@kici-dev/orchestrator 0.1.26 → 0.2.0

package/dist/db/migrations/080_cluster_settings.d.ts

@@ -0,0 +1,17 @@
+import { type Kysely } from 'kysely';
+/**
+ * Create `cluster_settings`: a single-row (id='default') table of fleet-wide
+ * operator tunables. Each knob column is nullable; NULL = "use the cluster
+ * default from config.ts". Distinct from org_settings (per customer_id) — these
+ * knobs have no per-tenant meaning (process-global singletons, ingest before
+ * org resolution, per-agent-instance, leader-only sweepers), so they live on a
+ * dedicated cluster-global table rather than a magic customer_id row.
+ *
+ * Read via ClusterSettingsReader (whole-row, short-TTL cache); written via the
+ * `/api/v1/admin/cluster-settings` route and `kici-admin cluster-settings` CLI.
+ *
+ * Idempotent: a re-run on a DB that already has the table is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=080_cluster_settings.d.ts.map

package/dist/db/migrations/081_org_settings_queue_timeout.d.ts

@@ -0,0 +1,19 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `org_settings.queue_timeout_ms BIGINT` (nullable).
+ *
+ * Per-org dispatch-queue job timeout. A queued job's deadline is
+ * `job.timeoutMs ?? <per-org queue_timeout_ms> ?? config.queueTimeoutMs`.
+ * NULL falls back to the cluster-wide default (`KICI_QUEUE_TIMEOUT_MS`,
+ * default 1h). Operators tune it per tenant via
+ * `kici-admin org-settings queue-timeout`.
+ *
+ * This is the one genuinely per-job tunable from the tunables audit — the
+ * read site (`JobQueue.enqueue`) has the job's `cacheOrgId` in scope. The
+ * fleet-wide tunables live on `cluster_settings` (migration 080) instead.
+ *
+ * Idempotent: a re-run on a DB that already has the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=081_org_settings_queue_timeout.d.ts.map

package/dist/db/migrations/082_host_s3_reachable.d.ts

@@ -0,0 +1,16 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `host_roster.s3_reachable BOOLEAN` (nullable).
+ *
+ * Per-host delivery hint for fresh-box bring-up: when true, the box can reach
+ * the orchestrator's object storage, so the bring-up handler picks the
+ * `s3-direct` delivery mode (the box pulls the payload via a presigned URL
+ * itself, no 50 MB through the ops agent). NULL / false ⇒ the conservative
+ * `ssh-push` fallback (the ops agent fetches the payload and streams it to the
+ * box over scp). Declared via `kici-admin host declare --s3-reachable`.
+ *
+ * Idempotent: a re-run on a DB that already has the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=082_host_s3_reachable.d.ts.map

package/dist/db/migrations/083_org_settings_artifact_caps.d.ts

@@ -0,0 +1,18 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `org_settings.artifact_max_bytes` + `artifact_max_per_run` (both nullable
+ * BIGINT).
+ *
+ * Per-org overrides of the per-artifact size cap and per-run artifact count cap
+ * for user-facing artifacts (ctx.artifacts). NULL falls back to the cluster-wide
+ * default (`config.artifactMaxBytes` / `config.artifactMaxPerRun`,
+ * `KICI_ARTIFACT_MAX_BYTES` / `KICI_ARTIFACT_MAX_PER_RUN`). Operators tune them
+ * per tenant via `kici-admin org-settings artifacts set-max-bytes` /
+ * `set-max-per-run`.
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has a
+ * column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=083_org_settings_artifact_caps.d.ts.map

package/dist/db/migrations/084_orchestrator_signing_keys.d.ts

@@ -0,0 +1,20 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add the `orchestrator_signing_keys` table: the cluster-scoped, long-lived
+ * ES256 provenance signing keys the orchestrator uses to sign its own build
+ * attestations. One `active` key signs; rotated-out keys go `retiring` then
+ * `retired` (still served in the JWKS so historical attestations keep
+ * verifying); `revoked` keys are removed from the trust root.
+ *
+ * `public_jwk` is the non-secret public half served at `/.well-known/jwks.json`.
+ * `encrypted_private_jwk` holds the AES-256-GCM-wrapped private JWK for `db`
+ * custody (wrapped with the orchestrator's `KICI_SECRET_KEY` master key, same
+ * posture as `scoped_secrets`) and is NULL for `aws-kms` / `command` custody
+ * where the private key never lives in the DB. `key_ref` locates the external
+ * key (KMS ARN / signer command) for non-`db` custody.
+ *
+ * Idempotent: guarded on table existence.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=084_orchestrator_signing_keys.d.ts.map

