@kici-dev/orchestrator 0.1.27 → 0.3.0

package/dist/dashboard/handler.d.ts

@@ -13,15 +13,23 @@
  */
 import { type Kysely } from 'kysely';
 import { type ColdStore } from '@kici-dev/shared';
-import type { DashboardRunDetailRequest, DashboardRunsListRequest, DashboardRunsListResponse, DashboardRunsFiltersRequest, DashboardRunsFiltersResponse, DashboardSourcesListRequest, DashboardSourcesListResponse, DashboardStepLogsRequest, DashboardAttestationsListRequest, DashboardAttestationsListAllRequest, DashboardAttestationGetRequest, DashboardAttestationRetryRequest, DashboardPayloadRequest, DashboardOrchLogsRequest, DashboardEventLogListRequest, DashboardEventLogDetailRequest, DashboardEventLogPayloadStreamRequest, DashboardAccessLogListRequest, DashboardEventDlqListRequest, DashboardEventDlqCountRequest, DashboardEventDlqRetryRequest, DashboardEventDlqDiscardRequest, RunRerunRequest, RunCancelRequest, ManualScheduleRequest, DashboardRunStructuredRequest } from '@kici-dev/engine';
+import type { DashboardRunDetailRequest, DashboardRunsListRequest, DashboardRunsListResponse, DashboardRunsFiltersRequest, DashboardRunsFiltersResponse, DashboardSourcesListRequest, DashboardSourcesListResponse, DashboardStepLogsRequest, DashboardAttestationsListRequest, DashboardAttestationsListAllRequest, DashboardAttestationGetRequest, DashboardAttestationRetryRequest, DashboardPayloadRequest, DashboardOrchLogsRequest, DashboardEventLogListRequest, DashboardEventLogActivityRequest, DashboardEventLogDetailRequest, DashboardEventLogPayloadStreamRequest, DashboardAccessLogListRequest, DashboardEventDlqListRequest, DashboardEventDlqCountRequest, DashboardEventDlqRetryRequest, DashboardEventDlqDiscardRequest, RunRerunRequest, RunCancelRequest, ManualScheduleRequest, DashboardRunStructuredRequest, DashboardArtifactsListRequest } from '@kici-dev/engine';
 import type { Database } from '../db/types.js';
 import type { LogStorage } from '../reporting/log-storage.js';
 import type { CacheStorage } from '../storage/types.js';
+import type { ArtifactStore } from '../artifacts/artifact-store.js';
 import type { AccessLogWriter } from '../audit/access-log.js';
 import type { EventStore } from '../events/event-store.js';
 interface DashboardHandlerDeps {
     db: Kysely<Database>;
     logStorage: LogStorage;
+    /**
+     * The orchestrator's own provenance issuer (`KICI_ORCHESTRATOR_PROVENANCE_ISSUER`)
+     * when it owns signing. Surfaced on attestations-list responses so the Platform
+     * returns it as `trustedIssuer` — the dashboard / CLI verify against the
+     * orchestrator that actually signed the bundles, not the Platform's own issuer.
+     */
+    provenanceSigningIssuer?: string | null;
     /**
      * Object-storage backend for provenance bundles. The attestations handler
      * reads each stored bundle by `storage_key` and inlines it into the response
@@ -31,6 +39,13 @@ interface DashboardHandlerDeps {
      * (the same one P1.5 writes bundles to).
      */
     provenanceStorage?: CacheStorage | null;
+    /**
+     * User-facing artifacts layer. Backs `dashboard.artifacts.list` — lists a
+     * run's named artifacts and mints a presigned GET per entry. Optional — when
+     * absent (orchestrator without a DB / cache storage) the handler replies with
+     * an `error` and an empty list.
+     */
+    artifactStore?: ArtifactStore | null;
     /**
      * Drain the deferred-attestation outbox on demand (mints in this process,
      * which owns the Platform WS). Backs `dashboard.attestation.retry`. Optional —
@@ -87,6 +102,7 @@ interface DashboardHandlerDeps {
      */
     onCancel: (runId: string, cancelledBy: string | null, cancelledByAgentLabel: string | null, force?: boolean) => Promise<{
         cancelledJobs: number;
+        alreadyTerminal?: boolean;
     }>;
     /**
      * Callback for handling manual schedule trigger requests.
@@ -124,6 +140,7 @@ export declare class DashboardHandler {
     private readonly db;
     private readonly logStorage;
     private readonly provenanceStorage;
+    private readonly artifactStore;
     private readonly send;
     private readonly orchestratorId;
     private readonly accessLog;
@@ -135,6 +152,7 @@ export declare class DashboardHandler {
     private readonly coldStore;
     private readonly eventStore;
     private readonly retryAttestations;
+    private readonly provenanceSigningIssuer;
     private readonly testMode;
     private readonly testRerunDelayMs;
     constructor(deps: DashboardHandlerDeps);
@@ -321,6 +339,13 @@ export declare class DashboardHandler {
      * skipped (best-effort) rather than failing the whole list.
      */
     handleAttestationsList(msg: DashboardAttestationsListRequest): Promise<void>;
+    /**
+     * Handle a dashboard.artifacts.list request: list the run's named artifacts
+     * with a presigned GET per entry. Mirrors `handleAttestationsList` (per-run
+     * org resolution + `recordAccess` + `send`). Org is resolved server-side from
+     * the run row, never the wire, so the listing cannot cross tenants.
+     */
+    handleArtifactsList(msg: DashboardArtifactsListRequest): Promise<void>;
     /**
      * Fetch + parse one attestation bundle from object storage. Returns the full
      * detail item, or null when the bundle is missing or not valid JSON (logged).
@@ -392,6 +417,15 @@ export declare class DashboardHandler {
      * deliveryId substring. All optional.
      */
     handleEventLogList(msg: DashboardEventLogListRequest): Promise<void>;
+    /**
+     * Handle a dashboard.event-log.activity request — windowed aggregate counts
+     * for the org (matched vs unmatched vs lockfile-missing), the
+     * orchestrator-only facts the Platform relay cannot compute (it only sees
+     * "delivered", not whether a trigger matched). Powers the Runs-page misconfig
+     * strip + the `kici runs` hint. Aggregate counts only — no payloads, no repo
+     * identifiers — so the Platform route serves them to all org members.
+     */
+    handleEventLogActivity(msg: DashboardEventLogActivityRequest): Promise<void>;
     /**
      * Handle a dashboard.access-log.list request.
      *

