@kici-dev/orchestrator 0.14.2 → 0.16.0

package/dist/cold-store/tables/event-log.d.ts

@@ -7,34 +7,27 @@
  *   - partition column: `received_at`
  *   - warm TTL: 30 days (rows are archived, not hard-deleted)
  *
- * Per-row payload retention: rows on this table carry a `payload_key`
- * pointing at a gzipped webhook body in object storage (LogStorage).
- * Cold-store packages the row metadata — including `payload_key` —
- * but does NOT touch the body the key points to. The body remains in
- * S3 indefinitely so the dashboard delivery-detail page resolves
- * payload reads identically for hot and cold rows. Nothing deletes the
- * row and the payload blob in lock-step.
+ * Each row's `payload_key` points at a gzipped webhook body in object
+ * storage. Archiving moves the row, `payload_key` included, and leaves the
+ * body where it is, so the delivery-detail page reads payloads the same way
+ * for hot and cold rows.
  *
- * Recursive write: archiving event_log rows writes one access_log
- * audit row per chunk (the orchestrator's audit surface). The new
- * access_log rows themselves get archived in a later cycle by the
- * AccessLogAdapter, bounded.
+ * Each archived chunk writes one `access_log` audit row, which the
+ * AccessLogAdapter archives in a later cycle.
  */
 import { type Kysely, type Selectable } from 'kysely';
-import { type ChunkCommitMetadata, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter } from '@kici-dev/shared';
+import { type ChunkCommitMetadata, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter, PgTableAdapterBase } from '@kici-dev/shared';
 import type { Database, EventLogTable } from '../../db/types.js';
 export type EventLogColdStoreRow = Selectable<EventLogTable>;
 export interface EventLogAdapterOptions {
     overrides?: Partial<ColdStoreTableConfig>;
 }
-export declare class EventLogAdapter implements TableAdapter<EventLogColdStoreRow> {
-    private readonly kdb;
+export declare class EventLogAdapter extends PgTableAdapterBase<Database> implements TableAdapter<EventLogColdStoreRow> {
     private readonly instanceId;
     readonly db: 'orchestrator';
     readonly table = "event_log";
     readonly tenantColumn = "routing_key";
     readonly partitionColumn = "received_at";
-    readonly config: ColdStoreTableConfig;
     constructor(kdb: Kysely<Database>, instanceId: string, opts?: EventLogAdapterOptions);
     listEligiblePartitions(args: {
         warmCutoff: Date;
@@ -43,10 +36,6 @@ export declare class EventLogAdapter implements TableAdapter<EventLogColdStoreRo
         tenantId: string;
         warmCutoff: Date;
     }): Promise<number>;
-    withPartitionLock<T>(args: {
-        tenantId: string;
-        partitionDate: string;
-    }, fn: () => Promise<T>): Promise<T | null>;
     selectEligible(args: {
         tenantId: string;
         partitionDate: string;