package/dist/db/migrations/085_cluster_settings_reroute_flap_grace_ms.d.ts

@@ -0,0 +1,12 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.reroute_flap_grace_ms` (nullable BIGINT).
+ *
+ * Fleet-wide grace window (ms) during which a rerouted job stays deferred from the recovery sweepers while its worker peer momentarily flaps. NULL → cluster default (`config.rerouteFlapGraceMs`, `KICI_REROUTE_FLAP_GRACE_MS`).
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has
+ * the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=085_cluster_settings_reroute_flap_grace_ms.d.ts.map

package/dist/db/migrations/086_cluster_settings_max_fanout_hosts.d.ts

@@ -0,0 +1,12 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.max_fanout_hosts` (nullable INTEGER).
+ *
+ * Fleet-wide cap on `runsOnAll` per-host fan-out children. NULL → cluster default (`config.maxFanoutHosts`, `KICI_MAX_FANOUT_HOSTS`).
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has
+ * the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=086_cluster_settings_max_fanout_hosts.d.ts.map

package/dist/db/migrations/087_cluster_settings_event_router_rate_limit.d.ts

@@ -0,0 +1,12 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.event_router_rate_limit_per_workflow_per_minute` (nullable INTEGER).
+ *
+ * Fleet-wide per-(source routing key + event) sliding-window rate limit (events/minute) for the event router. NULL → cluster default (`config.eventRouterRateLimitPerWorkflowPerMinute`, `KICI_EVENT_ROUTER_RATE_LIMIT_PER_WORKFLOW_PER_MINUTE`).
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has
+ * the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=087_cluster_settings_event_router_rate_limit.d.ts.map

package/dist/db/migrations/088_cluster_settings_cache_max_tarball_bytes.d.ts

@@ -0,0 +1,12 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.cache_max_tarball_bytes` (nullable BIGINT).
+ *
+ * Fleet-wide maximum dependency-cache tarball size (bytes); a larger store is rejected. NULL → cluster default (`config.cacheMaxTarballBytes`, `KICI_CACHE_MAX_TARBALL_BYTES`).
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has
+ * the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=088_cluster_settings_cache_max_tarball_bytes.d.ts.map

package/dist/db/migrations/089_cluster_settings_cache_ttl_days.d.ts

@@ -0,0 +1,12 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.cache_ttl_days` (nullable INTEGER).
+ *
+ * Fleet-wide dependency-cache entry TTL (days). An entry unread for longer is treated as expired on the next lookup. NULL → cluster default (`config.cacheTtlDays`, `KICI_CACHE_TTL_DAYS`).
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has
+ * the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=089_cluster_settings_cache_ttl_days.d.ts.map

package/dist/db/migrations/090_cluster_settings_concurrency_wait_timeout_ms.d.ts

@@ -0,0 +1,12 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.concurrency_wait_timeout_ms` (nullable BIGINT).
+ *
+ * Fleet-wide agent concurrency-slot wait timeout (ms), pushed to the agent on `job.dispatch`. NULL → cluster default (`config.concurrencyWaitTimeoutMs`, `KICI_CONCURRENCY_WAIT_TIMEOUT_MS`).
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has
+ * the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=090_cluster_settings_concurrency_wait_timeout_ms.d.ts.map

package/dist/db/migrations/091_cluster_settings_agent_token_ttl_ms.d.ts

@@ -0,0 +1,12 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.agent_token_ttl_ms` (nullable BIGINT).
+ *
+ * Fleet-wide ephemeral agent-token TTL (ms), resolved by the leader at spawn. NULL → cluster default (`config.agentTokenTtlMs`, `KICI_AGENT_TOKEN_TTL_MS`).
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has
+ * the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=091_cluster_settings_agent_token_ttl_ms.d.ts.map