package/dist/db/migration-test-harness.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Test harness for the per-migration real-Postgres suites.
+ *
+ * A test named `NNN_thing.test.ts` documents the schema that migration `NNN`
+ * produces, so it must apply the migration set only as far as `NNN`. Applying
+ * the whole set instead runs the assertions against the schema at the head of
+ * the migration list, where a later migration may already have dropped or
+ * reshaped the column under test — the test then fails, or passes for the wrong
+ * reason. Those suites only execute when `KICI_TEST_ADMIN_DATABASE_URL` is set,
+ * so that rot stays invisible in a normal `pnpm test` run.
+ *
+ * The harness derives the target from the calling test file's own URL, so a
+ * test can neither name the wrong migration nor drift when a file is renamed.
+ * It has no fallback to the whole set: an unknown or no-op target throws.
+ *
+ * Repo/store tests outside `migrations/` (host roster, artifact store, the repo
+ * suites) legitimately want head-of-list schema and use `migrateToLatest()`
+ * directly instead.
+ */
+import type { Kysely } from 'kysely';
+import { type MigrationResultSet } from 'kysely/migration';
+/**
+ * Derive `030_held_runs_env_set_null` from a
+ * `.../migrations/030_held_runs_env_set_null.test.ts` module URL.
+ *
+ * Throws when the caller is not a per-migration test, so a copy-paste into an
+ * unrelated suite fails loudly instead of silently migrating somewhere odd.
+ */
+export declare function migrationNameFromTestUrl(testUrl: string): string;
+/**
+ * Apply migrations `001..NNN` inclusive, where `NNN` is the migration the
+ * calling test file is named after. Pass `import.meta.url` as `testUrl`.
+ *
+ * Returns Kysely's result set so callers keep their own error handling
+ * (`if (error) throw error` / `expect(error).toBeUndefined()`). A target that
+ * does not exist surfaces as `error`; a target that applied nothing, or stopped
+ * somewhere other than itself, throws — neither can silently degrade into
+ * "the whole migration set ran".
+ */
+export declare function migrateToOwnMigration<DB>(db: Kysely<DB>, testUrl: string): Promise<MigrationResultSet>;
+//# sourceMappingURL=migration-test-harness.d.ts.map

