@kici-dev/orchestrator 0.1.26 → 0.2.0

package/dist/dashboard/attestation-filters.d.ts

@@ -12,54 +12,64 @@ import type { Database } from '../db/types.js';
  * lists (repository / workflow come back null).
  */
 export declare function baseAttestationsQuery(db: Kysely<Database>): import("kysely").SelectQueryBuilder<{
+    access_log: import("../db/types.js").AccessLogTable;
+    admin_tokens: import("../db/types.js").AdminTokenTable;
+    agent_tokens: import("../db/types.js").AgentTokenTable;
+    artifacts: import("../db/types.js").ArtifactsTable;
+    attestations: import("../db/types.js").AttestationsTable;
+    backup_runs: import("../db/types.js").BackupRunsTable;
+    batch_accumulation_items: import("../db/types.js").BatchAccumulationItemsTable;
+    batch_accumulation_windows: import("../db/types.js").BatchAccumulationWindowsTable;
+    check_run_tracking: import("../db/types.js").CheckRunTrackingTable;
     cluster_meta: import("../db/types.js").ClusterMetaTable;
-    environments: import("../db/types.js").EnvironmentsTable;
-    host_roster: import("../db/types.js").HostRosterTable;
-    dispatch_queue: import("../db/types.js").DispatchQueueTable;
+    cluster_settings: import("../db/types.js").ClusterSettingsTable;
+    cold_store_chunk_counts: import("../db/types.js").ColdStoreChunkCountsTable;
+    cold_store_chunks: import("../db/types.js").ColdStoreChunksTable;
+    concurrency_groups: import("../db/types.js").ConcurrencyGroupsTable;
+    config_versions: import("../db/types.js").ConfigVersionTable;
+    context_bindings: import("../db/types.js").ContextBindingsTable;
+    context_source_overrides: import("../db/types.js").ContextSourceOverridesTable;
+    context_variables: import("../db/types.js").ContextVariablesTable;
+    contexts: import("../db/types.js").ContextsTable;
+    cron_last_fired: import("../db/types.js").CronLastFiredTable;
+    cross_repo_trust: import("../db/types.js").CrossRepoTrustTable;
+    dashboard_encryption_keys: import("../db/types.js").DashboardEncryptionKeysTable;
     dedup_cache: import("../db/types.js").DedupCacheTable;
-    ip_allocations: import("../db/types.js").IpAllocationTable;
-    execution_runs: import("kysely").Nullable<import("../db/types.js").ExecutionRunTable>;
+    dispatch_queue: import("../db/types.js").DispatchQueueTable;
+    event_log: import("../db/types.js").EventLogTable;
+    execution_job_needs: import("../db/types.js").ExecutionJobNeedsTable;
     execution_jobs: import("../db/types.js").ExecutionJobTable;
+    execution_runs: import("kysely").Nullable<import("../db/types.js").ExecutionRunTable>;
     execution_steps: import("../db/types.js").ExecutionStepTable;
-    raft_state: import("../db/types.js").RaftStateTable;
-    secret_audit_log: import("../db/types.js").SecretAuditLogTable;
-    scoped_secrets: import("../db/types.js").ScopedSecretsTable;
-    environment_bindings: import("../db/types.js").EnvironmentBindingsTable;
-    environment_variables: import("../db/types.js").EnvironmentVariablesTable;
-    environment_source_overrides: import("../db/types.js").EnvironmentSourceOverridesTable;
-    held_runs: import("../db/types.js").HeldRunsTable;
-    held_run_approvals: import("../db/types.js").HeldRunApprovalsTable;
-    admin_tokens: import("../db/types.js").AdminTokenTable;
-    agent_tokens: import("../db/types.js").AgentTokenTable;
-    config_versions: import("../db/types.js").ConfigVersionTable;
-    kici_events: import("../db/types.js").KiciEventTable;
     generic_webhook_sources: import("../db/types.js").GenericWebhookSourceTable;
-    cross_repo_trust: import("../db/types.js").CrossRepoTrustTable;
-    test_uploads: import("../db/types.js").TestUploadsTable;
-    workflow_registrations: import("../db/types.js").WorkflowRegistrationsTable;
-    registry_versions: import("../db/types.js").RegistryVersionsTable;
-    cron_last_fired: import("../db/types.js").CronLastFiredTable;
-    run_ephemeral_keys: import("../db/types.js").RunEphemeralKeysTable;
-    run_secret_outputs: import("../db/types.js").RunSecretOutputsTable;
-    concurrency_groups: import("../db/types.js").ConcurrencyGroupsTable;
-    sources: import("../db/types.js").SourcesTable;
+    held_run_approvals: import("../db/types.js").HeldRunApprovalsTable;
+    held_runs: import("../db/types.js").HeldRunsTable;
+    host_roster: import("../db/types.js").HostRosterTable;
+    ingest_overflow_buffer: import("../db/types.js").IngestOverflowBufferTable;
+    ip_allocations: import("../db/types.js").IpAllocationTable;
     join_tokens: import("../db/types.js").JoinTokenTable;
+    kici_events: import("../db/types.js").KiciEventTable;
+    orchestrator_signing_keys: import("../db/types.js").OrchestratorSigningKeysTable;