package/dist/db/migrations/092_cluster_settings_version.d.ts

@@ -0,0 +1,16 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.version` (monotonic BIGINT, bumped on each settings
+ * change).
+ *
+ * The leader advertises this version on `peer.heartbeat` so DB-less workers can
+ * detect a change and pull the worker-relevant settings snapshot. DB-backed
+ * (not an in-memory counter) so it survives leader failover: a newly-elected
+ * leader continues monotonically from the row's current value.
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has
+ * the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=092_cluster_settings_version.d.ts.map

package/dist/db/migrations/093_org_settings_sandbox_allowlist.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=093_org_settings_sandbox_allowlist.d.ts.map

package/dist/db/migrations/094_dashboard_encryption_keys.d.ts

@@ -0,0 +1,21 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add the `dashboard_encryption_keys` table: the cluster-scoped, long-lived
+ * X25519 keypair the orchestrator owns for browser-sealed dashboard writes.
+ * Under the `encrypted` dashboard-write posture the browser seals a secret /
+ * variable value to the `active` key's public half before it leaves the page,
+ * so the hosted Platform relays only opaque ciphertext.
+ *
+ * Modeled on `orchestrator_signing_keys` (migration 084). `public_jwk` is the
+ * non-secret OKP/X25519 public JWK (`use:'enc'`) served at
+ * `/.well-known/jwks.json`. `encrypted_private_key` holds the AES-256-GCM
+ * master-key-wrapped (KICI_SECRET_KEY) DER private key — db custody only, so it
+ * is NOT NULL. One `active` key seals; a rotated-out key goes `revoked` and
+ * leaves the published JWKS, while its row stays so envelopes already sealed to
+ * it still decrypt.
+ *
+ * Idempotent: guarded on table existence.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=094_dashboard_encryption_keys.d.ts.map

package/dist/db/migrations/095_dashboard_write_policy_tristate.d.ts

@@ -0,0 +1,20 @@
+import { type Kysely } from 'kysely';
+/**
+ * Migrate stored `org_settings.dashboard_write_policy` JSONB from the legacy
+ * boolean shape to the tri-state `permissive | encrypted | disabled` shape:
+ *
+ *   - `false` (disabled)  → `"disabled"`
+ *   - `true`  (permissive) → key dropped (permissive is the absent-key default,
+ *     keeping the JSONB minimal — matches setDashboardWritePolicy normalization)
+ *   - already-string enum values → left untouched (idempotent re-run)
+ *
+ * Runtime reads coerce booleans defensively too (so an un-migrated row is never
+ * mis-read), but this migration normalizes the at-rest shape so the stored JSONB
+ * matches what the tri-state writer produces.
+ *
+ * Pure SQL rewrite: for each row, rebuild the object keeping only non-`true`
+ * entries and mapping `false` → `'disabled'`, leaving existing string values.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(): Promise<void>;
+//# sourceMappingURL=095_dashboard_write_policy_tristate.d.ts.map

package/dist/db/migrations/096_multi_schedule_cron_last_fired.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=096_multi_schedule_cron_last_fired.d.ts.map

package/dist/db/migrations/097_execution_runs_pr_number.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=097_execution_runs_pr_number.d.ts.map

package/dist/db/migrations/098_execution_runs_customer_id.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=098_execution_runs_customer_id.d.ts.map

package/dist/db/migrations/099_cluster_settings_dashboard_verified_issuer.d.ts

@@ -0,0 +1,21 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.dashboard_verified_issuer` (nullable text).
+ *
+ * The verified-tier origin the dashboard fetches the orchestrator's X25519
+ * dashboard-encryption public key from — and always displays next to a secret /
+ * variable entry field — under the `encrypted` dashboard-write posture. Fetching
+ * the key straight from the customer's own origin makes TLS to that domain the
+ * trust root, so an active hosted-control-plane MITM of the key cannot happen.
+ *
+ * Cluster-global (one orchestrator identity, one `.well-known`), not per-tenant,
+ * so it lives on `cluster_settings` rather than `org_settings`. The tier is
+ * explicit opt-in with no environment fallback: NULL ⇒ the verified tier is not
+ * offered and the convenient tier is used.
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has the
+ * column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=099_cluster_settings_dashboard_verified_issuer.d.ts.map

