULL while the row is still pending a later mint; set once, the row is skipped
+ * by the retrier and drops out of the pending-attestations gauge. Re-armed via
+ * `kici-admin attestations retry --include-rejected`.
+ *
+ * Idempotent: guarded on column existence.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=066_pending_attestations_rejected.d.ts.map