package/dist/db/migrations/069_reroute_tunables.d.ts

@@ -0,0 +1,21 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add the three reroute-tunable columns to `org_settings` (all nullable):
+ *
+ * - `reroute_spawn_window_ms BIGINT` — how long the coordinator waits after a
+ *   peer ACKs a reroute before treating "accepted but no progress" as a spawn
+ *   failure and re-dispatching. NULL falls back to the cluster default
+ *   (`rerouteSpawnWindowMs`, 90s).
+ * - `reroute_ack_timeout_ms BIGINT` — the reroute `sendAndWaitAck` deadline.
+ *   NULL falls back to `rerouteAckTimeoutMs` (15s).
+ * - `reroute_max_hops INTEGER` — maximum peer hops for a rerouted job. NULL
+ *   falls back to `rerouteMaxHops` (3).
+ *
+ * Operators tune them per-org via `kici-admin org-settings`.
+ *
+ * Idempotent: each column add is guarded on column existence, so a re-run on a
+ * DB that already has a column is a no-op for that column.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=069_reroute_tunables.d.ts.map

package/dist/db/migrations/070_execution_runs_failure_class.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=070_execution_runs_failure_class.d.ts.map

package/dist/db/migrations/071_batch_accumulation.d.ts

@@ -0,0 +1,26 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add the batch-accumulation tables that back the `workflows_failed_batch`
+ * trigger.
+ *
+ * When a `workflow_complete(failed)` event matches a `workflowsFailedBatch`
+ * registration, the orchestrator buffers the failed run into a durable window
+ * instead of dispatching now. The first failure opens the window (`opened_at`);
+ * the Raft-leader-only scanner sweeps windows past `expires_at`, emits one
+ * `__workflows_failed_batch` event carrying the buffered runs, and deletes the
+ * window (cascading its items).
+ *
+ * `batch_accumulation_windows` holds one open window per subscribing workflow —
+ * `UNIQUE(registration_id)` enforces open-once so concurrent failures append to
+ * the same window rather than opening N of them. `routing_key` /
+ * `repo_identifier` are captured at open time so the leader sweep can emit the
+ * batch event without re-reading the registration index.
+ *
+ * `batch_accumulation_items` holds the buffered failed runs, deleted with their
+ * window via `ON DELETE CASCADE`.
+ *
+ * Idempotent: guarded on table existence.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=071_batch_accumulation.d.ts.map

package/dist/db/migrations/072_dispatch_queue_run_id_index.d.ts

@@ -0,0 +1,15 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `idx_dispatch_queue_run_id` on `dispatch_queue (run_id)`.
+ *
+ * `failByRunId`, `cancelByRunId`, and `getDispatchedJobIdsByRunId` all filter
+ * `WHERE run_id = ?`. Without this index every run-failure cascade and cancel
+ * does a full-table scan over the whole dispatch history, each scan holding a
+ * pooled connection longer than necessary. The terminal-row retention sweep
+ * (`pruneTerminalDispatchRows`) also benefits from cheaper row lookup.
+ *
+ * Idempotent: `IF NOT EXISTS` makes a re-run a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=072_dispatch_queue_run_id_index.d.ts.map

package/dist/db/migrations/073_org_settings_ingest_concurrency.d.ts

@@ -0,0 +1,13 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `org_settings.ingest_max_concurrency BIGINT` (nullable).
+ *
+ * Per-org fairness cap for the webhook-ingest admission controller. NULL falls
+ * back to the cluster-wide default (`KICI_INGEST_ORG_MAX_CONCURRENCY`, default
+ * 32). Operators tune it per tenant via `kici-admin org-settings`.
+ *
+ * Idempotent: a re-run on a DB that already has the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=073_org_settings_ingest_concurrency.d.ts.map