package/dist/db/migrations/100_held_runs_hold_type_vocabulary.d.ts

@@ -0,0 +1,31 @@
+import { type Kysely } from 'kysely';
+/**
+ * Realign `held_runs.hold_type` onto the engine's `HoldType` vocabulary.
+ *
+ * The column carries two spellings the gates never emit: `approval` for a
+ * reviewer hold and `wait_timer` for a workflow-install wait hold. The
+ * dashboard switches on the gate vocabulary, so both fall through to the gray
+ * unknown-type badge — and two semantically identical wait holds render
+ * differently depending on which gate produced them.
+ *
+ * Writers emit the gate vocabulary; this backfills the history. The read path
+ * also normalizes (`normalizePersistedHoldType`) and the wait-hold release
+ * sweep matches both spellings, so a row written by an un-upgraded
+ * orchestrator behaves correctly whether or not this has run — the two sides
+ * deploy independently.
+ *
+ * Idempotent: a second run matches no rows.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+/**
+ * Rewrite the gate vocabulary back to the legacy spellings.
+ *
+ * Deliberately asymmetric: it rewrites *every* `reviewer` / `timer` row,
+ * including rows that were always written that way (a dispatch-gate wait hold
+ * has persisted as `timer` all along). That is the right trade for a rollback —
+ * an orchestrator running the older code matches its wait-hold release sweep on
+ * `wait_timer` alone, so leaving those rows spelled `timer` would strand them
+ * in the expire-and-fail path.
+ */
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=100_held_runs_hold_type_vocabulary.d.ts.map

package/dist/db/migrations/101_contexts_hold_expiry_drop_default.d.ts

@@ -0,0 +1,31 @@
+import { type Kysely } from 'kysely';
+/**
+ * Give the context hold expiry a single default, and retire the stored zeroes.
+ *
+ * `contexts.hold_expiry_seconds` carried `DEFAULT 86400` while every read-side
+ * fallback and the operator docs used 3600 — so a context created without an
+ * expiry held for 24 h, and one whose expiry was cleared held for 1 h. Dropping
+ * the DDL default (rather than moving it to 3600) makes both paths land on NULL
+ * and resolve through `DEFAULT_HOLD_EXPIRY_SECONDS`, so the two cannot drift
+ * apart again.
+ *
+ * The backfill is the other half of rejecting a zero expiry at the write
+ * boundary: a stored `0` puts every hold's deadline at the current instant, so
+ * the hold is swept to `expired` before a reviewer can act. Validation alone
+ * only stops new zeroes arriving; these rows already exist and there was no CLI
+ * path to notice them.
+ *
+ * Idempotent: dropping an absent default is a no-op and the UPDATE matches no
+ * rows on a second run.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+/**
+ * Restore the column's original default.
+ *
+ * Deliberately asymmetric: the zeroed rows are NOT recreated. After the
+ * backfill they are indistinguishable from a deliberate NULL, and a row put
+ * back to `0` would resume cancelling every hold on its context — so a
+ * rollback keeps them on the fallback rather than re-breaking them.
+ */
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=101_contexts_hold_expiry_drop_default.d.ts.map

package/dist/db/migrations/102_dispatch_queue_agent_id.d.ts

@@ -0,0 +1,20 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `dispatch_queue.agent_id` (nullable text).
+ *
+ * The durable record of which agent a job was dispatched to. `ack_agent_id` is
+ * cleared the moment the agent answers the dispatch, so it cannot answer "who
+ * owns this job?" for the rest of the job's life; this column is written at
+ * dispatch and cleared only on requeue, so a coordinator that never saw the
+ * dispatch — a freshly-elected leader after a failover — can still resolve
+ * ownership of a live `dispatched` row straight from the database.
+ *
+ * Nullable with no backfill: a row dispatched before this migration keeps a NULL
+ * owner and resolves to "not owned", which is the behaviour it already had.
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has the
+ * column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=102_dispatch_queue_agent_id.d.ts.map

package/dist/db/migrations/103_cluster_settings_ownership_db_check_timeout_ms.d.ts