package/dist/cold-store/tables/execution-jobs.d.ts

@@ -1,39 +1,26 @@
 /**
  * `execution_jobs` cold-store adapter (Orchestrator side).
  *
+ * Tenant column `routing_key`, partition column `created_at`, warm TTL 30
+ * days. Eligible: a terminal job with no live step rows for its (run, job).
  *
- * Contract:
- *   - tenant column: `routing_key` (denormalized in migration 006)
- *   - partition column: `created_at`
- *   - warm TTL: 30 days
- *   - eligibility: terminal job status AND no live steps remain for this
- *     (run, job)
- *
- * Order: registered AFTER `ExecutionStepsAdapter`, BEFORE
- * `ExecutionRunsAdapter` (within one cycle: steps → jobs → runs). The
- * "no live steps" predicate makes the ordering self-correcting across
- * cycle interruptions.
- *
- * FK ordering on the orchestrator side: `execution_jobs.run_id` is a
- * FK to `execution_runs(run_id)`. Deleting a job is safe from the FK's
- * perspective (the FK only constrains job → run direction). The runs
- * adapter's eligibility predicate handles the dependent-rows check.
+ * Registered between the steps and runs adapters (steps → jobs → runs).
+ * Deleting a job never trips the `execution_jobs.run_id → execution_runs`
+ * FK; the runs adapter skips runs that still have jobs.
  */
 import { type Kysely, type Selectable } from 'kysely';
-import { type ChunkCommitMetadata, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter } from '@kici-dev/shared';
+import { type ChunkCommitMetadata, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter, PgTableAdapterBase } from '@kici-dev/shared';
 import type { Database, ExecutionJobTable } from '../../db/types.js';
 export type ExecutionJobRow = Selectable<ExecutionJobTable>;
 export interface ExecutionJobsAdapterOptions {
     overrides?: Partial<ColdStoreTableConfig>;
 }
-export declare class ExecutionJobsAdapter implements TableAdapter<ExecutionJobRow> {
-    private readonly kdb;
+export declare class ExecutionJobsAdapter extends PgTableAdapterBase<Database> implements TableAdapter<ExecutionJobRow> {
     private readonly instanceId;
     readonly db: 'orchestrator';
     readonly table = "execution_jobs";
     readonly tenantColumn = "routing_key";
     readonly partitionColumn = "created_at";
-    readonly config: ColdStoreTableConfig;
     constructor(kdb: Kysely<Database>, instanceId: string, opts?: ExecutionJobsAdapterOptions);
     listEligiblePartitions(args: {
         warmCutoff: Date;
@@ -42,10 +29,6 @@ export declare class ExecutionJobsAdapter implements TableAdapter<ExecutionJobRo
         tenantId: string;
         warmCutoff: Date;
     }): Promise<number>;
-    withPartitionLock<T>(args: {
-        tenantId: string;
-        partitionDate: string;
-    }, fn: () => Promise<T>): Promise<T | null>;
     selectEligible(args: {
         tenantId: string;
         partitionDate: string;

package/dist/cold-store/tables/execution-runs.d.ts

@@ -1,34 +1,24 @@
 /**
  * `execution_runs` cold-store adapter (Orchestrator side).
  *
- *
- * Contract:
- *   - tenant column: `routing_key`
- *   - partition column: `created_at`
- *   - warm TTL: 30 days
- *   - eligibility: terminal run status AND no live jobs reference this run
- *
- * Order: registered LAST in the orchestrator cold-store. Within one
- * cycle the framework iterates adapters steps → jobs → runs; this
- * adapter goes last so the FK `execution_jobs.run_id →
- * execution_runs(run_id)` doesn't fire on DELETE. The "no live jobs"
- * predicate enforces the same invariant across cycle interruptions.
+ * Tenant column `routing_key`, partition column `created_at`, warm TTL 30
+ * days. Eligible: a terminal run that no live job references. Registered
+ * last (steps → jobs → runs) so the `execution_jobs.run_id` FK never fires
+ * on DELETE.
  */
 import { type Kysely, type Selectable } from 'kysely';
-import { type ChunkCommitMetadata, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter } from '@kici-dev/shared';
+import { type ChunkCommitMetadata, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter, PgTableAdapterBase } from '@kici-dev/shared';
 import type { Database, ExecutionRunTable } from '../../db/types.js';
 export type ExecutionRunRow = Selectable<ExecutionRunTable>;
 export interface ExecutionRunsAdapterOptions {
     overrides?: Partial<ColdStoreTableConfig>;
 }
-export declare class ExecutionRunsAdapter implements TableAdapter<ExecutionRunRow> {
-    private readonly kdb;
+export declare class ExecutionRunsAdapter extends PgTableAdapterBase<Database> implements TableAdapter<ExecutionRunRow> {
     private readonly instanceId;
     readonly db: 'orchestrator';
     readonly table = "execution_runs";
     readonly tenantColumn = "routing_key";
     readonly partitionColumn = "created_at";
-    readonly config: ColdStoreTableConfig;
     constructor(kdb: Kysely<Database>, instanceId: string, opts?: ExecutionRunsAdapterOptions);
     listEligiblePartitions(args: {
         warmCutoff: Date;
@@ -37,10 +27,6 @@ export declare class ExecutionRunsAdapter implements TableAdapter<ExecutionRunRo
         tenantId: string;
         warmCutoff: Date;
     }): Promise<number>;
-    withPartitionLock<T>(args: {
-        tenantId: string;
-        partitionDate: string;
-    }, fn: () => Promise<T>): Promise<T | null>;
     selectEligible(args: {
         tenantId: string;
         partitionDate: string;