package/dist/db/migrations/074_normalize_zero_concurrency_limit.d.ts

@@ -0,0 +1,13 @@
+import { type Kysely } from 'kysely';
+/**
+ * Normalize degenerate context concurrency limits. A `concurrency_limit` of 0
+ * (or any non-positive value) is meaningless — it wedged the workflow-install
+ * gate into an unreleasable concurrency hold. The write boundary now rejects it
+ * and the gate treats it as unlimited; this migration cleans up any pre-existing
+ * rows so the column only ever holds NULL (unlimited) or a positive integer.
+ * Idempotent; down() is a no-op (a normalized 0 cannot — and should not — be
+ * restored).
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(_db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=074_normalize_zero_concurrency_limit.d.ts.map

package/dist/db/migrations/075_ingest_overflow_buffer.d.ts

@@ -0,0 +1,16 @@
+import { type Kysely } from 'kysely';
+/**
+ * Durable overflow buffer for shed webhook-ingest deliveries.
+ *
+ * When the ingest admission controller sheds a delivery (429 / shed_retry_later),
+ * the ingest path additively persists it here. A background replayer re-injects
+ * the oldest `buffered` rows through normal ingest once capacity recovers.
+ *
+ * `status` is constrained to the OverflowStatus enum; `source_kind` to
+ * OverflowSourceKind. The `(status, captured_at)` index backs the FIFO drain.
+ *
+ * Idempotent: a re-run on a DB that already has the table is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=075_ingest_overflow_buffer.d.ts.map

package/dist/db/migrations/076_artifacts.d.ts

@@ -0,0 +1,19 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add the `artifacts` table for user-facing build artifacts and the per-org
+ * artifact quota + TTL knobs on `org_settings`.
+ *
+ * When a workflow step calls `ctx.artifacts.upload(name, paths)`, the agent
+ * uploads the packed tarball to object storage under
+ * `artifacts/{run_id}/{name}-{discriminator}.tar.gz` (the discriminator is a
+ * hash of the exact name) and the orchestrator records one row here
+ * so a later job (`ctx.artifacts.download`) and the dashboard can resolve it.
+ * `UNIQUE (run_id, name)` is the immutability constraint — the first upload of a
+ * name within a run wins; a duplicate name fails at the DB layer as a backstop
+ * to the handler's pre-mint duplicate check.
+ *
+ * Idempotent: a re-run on a DB that already has the table / columns is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=076_artifacts.d.ts.map

package/dist/db/migrations/077_backup_runs.d.ts

@@ -0,0 +1,13 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add the `backup_runs` table: one row per successful `kici-admin db backup`,
+ * recording when the orchestrator DB was last dumped plus the metadata needed
+ * to reason about a restore (dump path, size, secret-key generation, server
+ * version, migrations hash, host). The `checkBackupFreshness` diagnostic reads
+ * `MAX(created_at)` here to answer "when did we last back up?" on a live box.
+ *
+ * Idempotent: guarded on table existence.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=077_backup_runs.d.ts.map

package/dist/db/migrations/078_org_settings_backup_staleness.d.ts

@@ -0,0 +1,12 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add the nullable `org_settings.backup_staleness_warn_hours INTEGER` column:
+ * the per-org override for the DB-backup freshness diagnostic's WARN threshold.
+ * NULL falls back to the cluster default (`config.backupStalenessWarnHours`,
+ * 24h). Operators tune it per-org via `kici-admin org-settings backup-freshness`.
+ *
+ * Idempotent: guarded on column existence.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=078_org_settings_backup_staleness.d.ts.map

package/dist/db/migrations/079_org_settings_scaler_spawn_timeout.d.ts

@@ -0,0 +1,14 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `org_settings.scaler_spawn_timeout_ms BIGINT` (nullable).
+ *
+ * Per-org deadline for a single scaler `backend.spawn` (image pull + container
+ * create + start). NULL falls back to the cluster-wide default
+ * (`KICI_SCALER_SPAWN_TIMEOUT_MS`, default 300s). Operators tune it per tenant
+ * via `kici-admin org-settings scaler-spawn-timeout`.
+ *
+ * Idempotent: a re-run on a DB that already has the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=079_org_settings_scaler_spawn_timeout.d.ts.map