@@ -0,0 +1,20 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.ownership_db_check_timeout_ms` (nullable bigint).
+ *
+ * Deadline for a single database-backed agent-ownership lookup. The lookup runs
+ * on the inbound path of every job-scoped agent frame whose in-memory ownership
+ * check misses, so a slow database would otherwise stall the frame; past the
+ * deadline the lookup resolves as undecided and the frame is refused without
+ * counting an ownership violation.
+ *
+ * Cluster-global (every coordinator talks to the same database), so it lives on
+ * `cluster_settings` rather than `org_settings`. NULL ⇒ the orchestrator's own
+ * configured default applies.
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has the
+ * column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=103_cluster_settings_ownership_db_check_timeout_ms.d.ts.map

package/dist/db/migrations/104_check_run_terminal_sent.d.ts

@@ -0,0 +1,22 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `check_run_tracking.terminal_sent_at` (nullable timestamptz).
+ *
+ * `check_run_id` is written at CREATE time, while the check run is still
+ * `queued`, so it proves creation and never completion. Without a completion
+ * signal a check run stuck `queued` on the provider is indistinguishable from
+ * the provider simply lagging, which is what made a check-run poll timeout
+ * unattributable: nothing on our side recorded whether the terminal update had
+ * been sent at all.
+ *
+ * Stamped only after the provider accepts a `completed` update. Nullable and
+ * best-effort like every write on this table — a tracking write must never
+ * break check-run reporting — so NULL means "we have no record of sending it",
+ * not "it was never sent".
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has
+ * the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=104_check_run_terminal_sent.d.ts.map

package/dist/db/migrations/105_org_trust_policy.d.ts

@@ -0,0 +1,19 @@
+import { type Kysely } from 'kysely';
+/**
+ * Create `org_trust_policy` — the orchestrator's cache of the Platform-owned org
+ * trust policy pushed on `trust_policy.update`.
+ *
+ * A dedicated table rather than `org_settings` columns, because this is
+ * Platform-owned policy the orchestrator consumes, not operator-owned config the
+ * operator tunes. `source` records which of the two wrote the row so the admin
+ * surface can present a Platform-managed policy as read-only.
+ *
+ * Persisting rather than caching in memory is deliberate: a security policy that
+ * silently reverts to a default across a restart is worse than one that is never
+ * applied.
+ *
+ * Idempotent: guarded by IF NOT EXISTS, so a re-run is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=105_org_trust_policy.d.ts.map

package/dist/db/migrations/106_cluster_settings_check_run_tracking_ttl_days.d.ts

@@ -0,0 +1,18 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.check_run_tracking_ttl_days` (nullable integer).
+ *
+ * Retention window for `check_run_tracking` rows. The hourly cleanup sweep
+ * deletes rows untouched for longer than this; 0 disables the sweep.
+ *
+ * Cluster-global (the sweep runs once per fleet on the cleanup tick, with no
+ * tenant in scope at the read site), so it lives on `cluster_settings` rather
+ * than `org_settings`. NULL means the orchestrator's own configured default
+ * applies.
+ *
+ * Idempotent: guarded on column existence; a re-run on a database that already
+ * has the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=106_cluster_settings_check_run_tracking_ttl_days.d.ts.map

package/dist/db/migrations/107_check_run_tracking_updated_at_index.d.ts

@@ -0,0 +1,23 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `idx_check_run_tracking_updated_at` on `check_run_tracking (updated_at)`.
+ *
+ * `CheckRunTrackingStore.pruneStale` — the hourly retention sweep — filters
+ * `WHERE updated_at < now() - <window>`. The table already carries two indexes
+ * — the primary key on `(provider, owner, repo, sha, check_name)` and the
+ * partial `idx_check_run_tracking_run_id` — but `updated_at` leads neither, so
+ * that predicate can use neither and without this index every sweep
+ * sequentially scans the whole table. The scan
+ * is worst exactly where it hurts: a deployment that accumulated rows before
+ * retention existed has the largest table and gets the scan hourly, on every
+ * coordinator, since the cleanup tick is not leader-gated.
+ *
+ * Mirrors `idx_dispatch_queue_run_id` (migration 072) and
+ * `idx_request_idempotency_created_at` (migration 068), both of which exist to
+ * index a TTL sweep's prune predicate.
+ *
+ * Idempotent: `IF NOT EXISTS` makes a re-run a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=107_check_run_tracking_updated_at_index.d.ts.map

