@kici-dev/orchestrator 0.15.0 → 0.16.0

package/dist/config/reload.d.ts

@@ -14,6 +14,7 @@
 import type { Logger } from '@kici-dev/shared';
 import type { AppConfig, SharedConfig } from './types.js';
 import type { SharedConfigStore } from './shared-store.js';
+import type { ScalerFileReloadResult } from '../scaler/file-reload.js';
 /**
  * Source of a reload trigger.
  */
@@ -29,6 +30,12 @@ export interface ReloadResult {
     restartRequired?: string[];
     /** Fields that were hot-reloaded */
     fieldsChanged?: string[];
+    /**
+     * The scaler config's own reload outcome, when this orchestrator runs one.
+     * `success` describes the orchestrator config only: a refused scaler file
+     * shows here as `rejected` while `success` stays true.
+     */
+    scaler?: ScalerFileReloadResult;
 }
 /**
  * Options for executeReload.
@@ -53,8 +60,8 @@ export interface ConfigReloaderDeps {
     sharedStore: SharedConfigStore | null;
     /** Called after successful reload when provider config changed */
     onProviderChange?: (newConfig: AppConfig, oldConfig: AppConfig) => Promise<void>;
-    /** Called to reload scaler configuration */
-    onScalerReload?: () => Promise<void>;
+    /** Called to reload scaler configuration; its outcome is returned as `ReloadResult.scaler`. */
+    onScalerReload?: () => Promise<ScalerFileReloadResult | void>;
     /** Called when Platform connection settings changed */
     onPlatformReconnect?: (newConfig: AppConfig) => Promise<void>;
     /** Atomic swap callback -- replaces the config reference */

package/dist/config/schema.d.ts

@@ -109,7 +109,7 @@ export declare const sharedConfigSchema: z.ZodObject<{
             coordinator: "coordinator";
             worker: "worker";
         }>>;
-        coordinatorUrl: z.ZodOptional<z.ZodString>;
+        coordinatorUrls: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodString]>>;
         peerStaleTimeoutMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
         peerDiscovery: z.ZodOptional<z.ZodEnum<{
             platform: "platform";
@@ -201,7 +201,7 @@ export declare const appConfigSchema: z.ZodObject<{
             coordinator: "coordinator";
             worker: "worker";
         }>>;
-        coordinatorUrl: z.ZodOptional<z.ZodString>;
+        coordinatorUrls: z.ZodDefault<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodPipe<z.ZodString, z.ZodTransform<string[], string>>]>>;
         peerStaleTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
         peerDiscovery: z.ZodDefault<z.ZodEnum<{
             platform: "platform";

package/dist/config/types.d.ts

@@ -187,8 +187,8 @@ export interface AppConfig {
         peerMaxReconnectDelayMs: number;
         /** Cluster role: coordinator (full orchestrator) or worker (delegated execution). */
         role: 'coordinator' | 'worker';
-        /** URL of the coordinator to connect to when role=worker. */
-        coordinatorUrl?: string;
+        /** URLs of every coordinator to connect to when role=worker. */
+        coordinatorUrls: string[];
         /** Stale peer timeout in ms. */
         peerStaleTimeoutMs: number;
         /** Whether this coordinator dials Platform-announced peers. */