package/dist/cold-store/tables/execution-steps.d.ts

@@ -1,41 +1,27 @@
 /**
  * `execution_steps` cold-store adapter (Orchestrator side).
  *
+ * Tenant column `routing_key`, partition column `created_at`, warm TTL 30
+ * days. Steps are append-only, so age alone makes a row eligible.
  *
- * Contract:
- *   - tenant column: `routing_key` (denormalized in migration 006)
- *   - partition column: `created_at`
- *   - warm TTL: 30 days
- *   - eligibility: created_at < cutoff (steps are append-only and have no
- *     terminal-status predicate — there is no UPDATE statement against
- *     `execution_steps` in the orchestrator codebase, so age alone is
- *     sufficient)
- *
- * Order: registered FIRST in the orchestrator cold-store. Within one
- * cycle the framework iterates adapters in registration order
- * (steps → jobs → runs); steps go first so the FK chain
- * (execution_jobs.run_id → execution_runs.run_id) doesn't break when
- * jobs and runs are archived later.
- *
- * Audit emission: orchestrator-side adapters write to `access_log`
- * (the orchestrator's audit surface; `audit_log` is Platform-side only).
- * The row uses actor_type='system', actor_id='cold-store-archive:<id>'.
+ * Registered first: the framework archives in registration order (steps →
+ * jobs → runs), which keeps the `execution_jobs.run_id → execution_runs` FK
+ * chain intact. The archive audit row goes to `access_log`, the
+ * orchestrator's audit surface, as actor `cold-store-archive:<instanceId>`.
  */
 import { type Kysely, type Selectable } from 'kysely';
-import { type ChunkCommitMetadata, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter } from '@kici-dev/shared';
+import { type ChunkCommitMetadata, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter, PgTableAdapterBase } from '@kici-dev/shared';
 import type { Database, ExecutionStepTable } from '../../db/types.js';
 export type ExecutionStepRow = Selectable<ExecutionStepTable>;
 export interface ExecutionStepsAdapterOptions {
     overrides?: Partial<ColdStoreTableConfig>;
 }
-export declare class ExecutionStepsAdapter implements TableAdapter<ExecutionStepRow> {
-    private readonly kdb;
+export declare class ExecutionStepsAdapter extends PgTableAdapterBase<Database> implements TableAdapter<ExecutionStepRow> {
     private readonly instanceId;
     readonly db: 'orchestrator';
     readonly table = "execution_steps";
     readonly tenantColumn = "routing_key";
     readonly partitionColumn = "created_at";
-    readonly config: ColdStoreTableConfig;
     constructor(kdb: Kysely<Database>, instanceId: string, opts?: ExecutionStepsAdapterOptions);
     listEligiblePartitions(args: {
         warmCutoff: Date;
@@ -44,10 +30,6 @@ export declare class ExecutionStepsAdapter implements TableAdapter<ExecutionStep
         tenantId: string;
         warmCutoff: Date;
     }): Promise<number>;
-    withPartitionLock<T>(args: {
-        tenantId: string;
-        partitionDate: string;
-    }, fn: () => Promise<T>): Promise<T | null>;
     selectEligible(args: {
         tenantId: string;
         partitionDate: string;