package/dist/db/repos/dashboard-encryption-keys-repo.d.ts

@@ -0,0 +1,48 @@
+import type { Kysely } from 'kysely';
+import type { Database, DashboardEncryptionKeyRow } from '../types.js';
+/** Lifecycle status values for a dashboard-encryption key. */
+export declare const DashboardEncryptionKeyStatus: {
+    readonly active: 'active';
+    readonly revoked: 'revoked';
+};
+export type DashboardEncryptionKeyStatus = (typeof DashboardEncryptionKeyStatus)[keyof typeof DashboardEncryptionKeyStatus];
+export interface UpsertActiveEncryptionKeyInput {
+    kid: string;
+    public_jwk: Record<string, unknown>;
+    /** AES-256-GCM-wrapped DER private key (master-key wrapped). */
+    encrypted_private_key: string;
+}
+/**
+ * Repository for the orchestrator's dashboard-encryption (X25519) keys. One
+ * `active` key seals browser writes; a rotated-out key is `revoked`, which drops
+ * it from the published JWKS ({@link listNonRevoked}) so new seals only ever use
+ * the current key, while its row — and therefore its wrapped private half —
+ * stays on record ({@link getByKid}) so an envelope a browser already sealed to
+ * the old `kid` still decrypts. Mirrors the activate/demote transaction shape of
+ * `OrchestratorSigningKeyRepo`.
+ */
+export declare class DashboardEncryptionKeyRepo {
+    private readonly db;
+    constructor(db: Kysely<Database>);
+    /** Public keys published in the JWKS (the active key; revoked ones drop out). */
+    listNonRevoked(): Promise<DashboardEncryptionKeyRow[]>;
+    /** Every key on record: the active one plus every rotated-out (revoked) one. */
+    listServed(): Promise<DashboardEncryptionKeyRow[]>;
+    /** The single currently-active key row, or null when none is active. */
+    getActiveRow(): Promise<DashboardEncryptionKeyRow | null>;
+    /** Resolve a key (active or rotated-out) by kid, or null. */
+    getByKid(kid: string): Promise<DashboardEncryptionKeyRow | null>;
+    /**
+     * Activate `input.kid`. If already active, no-op. Otherwise demote any
+     * current active key to `revoked` and insert this kid as `active`, in one
+     * transaction. Returns true when a NEW kid was activated (caller audits).
+     */
+    upsertActive(input: UpsertActiveEncryptionKeyInput): Promise<boolean>;
+    /**
+     * Mark a key revoked (rotation / compromise). It leaves the published JWKS
+     * immediately, but its private half stays on record, so a browser still
+     * holding the old kid keeps decrypting until the row is deleted.
+     */
+    revoke(kid: string, reason: string): Promise<void>;
+}
+//# sourceMappingURL=dashboard-encryption-keys-repo.d.ts.map

package/dist/db/repos/signing-keys-repo.d.ts

@@ -0,0 +1,34 @@
+import type { Kysely } from 'kysely';
+import type { Database, OrchestratorSigningKeyRow } from '../types.js';
+export interface UpsertActiveInput {
+    kid: string;
+    public_jwk: Record<string, unknown>;
+    /** Wrapped private JWK for `db` custody; null for `aws-kms` / `command`. */
+    encrypted_private_jwk: string | null;
+    alg: string;
+    signer_kind: string;
+    key_ref: string | null;
+}
+/**
+ * Repository for the orchestrator's provenance signing keys. Ports the Platform's
+ * `signing-keys-repo.ts` status model (activate / retire / revoke) and adds
+ * `encrypted_private_jwk` custody for `db` keys.
+ */
+export declare class OrchestratorSigningKeyRepo {
+    private readonly db;
+    constructor(db: Kysely<Database>);
+    /** Public keys served in the JWKS / trusted for verification (everything except revoked). */
+    listTrusted(): Promise<OrchestratorSigningKeyRow[]>;
+    /** The single currently-active key row, or null when none is active. */
+    getActiveRow(): Promise<OrchestratorSigningKeyRow | null>;
+    /**
+     * Activate `input.kid`. If it is already active, no-op. Otherwise demote any
+     * current active key to `retiring`, upsert this kid as `active`, in one
+     * transaction. Returns true when a NEW kid was activated (caller audits).
+     * Refuses to reactivate a `revoked` kid.
+     */
+    upsertActive(input: UpsertActiveInput): Promise<boolean>;
+    retire(kid: string): Promise<void>;
+    revoke(kid: string, reason: string): Promise<void>;
+}
+//# sourceMappingURL=signing-keys-repo.d.ts.map