package/dist/config.d.ts

@@ -1,15 +1,9 @@
 /**
- * Orchestrator configuration.
+ * Orchestrator startup configuration, read from `KICI_*` environment variables.
  *
- * This is a thin backward-compatible wrapper around the new config resolution
- * chain (config/resolver.ts). It preserves the existing synchronous loadConfig()
- * API so that no other files need changing.
- *
- * The new config system lives in config/ and supports:
- * - YAML config files (config/loader.ts)
- * - Shared DB config store (config/shared-store.ts)
- * - 4-layer resolution: env > YAML > DB > defaults (config/resolver.ts)
- * - KICI_ env var mapping (config/env-overlay.ts)
+ * The runtime config reloader lives in config/: YAML files (config/loader.ts),
+ * the shared DB config store (config/shared-store.ts), the env overlay
+ * (config/env-overlay.ts) and the resolution chain (config/resolver.ts).
  *
  * Provider configuration (GitHub Apps, etc.) is managed via the `sources` table
  * and PgSecretStore, not through config. See SourceStore and SourceManager.
@@ -122,7 +116,6 @@ declare const configSchema: z.ZodObject<{
         filesystem: "filesystem";
         s3: "s3";
     }>>;
-    cacheStoragePath: z.ZodOptional<z.ZodString>;
     cacheStorageS3Bucket: z.ZodOptional<z.ZodString>;
     cacheStorageS3Prefix: z.ZodDefault<z.ZodString>;
     cacheStorageS3Region: z.ZodOptional<z.ZodString>;
@@ -240,7 +233,6 @@ declare const configSchema: z.ZodObject<{
             coordinator: "coordinator";
             worker: "worker";
         }>>;
-        coordinatorUrl: z.ZodOptional<z.ZodString>;
         coordinatorUrls: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string[], string | undefined>>;
         peerStaleTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
         electionGracePeriodMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -340,7 +332,6 @@ export declare const packagingConfigSchema: z.ZodObject<{
         filesystem: "filesystem";
         s3: "s3";
     }>>;
-    cacheStoragePath: z.ZodOptional<z.ZodString>;
     cacheStorageS3Bucket: z.ZodOptional<z.ZodString>;
     cacheStorageS3Prefix: z.ZodDefault<z.ZodString>;
     cacheStorageS3Region: z.ZodOptional<z.ZodString>;
@@ -458,7 +449,6 @@ export declare const packagingConfigSchema: z.ZodObject<{
             coordinator: "coordinator";
             worker: "worker";
         }>>;
-        coordinatorUrl: z.ZodOptional<z.ZodString>;
         coordinatorUrls: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string[], string | undefined>>;
         peerStaleTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
         electionGracePeriodMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -479,7 +469,7 @@ export declare const packagingConfigSchema: z.ZodObject<{
 export type AppConfig = z.infer<typeof configSchema> & {
     /** Unique identifier for this orchestrator instance, generated at startup */
     instanceId: string;
-    /** Object storage settings (populated from legacy env vars or SharedConfig) */
+    /** Object storage settings (populated from the KICI_STORAGE_* env vars or SharedConfig) */
     storage?: {
         type?: 's3' | 'filesystem';
         bucket?: string;
@@ -585,7 +575,6 @@ export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
     scalerProvisionBackoffMaxMs: number;
     scalerProvisionMaxConsecutiveFailures: number;
     cacheStorageType?: "filesystem" | "s3" | undefined;
-    cacheStoragePath?: string | undefined;
     cacheStorageS3Bucket?: string | undefined;
     cacheStorageS3Prefix: string;
     cacheStorageS3Region?: string | undefined;
@@ -676,7 +665,6 @@ export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
         peerHeartbeatIntervalMs: number;
         peerMaxReconnectDelayMs: number;
         role: "coordinator" | "worker";
-        coordinatorUrl?: string | undefined;
         coordinatorUrls: string[];
         peerStaleTimeoutMs: number;
         electionGracePeriodMs: number;
@@ -685,6 +673,14 @@ export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
         trustedProxies: string[];
     };
 }>;
+/**
+ * Load the startup orchestrator configuration from environment variables.
+ *
+ * It reads `process.env` through the names declared in `envDef`
+ * (KICI_DATABASE_URL, KICI_PORT, …) and refuses unknown `KICI_*` names. The
+ * config reloader (`config/resolver.ts`) layers the YAML file and the shared
+ * DB config store on top at runtime.
+ */
 export declare function loadConfig(scope?: ConfigScope): AppConfig;
 export {};
 //# sourceMappingURL=config.d.ts.map