package/dist/cold-store/tables/secret-audit-log.d.ts

@@ -1,12 +1,11 @@
 /**
  * `secret_audit_log` cold-store adapter (Orchestrator side).
  *
- *
  * Contract:
  *   - tenant column: `routing_key` (NULL → synthetic `__orchestrator__`)
  *   - partition column: `timestamp`
- *   - warm TTL: 90 days (longer window than other audit tables — volume is
- *     low, forensic value is high)
+ *   - warm TTL: `minSecretAuditLogWarmDays()` table-wide, tightened per row
+ *     by `secretAuditLogWarmSqlCase()`
  *
  * Synthetic tenant: rows without `routing_key` (e.g. orchestrator-level
  * key rotations done before any source is bound) collapse to a single
@@ -14,21 +13,19 @@
  * used for `event_log` payload keys when the routing key is missing.
  */
 import { type Kysely } from 'kysely';
-import { type ChunkCommitMetadata, type ColdRetention, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter } from '@kici-dev/shared';
+import { type ChunkCommitMetadata, type ColdRetention, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter, PgTableAdapterBase } from '@kici-dev/shared';
 import type { Database, SecretAuditLogRow } from '../../db/types.js';
 /** Re-exported rather than re-declared — see the note in `load-event-log-range`. */
 export type { SecretAuditLogRow };
 export interface SecretAuditLogAdapterOptions {
     overrides?: Partial<ColdStoreTableConfig>;
 }
-export declare class SecretAuditLogAdapter implements TableAdapter<SecretAuditLogRow> {
-    private readonly kdb;
+export declare class SecretAuditLogAdapter extends PgTableAdapterBase<Database> implements TableAdapter<SecretAuditLogRow> {
     private readonly instanceId;
     readonly db: 'orchestrator';
     readonly table = "secret_audit_log";
     readonly tenantColumn = "routing_key";
     readonly partitionColumn = "timestamp";
-    readonly config: ColdStoreTableConfig;
     constructor(kdb: Kysely<Database>, instanceId: string, opts?: SecretAuditLogAdapterOptions);
     listEligiblePartitions(args: {
         warmCutoff: Date;
@@ -37,10 +34,6 @@ export declare class SecretAuditLogAdapter implements TableAdapter<SecretAuditLo
         tenantId: string;
         warmCutoff: Date;
     }): Promise<number>;
-    withPartitionLock<T>(args: {
-        tenantId: string;
-        partitionDate: string;
-    }, fn: () => Promise<T>): Promise<T | null>;
     selectEligible(args: {
         tenantId: string;
         partitionDate: string;

package/dist/config/env-overlay.d.ts

@@ -3,20 +3,15 @@
  *
  * Converts KICI_-prefixed env vars to nested config paths and applies
  * them as overrides on top of a config object.
- *
- * Multi-app env var convention:
- * - App name in YAML: `main-org` -> env segment: `MAIN_ORG` (hyphen to underscore, uppercased)
- * - Example: KICI_PROVIDERS_GITHUB_MAIN_ORG_APP_ID -> providers.github[name=main-org].appId
  */
 /**
  * Convert a KICI_ env var key to a config path array.
  * Returns null for non-KICI_ keys or unknown mappings.
  *
  * Handles three patterns:
- * 1. Direct mappings (KICI_DATABASE_URL -> ['database', 'url'])
- * 2. Startup names whose overlay spelling differs (KICI_PORT -> ['server', 'port'])
- * 3. Multi-app GitHub provider (KICI_PROVIDERS_GITHUB_<NAME>_<FIELD> ->
- *    ['providers', 'github', '<name-lowered>', '<camelField>'])
+ * 1. Unprefixed names the startup loader reads (NODE_ENV -> ['nodeEnv'])
+ * 2. Direct mappings (KICI_DATABASE_URL -> ['database', 'url'])
+ * 3. Startup names whose overlay spelling differs (KICI_PORT -> ['server', 'port'])
  */
 export declare function envKeyToConfigPath(key: string): string[] | null;
 /**