package/dist/db/migrations/080_cluster_settings.d.ts

@@ -0,0 +1,17 @@
+import { type Kysely } from 'kysely';
+/**
+ * Create `cluster_settings`: a single-row (id='default') table of fleet-wide
+ * operator tunables. Each knob column is nullable; NULL = "use the cluster
+ * default from config.ts". Distinct from org_settings (per customer_id) — these
+ * knobs have no per-tenant meaning (process-global singletons, ingest before
+ * org resolution, per-agent-instance, leader-only sweepers), so they live on a
+ * dedicated cluster-global table rather than a magic customer_id row.
+ *
+ * Read via ClusterSettingsReader (whole-row, short-TTL cache); written via the
+ * `/api/v1/admin/cluster-settings` route and `kici-admin cluster-settings` CLI.
+ *
+ * Idempotent: a re-run on a DB that already has the table is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=080_cluster_settings.d.ts.map

package/dist/db/migrations/081_org_settings_queue_timeout.d.ts

@@ -0,0 +1,19 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `org_settings.queue_timeout_ms BIGINT` (nullable).
+ *
+ * Per-org dispatch-queue job timeout. A queued job's deadline is
+ * `job.timeoutMs ?? <per-org queue_timeout_ms> ?? config.queueTimeoutMs`.
+ * NULL falls back to the cluster-wide default (`KICI_QUEUE_TIMEOUT_MS`,
+ * default 1h). Operators tune it per tenant via
+ * `kici-admin org-settings queue-timeout`.
+ *
+ * This is the one genuinely per-job tunable from the tunables audit — the
+ * read site (`JobQueue.enqueue`) has the job's `cacheOrgId` in scope. The
+ * fleet-wide tunables live on `cluster_settings` (migration 080) instead.
+ *
+ * Idempotent: a re-run on a DB that already has the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=081_org_settings_queue_timeout.d.ts.map

package/dist/db/migrations/082_host_s3_reachable.d.ts

@@ -0,0 +1,16 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `host_roster.s3_reachable BOOLEAN` (nullable).
+ *
+ * Per-host delivery hint for fresh-box bring-up: when true, the box can reach
+ * the orchestrator's object storage, so the bring-up handler picks the
+ * `s3-direct` delivery mode (the box pulls the payload via a presigned URL
+ * itself, no 50 MB through the ops agent). NULL / false ⇒ the conservative
+ * `ssh-push` fallback (the ops agent fetches the payload and streams it to the
+ * box over scp). Declared via `kici-admin host declare --s3-reachable`.
+ *
+ * Idempotent: a re-run on a DB that already has the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=082_host_s3_reachable.d.ts.map

package/dist/db/migrations/083_org_settings_artifact_caps.d.ts

@@ -0,0 +1,18 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `org_settings.artifact_max_bytes` + `artifact_max_per_run` (both nullable
+ * BIGINT).
+ *
+ * Per-org overrides of the per-artifact size cap and per-run artifact count cap
+ * for user-facing artifacts (ctx.artifacts). NULL falls back to the cluster-wide
+ * default (`config.artifactMaxBytes` / `config.artifactMaxPerRun`,
+ * `KICI_ARTIFACT_MAX_BYTES` / `KICI_ARTIFACT_MAX_PER_RUN`). Operators tune them
+ * per tenant via `kici-admin org-settings artifacts set-max-bytes` /
+ * `set-max-per-run`.
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has a
+ * column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=083_org_settings_artifact_caps.d.ts.map

package/dist/db/migrations/084_orchestrator_signing_keys.d.ts

@@ -0,0 +1,20 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add the `orchestrator_signing_keys` table: the cluster-scoped, long-lived
+ * ES256 provenance signing keys the orchestrator uses to sign its own build
+ * attestations. One `active` key signs; rotated-out keys go `retiring` then
+ * `retired` (still served in the JWKS so historical attestations keep
+ * verifying); `revoked` keys are removed from the trust root.
+ *
+ * `public_jwk` is the non-secret public half served at `/.well-known/jwks.json`.
+ * `encrypted_private_jwk` holds the AES-256-GCM-wrapped private JWK for `db`
+ * custody (wrapped with the orchestrator's `KICI_SECRET_KEY` master key, same
+ * posture as `scoped_secrets`) and is NULL for `aws-kms` / `command` custody
+ * where the private key never lives in the DB. `key_ref` locates the external
+ * key (KMS ARN / signer command) for non-`db` custody.
+ *
+ * Idempotent: guarded on table existence.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=084_orchestrator_signing_keys.d.ts.map