package/dist/contexts/held-runs.d.ts

@@ -279,12 +279,9 @@ export declare class HeldRunStore {
      * incidental: `expireOverdue` is not scope-filtered, so a released-but-not-yet-
      * resumed row would otherwise be expired out from under its resume.
      *
-     * The filter matches every persisted spelling of the timer hold type, so a row
-     * an un-upgraded orchestrator wrote as `wait_timer` still resumes rather than
-     * falling through to the expire-and-fail sweep. It deliberately does NOT
-     * filter on `hold_scope`: a job-scoped timer hold used to be excluded here,
-     * which left it with no release path at all — created, never released,
-     * eventually expired, its job never dispatched.
+     * The filter deliberately does NOT filter on `hold_scope`: a job-scoped timer
+     * hold used to be excluded here, which left it with no release path at all —
+     * created, never released, eventually expired, its job never dispatched.
      */
     releaseDueWaitHolds(): Promise<ReleaseSignal[]>;
     /**

package/dist/dashboard/cursor.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Opaque pagination cursors for the dashboard list handlers:
+ * base64url(JSON(fields)), every field a string.
+ */
+/** Encode `fields` as a cursor. Key order follows the object literal. */
+export declare function encodeCursor(fields: Record<string, string>): string;
+/**
+ * Decode a cursor into exactly `keys`. Returns null when the cursor is not
+ * base64url JSON or any key is missing or not a string; other keys are dropped.
+ */
+export declare function decodeCursor<K extends string>(raw: string, keys: readonly K[]): Record<K, string> | null;
+//# sourceMappingURL=cursor.d.ts.map

package/dist/dashboard/handler.d.ts

@@ -14,7 +14,7 @@ interface DashboardHandlerDeps {
      * The orchestrator's own provenance issuer (`KICI_ORCHESTRATOR_PROVENANCE_ISSUER`)
      * when it owns signing. Surfaced on attestations-list responses so the Platform
      * returns it as `trustedIssuer` — the dashboard / CLI verify against the
-     * orchestrator that actually signed the bundles, not the Platform's own issuer.
+     * orchestrator that signed the bundles.
      */
     provenanceSigningIssuer?: string | null;
     /**
@@ -127,6 +127,7 @@ export declare class DashboardHandler {
     private readonly send;
     private readonly orchestratorId;
     private readonly accessLog;
+    private readonly access;
     private orgId;
     private routingKey;
     private readonly onRerun;
@@ -142,7 +143,7 @@ export declare class DashboardHandler {
      * Update the bound orgId + routingKey. Called from server.ts after resolving
      * the single tenant org from the `sources` / `generic_webhook_sources` table.
      *
-     * NOTE: this binding is the **fallback** for `recordAccess`. Run-targeted
+     * NOTE: this binding is the **fallback** access_log scope. Run-targeted
      * handlers resolve the run-owning org per-request via `resolveOrgForRun`;
      * the bound pair is consulted only when the per-target lookup yields no
      * result (e.g. cold-archived run, deleted source). On a multi-tenant
@@ -190,14 +191,6 @@ export declare class DashboardHandler {
      * has the operation switched off.
      */
     private enforcePolicy;
-    /**
-     * Write an access_log row for a handler invocation. The caller resolves
-     * the run-owning org via `resolveOrgForRun` (or the registration / event-
-     * log equivalents) and threads it in here so each row carries the org
-     * that owns the target — not the handler-bound (multi-tenant: non-
-     * deterministic) pair. Best-effort; the writer swallows failures.
-     */
-    private recordAccess;
     /**
      * Handle a dashboard.run.detail request.
      * Queries execution_jobs and execution_steps for the given runId,
@@ -337,14 +330,14 @@ export declare class DashboardHandler {
      * Handle a dashboard.attestations.list request: list the run's provenance
      * attestations, inlining each stored bundle from object storage so the
      * dashboard verifies it client-side. Mirrors `handleStepLogs` (per-run org
-     * resolution + `recordAccess` + `send`). Rows whose bundle can't be read are
+     * resolution + `access.recordIn` + `send`). Rows whose bundle can't be read are
      * skipped (best-effort) rather than failing the whole list.
      */
     handleAttestationsList(msg: DashboardAttestationsListRequest): Promise<void>;
     /**
      * Handle a dashboard.artifacts.list request: list the run's named artifacts
      * with a presigned GET per entry. Mirrors `handleAttestationsList` (per-run
-     * org resolution + `recordAccess` + `send`). Org is resolved server-side from
+     * org resolution + `access.recordIn` + `send`). Org is resolved server-side from
      * the run row, never the wire, so the listing cannot cross tenants.
      */
     handleArtifactsList(msg: DashboardArtifactsListRequest): Promise<void>;