package/dist/config/reload.d.ts

@@ -14,6 +14,7 @@
 import type { Logger } from '@kici-dev/shared';
 import type { AppConfig, SharedConfig } from './types.js';
 import type { SharedConfigStore } from './shared-store.js';
+import type { ScalerFileReloadResult } from '../scaler/file-reload.js';
 /**
  * Source of a reload trigger.
  */
@@ -29,6 +30,12 @@ export interface ReloadResult {
     restartRequired?: string[];
     /** Fields that were hot-reloaded */
     fieldsChanged?: string[];
+    /**
+     * The scaler config's own reload outcome, when this orchestrator runs one.
+     * `success` describes the orchestrator config only: a refused scaler file
+     * shows here as `rejected` while `success` stays true.
+     */
+    scaler?: ScalerFileReloadResult;
 }
 /**
  * Options for executeReload.
@@ -53,8 +60,8 @@ export interface ConfigReloaderDeps {
     sharedStore: SharedConfigStore | null;
     /** Called after successful reload when provider config changed */
     onProviderChange?: (newConfig: AppConfig, oldConfig: AppConfig) => Promise<void>;
-    /** Called to reload scaler configuration */
-    onScalerReload?: () => Promise<void>;
+    /** Called to reload scaler configuration; its outcome is returned as `ReloadResult.scaler`. */
+    onScalerReload?: () => Promise<ScalerFileReloadResult | void>;
     /** Called when Platform connection settings changed */
     onPlatformReconnect?: (newConfig: AppConfig) => Promise<void>;
     /** Atomic swap callback -- replaces the config reference */

package/dist/config/schema.d.ts

@@ -10,6 +10,12 @@
  * and PgSecretStore, not through config schemas.
  */
 import { z } from 'zod';
+/** Whether a coordinator dials the peers the Platform announces. */
+export declare const PeerDiscoveryMode: z.ZodEnum<{
+    platform: "platform";
+    static: "static";
+}>;
+export type PeerDiscoveryMode = z.infer<typeof PeerDiscoveryMode>;
 /**
  * Schema for the local YAML configuration file.
  * All fields optional except database.url.
@@ -103,8 +109,12 @@ export declare const sharedConfigSchema: z.ZodObject<{
             coordinator: "coordinator";
             worker: "worker";
         }>>;
-        coordinatorUrl: z.ZodOptional<z.ZodString>;
+        coordinatorUrls: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodString]>>;
         peerStaleTimeoutMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+        peerDiscovery: z.ZodOptional<z.ZodEnum<{
+            platform: "platform";
+            static: "static";
+        }>>;
     }, z.core.$strip>>;
     webhookPayloadDir: z.ZodOptional<z.ZodString>;
     cacheTtlDays: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
@@ -191,8 +201,12 @@ export declare const appConfigSchema: z.ZodObject<{
             coordinator: "coordinator";
             worker: "worker";
         }>>;
-        coordinatorUrl: z.ZodOptional<z.ZodString>;
+        coordinatorUrls: z.ZodDefault<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodPipe<z.ZodString, z.ZodTransform<string[], string>>]>>;
         peerStaleTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+        peerDiscovery: z.ZodDefault<z.ZodEnum<{
+            platform: "platform";
+            static: "static";
+        }>>;
     }, z.core.$strip>>;
     webhookPayloadDir: z.ZodOptional<z.ZodString>;
     cacheTtlDays: z.ZodDefault<z.ZodCoercedNumber<unknown>>;

package/dist/config/types.d.ts

@@ -7,6 +7,7 @@
  * - AppConfig: merged result type used throughout the codebase
  */
 import type { OrchestratorMode } from '@kici-dev/engine';
+import type { PeerDiscoveryMode } from './schema.js';
 /**
  * Per-orchestrator settings loaded from YAML file.
  * These are instance-specific and never shared across orchestrators.
@@ -85,6 +86,7 @@ export interface SharedConfig {
         raftHeartbeatMs?: number;
         peerHeartbeatIntervalMs?: number;
         peerMaxReconnectDelayMs?: number;
+        peerDiscovery?: PeerDiscoveryMode;
     };
     webhookPayloadDir?: string;
     cacheTtlDays?: number;
@@ -185,10 +187,12 @@ export interface AppConfig {
         peerMaxReconnectDelayMs: number;
         /** Cluster role: coordinator (full orchestrator) or worker (delegated execution). */
         role: 'coordinator' | 'worker';
-        /** URL of the coordinator to connect to when role=worker. */
-        coordinatorUrl?: string;
+        /** URLs of every coordinator to connect to when role=worker. */
+        coordinatorUrls: string[];
         /** Stale peer timeout in ms. */
         peerStaleTimeoutMs: number;
+        /** Whether this coordinator dials Platform-announced peers. */
+        peerDiscovery: PeerDiscoveryMode;
     };
     /** Webhook payload storage directory */
     webhookPayloadDir?: string;