package/dist/db/migrations/085_cluster_settings_reroute_flap_grace_ms.d.ts

@@ -0,0 +1,12 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.reroute_flap_grace_ms` (nullable BIGINT).
+ *
+ * Fleet-wide grace window (ms) during which a rerouted job stays deferred from the recovery sweepers while its worker peer momentarily flaps. NULL → cluster default (`config.rerouteFlapGraceMs`, `KICI_REROUTE_FLAP_GRACE_MS`).
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has
+ * the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=085_cluster_settings_reroute_flap_grace_ms.d.ts.map

package/dist/db/migrations/086_cluster_settings_max_fanout_hosts.d.ts

@@ -0,0 +1,12 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.max_fanout_hosts` (nullable INTEGER).
+ *
+ * Fleet-wide cap on `runsOnAll` per-host fan-out children. NULL → cluster default (`config.maxFanoutHosts`, `KICI_MAX_FANOUT_HOSTS`).
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has
+ * the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=086_cluster_settings_max_fanout_hosts.d.ts.map

package/dist/db/migrations/087_cluster_settings_event_router_rate_limit.d.ts

@@ -0,0 +1,12 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.event_router_rate_limit_per_workflow_per_minute` (nullable INTEGER).
+ *
+ * Fleet-wide per-(source routing key + event) sliding-window rate limit (events/minute) for the event router. NULL → cluster default (`config.eventRouterRateLimitPerWorkflowPerMinute`, `KICI_EVENT_ROUTER_RATE_LIMIT_PER_WORKFLOW_PER_MINUTE`).
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has
+ * the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=087_cluster_settings_event_router_rate_limit.d.ts.map

package/dist/db/migrations/088_cluster_settings_cache_max_tarball_bytes.d.ts

@@ -0,0 +1,12 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.cache_max_tarball_bytes` (nullable BIGINT).
+ *
+ * Fleet-wide maximum dependency-cache tarball size (bytes); a larger store is rejected. NULL → cluster default (`config.cacheMaxTarballBytes`, `KICI_CACHE_MAX_TARBALL_BYTES`).
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has
+ * the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=088_cluster_settings_cache_max_tarball_bytes.d.ts.map

package/dist/db/migrations/089_cluster_settings_cache_ttl_days.d.ts

@@ -0,0 +1,12 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.cache_ttl_days` (nullable INTEGER).
+ *
+ * Fleet-wide dependency-cache entry TTL (days). An entry unread for longer is treated as expired on the next lookup. NULL → cluster default (`config.cacheTtlDays`, `KICI_CACHE_TTL_DAYS`).
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has
+ * the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=089_cluster_settings_cache_ttl_days.d.ts.map

package/dist/db/migrations/090_cluster_settings_concurrency_wait_timeout_ms.d.ts

@@ -0,0 +1,12 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.concurrency_wait_timeout_ms` (nullable BIGINT).
+ *
+ * Fleet-wide agent concurrency-slot wait timeout (ms), pushed to the agent on `job.dispatch`. NULL → cluster default (`config.concurrencyWaitTimeoutMs`, `KICI_CONCURRENCY_WAIT_TIMEOUT_MS`).
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has
+ * the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=090_cluster_settings_concurrency_wait_timeout_ms.d.ts.map

package/dist/db/migrations/091_cluster_settings_agent_token_ttl_ms.d.ts

@@ -0,0 +1,12 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.agent_token_ttl_ms` (nullable BIGINT).
+ *
+ * Fleet-wide ephemeral agent-token TTL (ms), resolved by the leader at spawn. NULL → cluster default (`config.agentTokenTtlMs`, `KICI_AGENT_TOKEN_TTL_MS`).
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has
+ * the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=091_cluster_settings_agent_token_ttl_ms.d.ts.map