package/dist/db/deferred-index-build.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Builds the deferred indexes (`deferred-indexes.ts`) after boot, each one
+ * `CONCURRENTLY` on its own connection.
+ */
+import type pg from 'pg';
+import { type Logger } from '@kici-dev/shared';
+import { type DeferredIndex } from './deferred-indexes.js';
+/**
+ * Distinct from the migrator's `543210001`: an index build must not block, or
+ * be blocked by, a peer applying migrations.
+ */
+export declare const DEFERRED_INDEX_LOCK_KEY = 543210002;
+/**
+ * Drop a leftover invalid index before rebuilding it.
+ *
+ * An interrupted `CREATE INDEX CONCURRENTLY` leaves the index in place marked
+ * invalid: it is not used by the planner, and `IF NOT EXISTS` sees it and
+ * skips. Without this, the very first failed build would make the retry a
+ * permanent no-op — the opposite of the "retries on the next boot" contract.
+ */
+export declare function dropIfInvalid(client: Pick<pg.Client, 'query'>, name: string, logger: Logger): Promise<void>;
+export interface BuildDeferredIndexesResult {
+    built: string[];
+    failed: string[];
+}
+/**
+ * Build every deferred index on one dedicated connection.
+ *
+ * The connection is taken straight from `pg` rather than from the serving
+ * pool: `CREATE INDEX CONCURRENTLY` must run outside a transaction and must
+ * not inherit a statement timeout, and a concurrent build on a large table
+ * would otherwise hold a serving connection for its whole duration.
+ *
+ * The advisory lock is `pg_try_advisory_lock`, not the blocking form: when a
+ * peer is already building, this instance has nothing to wait for.
+ */
+export declare function buildDeferredIndexes(databaseUrl: string, opts?: {
+    logger?: Logger;
+    indexes?: ReadonlyArray<DeferredIndex>;
+    pg?: typeof import('pg');
+}): Promise<BuildDeferredIndexesResult>;
+//# sourceMappingURL=deferred-index-build.d.ts.map