package/dist/config.d.ts

@@ -1,15 +1,9 @@
 /**
- * Orchestrator configuration.
+ * Orchestrator startup configuration, read from `KICI_*` environment variables.
  *
- * This is a thin backward-compatible wrapper around the new config resolution
- * chain (config/resolver.ts). It preserves the existing synchronous loadConfig()
- * API so that no other files need changing.
- *
- * The new config system lives in config/ and supports:
- * - YAML config files (config/loader.ts)
- * - Shared DB config store (config/shared-store.ts)
- * - 4-layer resolution: env > YAML > DB > defaults (config/resolver.ts)
- * - KICI_ env var mapping (config/env-overlay.ts)
+ * The runtime config reloader lives in config/: YAML files (config/loader.ts),
+ * the shared DB config store (config/shared-store.ts), the env overlay
+ * (config/env-overlay.ts) and the resolution chain (config/resolver.ts).
  *
  * Provider configuration (GitHub Apps, etc.) is managed via the `sources` table
  * and PgSecretStore, not through config. See SourceStore and SourceManager.
@@ -122,7 +116,6 @@ declare const configSchema: z.ZodObject<{
         filesystem: "filesystem";
         s3: "s3";
     }>>;
-    cacheStoragePath: z.ZodOptional<z.ZodString>;
     cacheStorageS3Bucket: z.ZodOptional<z.ZodString>;
     cacheStorageS3Prefix: z.ZodDefault<z.ZodString>;
     cacheStorageS3Region: z.ZodOptional<z.ZodString>;
@@ -240,11 +233,14 @@ declare const configSchema: z.ZodObject<{
             coordinator: "coordinator";
             worker: "worker";
         }>>;
-        coordinatorUrl: z.ZodOptional<z.ZodString>;
         coordinatorUrls: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string[], string | undefined>>;
         peerStaleTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
         electionGracePeriodMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
         singleNode: z.ZodPipe<z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>, z.ZodTransform<boolean, string | boolean>>;
+        peerDiscovery: z.ZodDefault<z.ZodEnum<{
+            platform: "platform";
+            static: "static";
+        }>>;
         trustedProxies: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<string[], string>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
@@ -336,7 +332,6 @@ export declare const packagingConfigSchema: z.ZodObject<{
         filesystem: "filesystem";
         s3: "s3";
     }>>;
-    cacheStoragePath: z.ZodOptional<z.ZodString>;
     cacheStorageS3Bucket: z.ZodOptional<z.ZodString>;
     cacheStorageS3Prefix: z.ZodDefault<z.ZodString>;
     cacheStorageS3Region: z.ZodOptional<z.ZodString>;
@@ -454,11 +449,14 @@ export declare const packagingConfigSchema: z.ZodObject<{
             coordinator: "coordinator";
             worker: "worker";
         }>>;
-        coordinatorUrl: z.ZodOptional<z.ZodString>;
         coordinatorUrls: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string[], string | undefined>>;
         peerStaleTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
         electionGracePeriodMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
         singleNode: z.ZodPipe<z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>, z.ZodTransform<boolean, string | boolean>>;
+        peerDiscovery: z.ZodDefault<z.ZodEnum<{
+            platform: "platform";
+            static: "static";
+        }>>;
         trustedProxies: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<string[], string>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
@@ -471,7 +469,7 @@ export declare const packagingConfigSchema: z.ZodObject<{
 export type AppConfig = z.infer<typeof configSchema> & {
     /** Unique identifier for this orchestrator instance, generated at startup */
     instanceId: string;
-    /** Object storage settings (populated from legacy env vars or SharedConfig) */
+    /** Object storage settings (populated from the KICI_STORAGE_* env vars or SharedConfig) */
     storage?: {
         type?: 's3' | 'filesystem';
         bucket?: string;
@@ -577,7 +575,6 @@ export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
     scalerProvisionBackoffMaxMs: number;
     scalerProvisionMaxConsecutiveFailures: number;
     cacheStorageType?: "filesystem" | "s3" | undefined;
-    cacheStoragePath?: string | undefined;
     cacheStorageS3Bucket?: string | undefined;
     cacheStorageS3Prefix: string;
     cacheStorageS3Region?: string | undefined;
@@ -668,14 +665,22 @@ export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
         peerHeartbeatIntervalMs: number;
         peerMaxReconnectDelayMs: number;
         role: "coordinator" | "worker";
-        coordinatorUrl?: string | undefined;
         coordinatorUrls: string[];
         peerStaleTimeoutMs: number;
         electionGracePeriodMs: number;
         singleNode: boolean;
+        peerDiscovery: "platform" | "static";
         trustedProxies: string[];
     };
 }>;
+/**
+ * Load the startup orchestrator configuration from environment variables.
+ *
+ * It reads `process.env` through the names declared in `envDef`
+ * (KICI_DATABASE_URL, KICI_PORT, …) and refuses unknown `KICI_*` names. The
+ * config reloader (`config/resolver.ts`) layers the YAML file and the shared
+ * DB config store on top at runtime.
+ */
 export declare function loadConfig(scope?: ConfigScope): AppConfig;
 export {};
 //# sourceMappingURL=config.d.ts.map