     org_settings: import("../db/types.js").OrgSettingsTable;
-    execution_job_needs: import("../db/types.js").ExecutionJobNeedsTable;
+    org_trust_policy: import("../db/types.js").OrgTrustPolicyTable;
+    pending_attestations: import("../db/types.js").PendingAttestationsTable;
     pending_job_contexts: import("../db/types.js").PendingJobContextsTable;
     pending_workflow_contexts: import("../db/types.js").PendingWorkflowContextsTable;
-    event_log: import("../db/types.js").EventLogTable;
-    access_log: import("../db/types.js").AccessLogTable;
-    cold_store_chunk_counts: import("../db/types.js").ColdStoreChunkCountsTable;
-    cold_store_chunks: import("../db/types.js").ColdStoreChunksTable;
-    check_run_tracking: import("../db/types.js").CheckRunTrackingTable;
-    scaler_spawning_agents: import("../db/types.js").ScalerSpawningAgentsTable;
+    raft_state: import("../db/types.js").RaftStateTable;
+    registry_versions: import("../db/types.js").RegistryVersionsTable;
+    remote_sources: import("../db/types.js").RemoteSourcesTable;
+    request_idempotency: import("../db/types.js").RequestIdempotencyTable;
+    run_ephemeral_keys: import("../db/types.js").RunEphemeralKeysTable;
+    run_secret_outputs: import("../db/types.js").RunSecretOutputsTable;
     scaler_agent_jobs: import("../db/types.js").ScalerAgentJobsTable;
     scaler_reservations: import("../db/types.js").ScalerReservationsTable;
-    attestations: import("../db/types.js").AttestationsTable;
-    pending_attestations: import("../db/types.js").PendingAttestationsTable;
-    remote_sources: import("../db/types.js").RemoteSourcesTable;
-}, "execution_runs" | "execution_jobs" | "attestations", {}>;
+    scaler_spawning_agents: import("../db/types.js").ScalerSpawningAgentsTable;
+    scoped_secrets: import("../db/types.js").ScopedSecretsTable;
+    secret_audit_log: import("../db/types.js").SecretAuditLogTable;
+    sources: import("../db/types.js").SourcesTable;
+    test_uploads: import("../db/types.js").TestUploadsTable;
+    workflow_registrations: import("../db/types.js").WorkflowRegistrationsTable;
+}, "attestations" | "execution_jobs" | "execution_runs", {}>;
 export type AttestationsBaseQuery = ReturnType<typeof baseAttestationsQuery>;
 /**
  * Base query for the deferred-attestation outbox (`pending_attestations`),
@@ -73,54 +83,64 @@ export type AttestationsBaseQuery = ReturnType<typeof baseAttestationsQuery>;
  * run / job still lists (repository / workflow / job name come back null).
  */
 export declare function basePendingAttestationsQuery(db: Kysely<Database>): import("kysely").SelectQueryBuilder<{
+    access_log: import("../db/types.js").AccessLogTable;
+    admin_tokens: import("../db/types.js").AdminTokenTable;
+    agent_tokens: import("../db/types.js").AgentTokenTable;
+    artifacts: import("../db/types.js").ArtifactsTable;
+    attestations: import("../db/types.js").AttestationsTable;
+    backup_runs: import("../db/types.js").BackupRunsTable;
+    batch_accumulation_items: import("../db/types.js").BatchAccumulationItemsTable;
+    batch_accumulation_windows: import("../db/types.js").BatchAccumulationWindowsTable;
+    check_run_tracking: import("../db/types.js").CheckRunTrackingTable;
     cluster_meta: import("../db/types.js").ClusterMetaTable;
-    environments: import("../db/types.js").EnvironmentsTable;
-    host_roster: import("../db/types.js").HostRosterTable;
-    dispatch_queue: import("../db/types.js").DispatchQueueTable;
+    cluster_settings: import("../db/types.js").ClusterSettingsTable;
+    cold_store_chunk_counts: import("../db/types.js").ColdStoreChunkCountsTable;
+    cold_store_chunks: import("../db/types.js").ColdStoreChunksTable;
+    concurrency_groups: import("../db/types.js").ConcurrencyGroupsTable;
+    config_versions: import("../db/types.js").ConfigVersionTable;
+    context_bindings: import("../db/types.js").ContextBindingsTable;
+    context_source_overrides: import("../db/types.js").ContextSourceOverridesTable;
+    context_variables: import("../db/types.js").ContextVariablesTable;
+    contexts: import("../db/types.js").ContextsTable;
+    cron_last_fired: import("../db/types.js").CronLastFiredTable;
+    cross_repo_trust: import("../db/types.js").CrossRepoTrustTable;
+    dashboard_encryption_keys: import("../db/types.js").DashboardEncryptionKeysTable;
     dedup_cache: import("../db/types.js").DedupCacheTable;
-    ip_allocations: import("../db/types.js").IpAllocationTable;
-    execution_runs: import("kysely").Nullable<import("../db/types.js").ExecutionRunTable>;
+    dispatch_queue: import("../db/types.js").DispatchQueueTable;
+    event_log: import("../db/types.js").EventLogTable;