package/dist/db/migrations/092_cluster_settings_version.d.ts

@@ -0,0 +1,16 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.version` (monotonic BIGINT, bumped on each settings
+ * change).
+ *
+ * The leader advertises this version on `peer.heartbeat` so DB-less workers can
+ * detect a change and pull the worker-relevant settings snapshot. DB-backed
+ * (not an in-memory counter) so it survives leader failover: a newly-elected
+ * leader continues monotonically from the row's current value.
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has
+ * the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=092_cluster_settings_version.d.ts.map

package/dist/db/migrations/093_org_settings_sandbox_allowlist.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=093_org_settings_sandbox_allowlist.d.ts.map

package/dist/db/migrations/094_dashboard_encryption_keys.d.ts

@@ -0,0 +1,21 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add the `dashboard_encryption_keys` table: the cluster-scoped, long-lived
+ * X25519 keypair the orchestrator owns for browser-sealed dashboard writes.
+ * Under the `encrypted` dashboard-write posture the browser seals a secret /
+ * variable value to the `active` key's public half before it leaves the page,
+ * so the hosted Platform relays only opaque ciphertext.
+ *
+ * Modeled on `orchestrator_signing_keys` (migration 084). `public_jwk` is the
+ * non-secret OKP/X25519 public JWK (`use:'enc'`) served at
+ * `/.well-known/jwks.json`. `encrypted_private_key` holds the AES-256-GCM
+ * master-key-wrapped (KICI_SECRET_KEY) DER private key — db custody only, so it
+ * is NOT NULL. One `active` key seals; a rotated-out key goes `revoked` and
+ * leaves the published JWKS, while its row stays so envelopes already sealed to
+ * it still decrypt.
+ *
+ * Idempotent: guarded on table existence.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=094_dashboard_encryption_keys.d.ts.map

package/dist/db/migrations/095_dashboard_write_policy_tristate.d.ts

@@ -0,0 +1,20 @@
+import { type Kysely } from 'kysely';
+/**
+ * Migrate stored `org_settings.dashboard_write_policy` JSONB from the legacy
+ * boolean shape to the tri-state `permissive | encrypted | disabled` shape:
+ *
+ *   - `false` (disabled)  → `"disabled"`
+ *   - `true`  (permissive) → key dropped (permissive is the absent-key default,
+ *     keeping the JSONB minimal — matches setDashboardWritePolicy normalization)
+ *   - already-string enum values → left untouched (idempotent re-run)
+ *
+ * Runtime reads coerce booleans defensively too (so an un-migrated row is never
+ * mis-read), but this migration normalizes the at-rest shape so the stored JSONB
+ * matches what the tri-state writer produces.
+ *
+ * Pure SQL rewrite: for each row, rebuild the object keeping only non-`true`
+ * entries and mapping `false` → `'disabled'`, leaving existing string values.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(): Promise<void>;
+//# sourceMappingURL=095_dashboard_write_policy_tristate.d.ts.map

package/dist/db/migrations/096_multi_schedule_cron_last_fired.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=096_multi_schedule_cron_last_fired.d.ts.map

package/dist/db/migrations/097_execution_runs_pr_number.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=097_execution_runs_pr_number.d.ts.map

package/dist/db/migrations/098_execution_runs_customer_id.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=098_execution_runs_customer_id.d.ts.map

package/dist/db/migrations/099_cluster_settings_dashboard_verified_issuer.d.ts

@@ -0,0 +1,21 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.dashboard_verified_issuer` (nullable text).
+ *
+ * The verified-tier origin the dashboard fetches the orchestrator's X25519
+ * dashboard-encryption public key from — and always displays next to a secret /
+ * variable entry field — under the `encrypted` dashboard-write posture. Fetching
+ * the key straight from the customer's own origin makes TLS to that domain the
+ * trust root, so an active hosted-control-plane MITM of the key cannot happen.
+ *
+ * Cluster-global (one orchestrator identity, one `.well-known`), not per-tenant,
+ * so it lives on `cluster_settings` rather than `org_settings`. The tier is
+ * explicit opt-in with no environment fallback: NULL ⇒ the verified tier is not
+ * offered and the convenient tier is used.
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has the
+ * column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=099_cluster_settings_dashboard_verified_issuer.d.ts.map