package/dist/contexts/held-runs.d.ts

@@ -279,12 +279,9 @@ export declare class HeldRunStore {
      * incidental: `expireOverdue` is not scope-filtered, so a released-but-not-yet-
      * resumed row would otherwise be expired out from under its resume.
      *
-     * The filter matches every persisted spelling of the timer hold type, so a row
-     * an un-upgraded orchestrator wrote as `wait_timer` still resumes rather than
-     * falling through to the expire-and-fail sweep. It deliberately does NOT
-     * filter on `hold_scope`: a job-scoped timer hold used to be excluded here,
-     * which left it with no release path at all — created, never released,
-     * eventually expired, its job never dispatched.
+     * The filter deliberately does NOT filter on `hold_scope`: a job-scoped timer
+     * hold used to be excluded here, which left it with no release path at all —
+     * created, never released, eventually expired, its job never dispatched.
      */
     releaseDueWaitHolds(): Promise<ReleaseSignal[]>;
     /**

package/dist/dashboard/cursor.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Opaque pagination cursors for the dashboard list handlers:
+ * base64url(JSON(fields)), every field a string.
+ */
+/** Encode `fields` as a cursor. Key order follows the object literal. */
+export declare function encodeCursor(fields: Record<string, string>): string;
+/**
+ * Decode a cursor into exactly `keys`. Returns null when the cursor is not
+ * base64url JSON or any key is missing or not a string; other keys are dropped.
+ */
+export declare function decodeCursor<K extends string>(raw: string, keys: readonly K[]): Record<K, string> | null;
+//# sourceMappingURL=cursor.d.ts.map