+    execution_job_needs: import("../db/types.js").ExecutionJobNeedsTable;
     execution_jobs: import("kysely").Nullable<import("../db/types.js").ExecutionJobTable>;
+    execution_runs: import("kysely").Nullable<import("../db/types.js").ExecutionRunTable>;
     execution_steps: import("../db/types.js").ExecutionStepTable;
-    raft_state: import("../db/types.js").RaftStateTable;
-    secret_audit_log: import("../db/types.js").SecretAuditLogTable;
-    scoped_secrets: import("../db/types.js").ScopedSecretsTable;
-    environment_bindings: import("../db/types.js").EnvironmentBindingsTable;
-    environment_variables: import("../db/types.js").EnvironmentVariablesTable;
-    environment_source_overrides: import("../db/types.js").EnvironmentSourceOverridesTable;
-    held_runs: import("../db/types.js").HeldRunsTable;
-    held_run_approvals: import("../db/types.js").HeldRunApprovalsTable;
-    admin_tokens: import("../db/types.js").AdminTokenTable;
-    agent_tokens: import("../db/types.js").AgentTokenTable;
-    config_versions: import("../db/types.js").ConfigVersionTable;
-    kici_events: import("../db/types.js").KiciEventTable;
     generic_webhook_sources: import("../db/types.js").GenericWebhookSourceTable;
-    cross_repo_trust: import("../db/types.js").CrossRepoTrustTable;
-    test_uploads: import("../db/types.js").TestUploadsTable;
-    workflow_registrations: import("../db/types.js").WorkflowRegistrationsTable;
-    registry_versions: import("../db/types.js").RegistryVersionsTable;
-    cron_last_fired: import("../db/types.js").CronLastFiredTable;
-    run_ephemeral_keys: import("../db/types.js").RunEphemeralKeysTable;
-    run_secret_outputs: import("../db/types.js").RunSecretOutputsTable;
-    concurrency_groups: import("../db/types.js").ConcurrencyGroupsTable;
-    sources: import("../db/types.js").SourcesTable;
+    held_run_approvals: import("../db/types.js").HeldRunApprovalsTable;
+    held_runs: import("../db/types.js").HeldRunsTable;
+    host_roster: import("../db/types.js").HostRosterTable;
+    ingest_overflow_buffer: import("../db/types.js").IngestOverflowBufferTable;
+    ip_allocations: import("../db/types.js").IpAllocationTable;
     join_tokens: import("../db/types.js").JoinTokenTable;
+    kici_events: import("../db/types.js").KiciEventTable;
+    orchestrator_signing_keys: import("../db/types.js").OrchestratorSigningKeysTable;
     org_settings: import("../db/types.js").OrgSettingsTable;
-    execution_job_needs: import("../db/types.js").ExecutionJobNeedsTable;
+    org_trust_policy: import("../db/types.js").OrgTrustPolicyTable;
+    pending_attestations: import("../db/types.js").PendingAttestationsTable;
     pending_job_contexts: import("../db/types.js").PendingJobContextsTable;
     pending_workflow_contexts: import("../db/types.js").PendingWorkflowContextsTable;
-    event_log: import("../db/types.js").EventLogTable;
-    access_log: import("../db/types.js").AccessLogTable;
-    cold_store_chunk_counts: import("../db/types.js").ColdStoreChunkCountsTable;
-    cold_store_chunks: import("../db/types.js").ColdStoreChunksTable;
-    check_run_tracking: import("../db/types.js").CheckRunTrackingTable;
-    scaler_spawning_agents: import("../db/types.js").ScalerSpawningAgentsTable;
+    raft_state: import("../db/types.js").RaftStateTable;
+    registry_versions: import("../db/types.js").RegistryVersionsTable;
+    remote_sources: import("../db/types.js").RemoteSourcesTable;
+    request_idempotency: import("../db/types.js").RequestIdempotencyTable;
+    run_ephemeral_keys: import("../db/types.js").RunEphemeralKeysTable;
+    run_secret_outputs: import("../db/types.js").RunSecretOutputsTable;
     scaler_agent_jobs: import("../db/types.js").ScalerAgentJobsTable;
     scaler_reservations: import("../db/types.js").ScalerReservationsTable;
-    attestations: import("../db/types.js").AttestationsTable;
-    pending_attestations: import("../db/types.js").PendingAttestationsTable;
-    remote_sources: import("../db/types.js").RemoteSourcesTable;
-}, "execution_runs" | "execution_jobs" | "pending_attestations", {}>;
+    scaler_spawning_agents: import("../db/types.js").ScalerSpawningAgentsTable;
+    scoped_secrets: import("../db/types.js").ScopedSecretsTable;
+    secret_audit_log: import("../db/types.js").SecretAuditLogTable;
+    sources: import("../db/types.js").SourcesTable;
+    test_uploads: import("../db/types.js").TestUploadsTable;
+    workflow_registrations: import("../db/types.js").WorkflowRegistrationsTable;
+}, "execution_jobs" | "execution_runs" | "pending_attestations", {}>;
 /**
  * Apply org-wide attestation filters to the base query. Digest is exact-match;
  * name is an ILIKE substring; status / repository / workflow / job are equality;