package/dist/dashboard/handler.d.ts

@@ -14,7 +14,7 @@ interface DashboardHandlerDeps {
      * The orchestrator's own provenance issuer (`KICI_ORCHESTRATOR_PROVENANCE_ISSUER`)
      * when it owns signing. Surfaced on attestations-list responses so the Platform
      * returns it as `trustedIssuer` — the dashboard / CLI verify against the
-     * orchestrator that actually signed the bundles, not the Platform's own issuer.
+     * orchestrator that signed the bundles.
      */
     provenanceSigningIssuer?: string | null;
     /**
@@ -127,6 +127,7 @@ export declare class DashboardHandler {
     private readonly send;
     private readonly orchestratorId;
     private readonly accessLog;
+    private readonly access;
     private orgId;
     private routingKey;
     private readonly onRerun;
@@ -142,7 +143,7 @@ export declare class DashboardHandler {
      * Update the bound orgId + routingKey. Called from server.ts after resolving
      * the single tenant org from the `sources` / `generic_webhook_sources` table.
      *
-     * NOTE: this binding is the **fallback** for `recordAccess`. Run-targeted
+     * NOTE: this binding is the **fallback** access_log scope. Run-targeted
      * handlers resolve the run-owning org per-request via `resolveOrgForRun`;
      * the bound pair is consulted only when the per-target lookup yields no
      * result (e.g. cold-archived run, deleted source). On a multi-tenant
@@ -190,14 +191,6 @@ export declare class DashboardHandler {
      * has the operation switched off.
      */
     private enforcePolicy;
-    /**
-     * Write an access_log row for a handler invocation. The caller resolves
-     * the run-owning org via `resolveOrgForRun` (or the registration / event-
-     * log equivalents) and threads it in here so each row carries the org
-     * that owns the target — not the handler-bound (multi-tenant: non-
-     * deterministic) pair. Best-effort; the writer swallows failures.
-     */
-    private recordAccess;
     /**
      * Handle a dashboard.run.detail request.
      * Queries execution_jobs and execution_steps for the given runId,
@@ -337,14 +330,14 @@ export declare class DashboardHandler {
      * Handle a dashboard.attestations.list request: list the run's provenance
      * attestations, inlining each stored bundle from object storage so the
      * dashboard verifies it client-side. Mirrors `handleStepLogs` (per-run org
-     * resolution + `recordAccess` + `send`). Rows whose bundle can't be read are
+     * resolution + `access.recordIn` + `send`). Rows whose bundle can't be read are
      * skipped (best-effort) rather than failing the whole list.
      */
     handleAttestationsList(msg: DashboardAttestationsListRequest): Promise<void>;
     /**
      * Handle a dashboard.artifacts.list request: list the run's named artifacts
      * with a presigned GET per entry. Mirrors `handleAttestationsList` (per-run
-     * org resolution + `recordAccess` + `send`). Org is resolved server-side from
+     * org resolution + `access.recordIn` + `send`). Org is resolved server-side from
      * the run row, never the wire, so the listing cannot cross tenants.
      */
     handleArtifactsList(msg: DashboardArtifactsListRequest): Promise<void>;

package/dist/db/deferred-index-build.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Builds the deferred indexes (`deferred-indexes.ts`) after boot, each one
+ * `CONCURRENTLY` on its own connection.
+ */
+import type pg from 'pg';
+import { type Logger } from '@kici-dev/shared';
+import { type DeferredIndex } from './deferred-indexes.js';
+/**
+ * Distinct from the migrator's `543210001`: an index build must not block, or
+ * be blocked by, a peer applying migrations.
+ */
+export declare const DEFERRED_INDEX_LOCK_KEY = 543210002;
+/**
+ * Drop a leftover invalid index before rebuilding it.
+ *
+ * An interrupted `CREATE INDEX CONCURRENTLY` leaves the index in place marked
+ * invalid: it is not used by the planner, and `IF NOT EXISTS` sees it and
+ * skips. Without this, the very first failed build would make the retry a
+ * permanent no-op — the opposite of the "retries on the next boot" contract.
+ */
+export declare function dropIfInvalid(client: Pick<pg.Client, 'query'>, name: string, logger: Logger): Promise<void>;
+export interface BuildDeferredIndexesResult {
+    built: string[];
+    failed: string[];
+}
+/**
+ * Build every deferred index on one dedicated connection.
+ *
+ * The connection is taken straight from `pg` rather than from the serving
+ * pool: `CREATE INDEX CONCURRENTLY` must run outside a transaction and must
+ * not inherit a statement timeout, and a concurrent build on a large table
+ * would otherwise hold a serving connection for its whole duration.
+ *
+ * The advisory lock is `pg_try_advisory_lock`, not the blocking form: when a
+ * peer is already building, this instance has nothing to wait for.
+ */
+export declare function buildDeferredIndexes(databaseUrl: string, opts?: {
+    logger?: Logger;
+    indexes?: ReadonlyArray<DeferredIndex>;
+    pg?: typeof import('pg');
+}): Promise<BuildDeferredIndexesResult>;
+//# sourceMappingURL=deferred-index-build.d.ts.map