package/dist/dashboard/handler.d.ts

@@ -13,15 +13,23 @@
  */
 import { type Kysely } from 'kysely';
 import { type ColdStore } from '@kici-dev/shared';
-import type { DashboardRunDetailRequest, DashboardRunsListRequest, DashboardRunsListResponse, DashboardRunsFiltersRequest, DashboardRunsFiltersResponse, DashboardSourcesListRequest, DashboardSourcesListResponse, DashboardStepLogsRequest, DashboardAttestationsListRequest, DashboardAttestationsListAllRequest, DashboardAttestationGetRequest, DashboardAttestationRetryRequest, DashboardPayloadRequest, DashboardOrchLogsRequest, DashboardEventLogListRequest, DashboardEventLogDetailRequest, DashboardEventLogPayloadStreamRequest, DashboardAccessLogListRequest, DashboardEventDlqListRequest, DashboardEventDlqCountRequest, DashboardEventDlqRetryRequest, DashboardEventDlqDiscardRequest, RunRerunRequest, RunCancelRequest, ManualScheduleRequest, DashboardRunStructuredRequest } from '@kici-dev/engine';
+import type { DashboardRunDetailRequest, DashboardRunsListRequest, DashboardRunsListResponse, DashboardRunsFiltersRequest, DashboardRunsFiltersResponse, DashboardSourcesListRequest, DashboardSourcesListResponse, DashboardStepLogsRequest, DashboardAttestationsListRequest, DashboardAttestationsListAllRequest, DashboardAttestationGetRequest, DashboardAttestationRetryRequest, DashboardPayloadRequest, DashboardOrchLogsRequest, DashboardEventLogListRequest, DashboardEventLogActivityRequest, DashboardEventLogDetailRequest, DashboardEventLogPayloadStreamRequest, DashboardAccessLogListRequest, DashboardEventDlqListRequest, DashboardEventDlqCountRequest, DashboardEventDlqRetryRequest, DashboardEventDlqDiscardRequest, RunRerunRequest, RunCancelRequest, ManualScheduleRequest, DashboardRunStructuredRequest, DashboardArtifactsListRequest } from '@kici-dev/engine';
 import type { Database } from '../db/types.js';
 import type { LogStorage } from '../reporting/log-storage.js';
 import type { CacheStorage } from '../storage/types.js';
+import type { ArtifactStore } from '../artifacts/artifact-store.js';
 import type { AccessLogWriter } from '../audit/access-log.js';
 import type { EventStore } from '../events/event-store.js';
 interface DashboardHandlerDeps {
     db: Kysely<Database>;
     logStorage: LogStorage;
+    /**
+     * The orchestrator's own provenance issuer (`KICI_ORCHESTRATOR_PROVENANCE_ISSUER`)
+     * when it owns signing. Surfaced on attestations-list responses so the Platform
+     * returns it as `trustedIssuer` — the dashboard / CLI verify against the
+     * orchestrator that actually signed the bundles, not the Platform's own issuer.
+     */
+    provenanceSigningIssuer?: string | null;
     /**
      * Object-storage backend for provenance bundles. The attestations handler
      * reads each stored bundle by `storage_key` and inlines it into the response
@@ -31,6 +39,13 @@ interface DashboardHandlerDeps {
      * (the same one P1.5 writes bundles to).
      */
     provenanceStorage?: CacheStorage | null;
+    /**
+     * User-facing artifacts layer. Backs `dashboard.artifacts.list` — lists a
+     * run's named artifacts and mints a presigned GET per entry. Optional — when
+     * absent (orchestrator without a DB / cache storage) the handler replies with
+     * an `error` and an empty list.
+     */
+    artifactStore?: ArtifactStore | null;
     /**
      * Drain the deferred-attestation outbox on demand (mints in this process,
      * which owns the Platform WS). Backs `dashboard.attestation.retry`. Optional —
@@ -70,7 +85,14 @@ interface DashboardHandlerDeps {
      * compat with mixed deploys; absent means the orchestrator falls
      * back to the legacy "no PG row → throw" path.
      */
-    onRerun: (runId: string, triggeredBy: string | null, triggeredByAgentLabel: string | null, routingKey?: string) => Promise<{
+    onRerun: (runId: string, triggeredBy: string | null, triggeredByAgentLabel: string | null, 
+    /**
+     * Platform-minted `requestId` for this rerun. Stable across an HA relay
+     * failover re-send, so the orchestrator uses it as an idempotency key: a
+     * re-sent request returns the first coordinator's run instead of minting a
+     * second one.
+     */
+    requestId: string, routingKey?: string) => Promise<{
         newRunId: string;
     }>;
     /**
@@ -80,12 +102,19 @@ interface DashboardHandlerDeps {
      */
     onCancel: (runId: string, cancelledBy: string | null, cancelledByAgentLabel: string | null, force?: boolean) => Promise<{
         cancelledJobs: number;
+        alreadyTerminal?: boolean;
     }>;
     /**
      * Callback for handling manual schedule trigger requests.
      * Returns { newRunId } on success or throws on failure.
      */
-    onManualSchedule: (registrationId: string, triggeredBy: string | null, triggeredByAgentLabel: string | null) => Promise<{
+    onManualSchedule: (registrationId: string, triggeredBy: string | null, triggeredByAgentLabel: string | null, 
+    /**
+     * Platform-minted `requestId` for this manual schedule. Used as an
+     * idempotency key so an HA relay failover re-send returns the first
+     * coordinator's run instead of minting a second one.
+     */
+    requestId: string) => Promise<{
         newRunId: string;
     }>;
     /**
@@ -95,11 +124,23 @@ interface DashboardHandlerDeps {
      * deployments the store is wired by `bootstrapOrchestrator`.
      */
     eventStore?: EventStore | null;
+    /**
+     * **Test-only.** Master switch for fault-injection knobs. When false the
+     * handler ignores every test-only knob below even if it is set.
+     */
+    testMode?: boolean;
+    /**
+     * **Test-only.** When set (and `testMode` is true), `handleRerunRequest`
+     * sleeps this many ms before invoking `onRerun`, so an HA E2E can force a
+     * slow first coordinator and trigger a relay failover. Ignored in production.
+     */
+    testRerunDelayMs?: number;
 }
 export declare class DashboardHandler {
     private readonly db;
     private readonly logStorage;
     private readonly provenanceStorage;
+    private readonly artifactStore;
     private readonly send;
     private readonly orchestratorId;
     private readonly accessLog;
@@ -111,6 +152,9 @@ export declare class DashboardHandler {
     private readonly coldStore;
     private readonly eventStore;
     private readonly retryAttestations;
+    private readonly provenanceSigningIssuer;
+    private readonly testMode;
+    private readonly testRerunDelayMs;
     constructor(deps: DashboardHandlerDeps);
     /**
      * Update the bound orgId + routingKey. Called from server.ts after resolving
@@ -295,6 +339,13 @@ export declare class DashboardHandler {
      * skipped (best-effort) rather than failing the whole list.
      */
     handleAttestationsList(msg: DashboardAttestationsListRequest): Promise<void>;
+    /**
+     * Handle a dashboard.artifacts.list request: list the run's named artifacts
+     * with a presigned GET per entry. Mirrors `handleAttestationsList` (per-run
+     * org resolution + `recordAccess` + `send`). Org is resolved server-side from
+     * the run row, never the wire, so the listing cannot cross tenants.
+     */
+    handleArtifactsList(msg: DashboardArtifactsListRequest): Promise<void>;
     /**
      * Fetch + parse one attestation bundle from object storage. Returns the full
      * detail item, or null when the bundle is missing or not valid JSON (logged).
@@ -366,6 +417,15 @@ export declare class DashboardHandler {
      * deliveryId substring. All optional.
      */
     handleEventLogList(msg: DashboardEventLogListRequest): Promise<void>;
+    /**
+     * Handle a dashboard.event-log.activity request — windowed aggregate counts
+     * for the org (matched vs unmatched vs lockfile-missing), the
+     * orchestrator-only facts the Platform relay cannot compute (it only sees
+     * "delivered", not whether a trigger matched). Powers the Runs-page misconfig
+     * strip + the `kici runs` hint. Aggregate counts only — no payloads, no repo
+     * identifiers — so the Platform route serves them to all org members.
+     */
+    handleEventLogActivity(msg: DashboardEventLogActivityRequest): Promise<void>;
     /**
      * Handle a dashboard.access-log.list request.
      *

package/dist/db/migration-test-harness.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Test harness for the per-migration real-Postgres suites.
+ *
+ * A test named `NNN_thing.test.ts` documents the schema that migration `NNN`
+ * produces, so it must apply the migration set only as far as `NNN`. Applying
+ * the whole set instead runs the assertions against the schema at the head of
+ * the migration list, where a later migration may already have dropped or
+ * reshaped the column under test — the test then fails, or passes for the wrong
+ * reason. Those suites only execute when `KICI_TEST_ADMIN_DATABASE_URL` is set,
+ * so that rot stays invisible in a normal `pnpm test` run.
+ *
+ * The harness derives the target from the calling test file's own URL, so a
+ * test can neither name the wrong migration nor drift when a file is renamed.
+ * It has no fallback to the whole set: an unknown or no-op target throws.
+ *
+ * Repo/store tests outside `migrations/` (host roster, artifact store, the repo
+ * suites) legitimately want head-of-list schema and use `migrateToLatest()`
+ * directly instead.
+ */
+import type { Kysely } from 'kysely';
+import { type MigrationResultSet } from 'kysely/migration';
+/**
+ * Derive `030_held_runs_env_set_null` from a
+ * `.../migrations/030_held_runs_env_set_null.test.ts` module URL.
+ *
+ * Throws when the caller is not a per-migration test, so a copy-paste into an
+ * unrelated suite fails loudly instead of silently migrating somewhere odd.
+ */
+export declare function migrationNameFromTestUrl(testUrl: string): string;
+/**
+ * Apply migrations `001..NNN` inclusive, where `NNN` is the migration the
+ * calling test file is named after. Pass `import.meta.url` as `testUrl`.
+ *
+ * Returns Kysely's result set so callers keep their own error handling
+ * (`if (error) throw error` / `expect(error).toBeUndefined()`). A target that
+ * does not exist surfaces as `error`; a target that applied nothing, or stopped
+ * somewhere other than itself, throws — neither can silently degrade into
+ * "the whole migration set ran".
+ */
+export declare function migrateToOwnMigration<DB>(db: Kysely<DB>, testUrl: string): Promise<MigrationResultSet>;
+//# sourceMappingURL=migration-test-harness.d.ts.map

package/dist/db/migrations/067_environments_to_contexts.d.ts

@@ -0,0 +1,36 @@
+import { type Kysely } from 'kysely';
+/**
+ * Rename the named-policy object from "environment" to "context" across the
+ * orchestrator schema. Data-preserving rename-in-place (never drop/recreate):
+ *
+ * Tables:
+ *  - `environments`               → `contexts`
+ *  - `environment_bindings`       → `context_bindings`
+ *  - `environment_variables`      → `context_variables`
+ *  - `environment_source_overrides` → `context_source_overrides`
+ *
+ * Columns:
+ *  - `context_bindings.environment_id`         → `context_id`
+ *  - `context_variables.environment_id`        → `context_id`
+ *  - `context_source_overrides.environment_id` → `context_id`
+ *  - `held_runs.environment_id`                → `context_id`
+ *  - `execution_runs.environment`              → `context`
+ *  - `execution_runs.environment_id`           → `context_id`
+ *  - `execution_jobs.environments`             → `contexts`
+ *  - `execution_jobs.skipped_environments`     → `skipped_contexts`
+ *
+ * Index:
+ *  - `idx_execution_runs_environment_id` → `idx_execution_runs_context_id`
+ *
+ * Held-run enum values + defaults: `held_runs.queue_type` /
+ * `held_runs.trigger_source` default `'environment'` → `'context'` and existing
+ * `'environment'` rows are migrated to `'context'` (the `HeldRunQueueType` value
+ * rename).
+ *
+ * Foreign keys and remaining constraints/indexes follow the renamed tables and
+ * columns automatically (Postgres references them by identity, not name), so
+ * only the one hand-named index above needs an explicit rename.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=067_environments_to_contexts.d.ts.map

package/dist/db/migrations/068_request_idempotency.d.ts

@@ -0,0 +1,17 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add the `request_idempotency` claim table: a `request_id`-keyed record that
+ * makes run-minting dashboard requests (`run.rerun.request`,
+ * `run.manual_schedule.request`) idempotent on the Platform `requestId`. HA
+ * coordinator siblings share one orchestrator DB, so when the Platform relay
+ * fails over and re-sends the same request to a sibling, the atomic `INSERT …
+ * ON CONFLICT DO NOTHING` on `request_id` lets exactly one coordinator win —
+ * the loser returns the winner's `new_run_id` instead of minting a second run.
+ * Rows are pruned after 1h (far past the ~10s request budget) by the periodic
+ * cleanup tick.
+ *
+ * Idempotent: guarded on table existence.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=068_request_idempotency.d.ts.map

package/dist/db/migrations/069_reroute_tunables.d.ts

@@ -0,0 +1,21 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add the three reroute-tunable columns to `org_settings` (all nullable):
+ *
+ * - `reroute_spawn_window_ms BIGINT` — how long the coordinator waits after a
+ *   peer ACKs a reroute before treating "accepted but no progress" as a spawn
+ *   failure and re-dispatching. NULL falls back to the cluster default
+ *   (`rerouteSpawnWindowMs`, 90s).
+ * - `reroute_ack_timeout_ms BIGINT` — the reroute `sendAndWaitAck` deadline.
+ *   NULL falls back to `rerouteAckTimeoutMs` (15s).
+ * - `reroute_max_hops INTEGER` — maximum peer hops for a rerouted job. NULL
+ *   falls back to `rerouteMaxHops` (3).
+ *
+ * Operators tune them per-org via `kici-admin org-settings`.
+ *
+ * Idempotent: each column add is guarded on column existence, so a re-run on a
+ * DB that already has a column is a no-op for that column.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=069_reroute_tunables.d.ts.map

package/dist/db/migrations/070_execution_runs_failure_class.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=070_execution_runs_failure_class.d.ts.map

package/dist/db/migrations/071_batch_accumulation.d.ts

@@ -0,0 +1,26 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add the batch-accumulation tables that back the `workflows_failed_batch`
+ * trigger.
+ *
+ * When a `workflow_complete(failed)` event matches a `workflowsFailedBatch`
+ * registration, the orchestrator buffers the failed run into a durable window
+ * instead of dispatching now. The first failure opens the window (`opened_at`);
+ * the Raft-leader-only scanner sweeps windows past `expires_at`, emits one
+ * `__workflows_failed_batch` event carrying the buffered runs, and deletes the
+ * window (cascading its items).
+ *
+ * `batch_accumulation_windows` holds one open window per subscribing workflow —
+ * `UNIQUE(registration_id)` enforces open-once so concurrent failures append to
+ * the same window rather than opening N of them. `routing_key` /
+ * `repo_identifier` are captured at open time so the leader sweep can emit the
+ * batch event without re-reading the registration index.
+ *
+ * `batch_accumulation_items` holds the buffered failed runs, deleted with their
+ * window via `ON DELETE CASCADE`.
+ *
+ * Idempotent: guarded on table existence.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=071_batch_accumulation.d.ts.map

package/dist/db/migrations/072_dispatch_queue_run_id_index.d.ts

@@ -0,0 +1,15 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `idx_dispatch_queue_run_id` on `dispatch_queue (run_id)`.
+ *
+ * `failByRunId`, `cancelByRunId`, and `getDispatchedJobIdsByRunId` all filter
+ * `WHERE run_id = ?`. Without this index every run-failure cascade and cancel
+ * does a full-table scan over the whole dispatch history, each scan holding a
+ * pooled connection longer than necessary. The terminal-row retention sweep
+ * (`pruneTerminalDispatchRows`) also benefits from cheaper row lookup.
+ *
+ * Idempotent: `IF NOT EXISTS` makes a re-run a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=072_dispatch_queue_run_id_index.d.ts.map

package/dist/db/migrations/073_org_settings_ingest_concurrency.d.ts

@@ -0,0 +1,13 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `org_settings.ingest_max_concurrency BIGINT` (nullable).
+ *
+ * Per-org fairness cap for the webhook-ingest admission controller. NULL falls
+ * back to the cluster-wide default (`KICI_INGEST_ORG_MAX_CONCURRENCY`, default
+ * 32). Operators tune it per tenant via `kici-admin org-settings`.
+ *
+ * Idempotent: a re-run on a DB that already has the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=073_org_settings_ingest_concurrency.d.ts.map

package/dist/db/migrations/074_normalize_zero_concurrency_limit.d.ts

@@ -0,0 +1,13 @@
+import { type Kysely } from 'kysely';
+/**
+ * Normalize degenerate context concurrency limits. A `concurrency_limit` of 0
+ * (or any non-positive value) is meaningless — it wedged the workflow-install
+ * gate into an unreleasable concurrency hold. The write boundary now rejects it
+ * and the gate treats it as unlimited; this migration cleans up any pre-existing
+ * rows so the column only ever holds NULL (unlimited) or a positive integer.
+ * Idempotent; down() is a no-op (a normalized 0 cannot — and should not — be
+ * restored).
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(_db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=074_normalize_zero_concurrency_limit.d.ts.map

package/dist/db/migrations/075_ingest_overflow_buffer.d.ts

@@ -0,0 +1,16 @@
+import { type Kysely } from 'kysely';
+/**
+ * Durable overflow buffer for shed webhook-ingest deliveries.
+ *
+ * When the ingest admission controller sheds a delivery (429 / shed_retry_later),
+ * the ingest path additively persists it here. A background replayer re-injects
+ * the oldest `buffered` rows through normal ingest once capacity recovers.
+ *
+ * `status` is constrained to the OverflowStatus enum; `source_kind` to
+ * OverflowSourceKind. The `(status, captured_at)` index backs the FIFO drain.
+ *
+ * Idempotent: a re-run on a DB that already has the table is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=075_ingest_overflow_buffer.d.ts.map

package/dist/db/migrations/076_artifacts.d.ts

@@ -0,0 +1,19 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add the `artifacts` table for user-facing build artifacts and the per-org
+ * artifact quota + TTL knobs on `org_settings`.
+ *
+ * When a workflow step calls `ctx.artifacts.upload(name, paths)`, the agent
+ * uploads the packed tarball to object storage under
+ * `artifacts/{run_id}/{name}-{discriminator}.tar.gz` (the discriminator is a
+ * hash of the exact name) and the orchestrator records one row here
+ * so a later job (`ctx.artifacts.download`) and the dashboard can resolve it.
+ * `UNIQUE (run_id, name)` is the immutability constraint — the first upload of a
+ * name within a run wins; a duplicate name fails at the DB layer as a backstop
+ * to the handler's pre-mint duplicate check.
+ *
+ * Idempotent: a re-run on a DB that already has the table / columns is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=076_artifacts.d.ts.map

package/dist/db/migrations/077_backup_runs.d.ts

@@ -0,0 +1,13 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add the `backup_runs` table: one row per successful `kici-admin db backup`,
+ * recording when the orchestrator DB was last dumped plus the metadata needed
+ * to reason about a restore (dump path, size, secret-key generation, server
+ * version, migrations hash, host). The `checkBackupFreshness` diagnostic reads
+ * `MAX(created_at)` here to answer "when did we last back up?" on a live box.
+ *
+ * Idempotent: guarded on table existence.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=077_backup_runs.d.ts.map

package/dist/db/migrations/078_org_settings_backup_staleness.d.ts

@@ -0,0 +1,12 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add the nullable `org_settings.backup_staleness_warn_hours INTEGER` column:
+ * the per-org override for the DB-backup freshness diagnostic's WARN threshold.
+ * NULL falls back to the cluster default (`config.backupStalenessWarnHours`,
+ * 24h). Operators tune it per-org via `kici-admin org-settings backup-freshness`.
+ *
+ * Idempotent: guarded on column existence.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=078_org_settings_backup_staleness.d.ts.map

package/dist/db/migrations/079_org_settings_scaler_spawn_timeout.d.ts

@@ -0,0 +1,14 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `org_settings.scaler_spawn_timeout_ms BIGINT` (nullable).
+ *
+ * Per-org deadline for a single scaler `backend.spawn` (image pull + container
+ * create + start). NULL falls back to the cluster-wide default
+ * (`KICI_SCALER_SPAWN_TIMEOUT_MS`, default 300s). Operators tune it per tenant
+ * via `kici-admin org-settings scaler-spawn-timeout`.
+ *
+ * Idempotent: a re-run on a DB that already has the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=079_org_settings_scaler_spawn_timeout.d.ts.map