package/dist/db/deferred-indexes.d.ts

@@ -16,15 +16,10 @@
  * a failed build retries on the next boot.
  *
  * A repository check enforces that new indexes on those tables land here
- * rather than in a migration.
+ * rather than in a migration. The build itself is `deferred-index-build.ts`;
+ * this module holds only the list, so a CLI can read it without loading the
+ * orchestrator's metrics.
  */
-import type pg from 'pg';
-import { type Logger } from '@kici-dev/shared';
-/**
- * Distinct from the migrator's `543210001`: an index build must not block, or
- * be blocked by, a peer applying migrations.
- */
-export declare const DEFERRED_INDEX_LOCK_KEY = 543210002;
 export interface DeferredIndex {
     /** Index name, matching the one the SQL creates. */
     name: string;
@@ -40,33 +35,4 @@ export interface DeferredIndex {
  * prefixed by an organization or routing key.
  */
 export declare const DEFERRED_INDEXES: ReadonlyArray<DeferredIndex>;
-/**
- * Drop a leftover invalid index before rebuilding it.
- *
- * An interrupted `CREATE INDEX CONCURRENTLY` leaves the index in place marked
- * invalid: it is not used by the planner, and `IF NOT EXISTS` sees it and
- * skips. Without this, the very first failed build would make the retry a
- * permanent no-op — the opposite of the "retries on the next boot" contract.
- */
-export declare function dropIfInvalid(client: Pick<pg.Client, 'query'>, name: string, logger: Logger): Promise<void>;
-export interface BuildDeferredIndexesResult {
-    built: string[];
-    failed: string[];
-}
-/**
- * Build every deferred index on one dedicated connection.
- *
- * The connection is taken straight from `pg` rather than from the serving
- * pool: `CREATE INDEX CONCURRENTLY` must run outside a transaction and must
- * not inherit a statement timeout, and a concurrent build on a large table
- * would otherwise hold a serving connection for its whole duration.
- *
- * The advisory lock is `pg_try_advisory_lock`, not the blocking form: when a
- * peer is already building, this instance has nothing to wait for.
- */
-export declare function buildDeferredIndexes(databaseUrl: string, opts?: {
-    logger?: Logger;
-    indexes?: ReadonlyArray<DeferredIndex>;
-    pg?: typeof import('pg');
-}): Promise<BuildDeferredIndexesResult>;
 //# sourceMappingURL=deferred-indexes.d.ts.map

package/dist/db/migrations/100_held_runs_hold_type_vocabulary.d.ts

@@ -8,11 +8,9 @@ import { type Kysely } from 'kysely';
  * unknown-type badge — and two semantically identical wait holds render
  * differently depending on which gate produced them.
  *
- * Writers emit the gate vocabulary; this backfills the history. The read path
- * also normalizes (`normalizePersistedHoldType`) and the wait-hold release
- * sweep matches both spellings, so a row written by an un-upgraded
- * orchestrator behaves correctly whether or not this has run — the two sides
- * deploy independently.
+ * Writers emit the gate vocabulary; this backfills the history. Migration 158
+ * re-applies the same rewrite, after which the readers match the gate
+ * vocabulary only.
  *
  * Idempotent: a second run matches no rows.
  */

package/dist/db/migrations/158_normalize_legacy_values.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(): Promise<void>;
+//# sourceMappingURL=158_normalize_legacy_values.d.ts.map

package/dist/db/repos/org-ids-repo.d.ts

@@ -0,0 +1,87 @@
+/**
+ * The org ids this orchestrator holds data for, and which data names each one.
+ *
+ * The org-scoped kici-admin commands (`secret`, `context`, `variable`,
+ * `remote-source`, `org-settings`, `trust-policy`, `registration`) take an org
+ * id. This module answers "which org ids exist here" from the configuration and
+ * anchor tables, for both `GET /api/v1/admin/org-ids` and
+ * `kici-admin org list --database-url`, so the two transports cannot disagree.
+ */
+import { type Kysely } from 'kysely';
+import { z } from 'zod';
+import type { Database } from '../types.js';
+/**
+ * Where an org id was found. `platform` is the live Platform connection, which
+ * only the admin API can see; every other value names a table.
+ */
+export declare const OrgIdSource: z.ZodEnum<{
+    context: "context";
+    "generic-source": "generic-source";
+    "org-settings": "org-settings";
+    platform: "platform";
+    registration: "registration";
+    "remote-source": "remote-source";
+    secret: "secret";
+    source: "source";
+    "trust-policy": "trust-policy";
+}>;
+export type OrgIdSource = z.infer<typeof OrgIdSource>;
+/**
+ * The orchestrator's Platform attachment: `attached` once the Platform named
+ * the org on `auth.success`, `pending` while a Platform client has not
+ * authenticated yet, `none` when no Platform client runs (independent mode).
+ */
+export declare const PlatformAttachment: z.ZodEnum<{
+    attached: "attached";
+    none: "none";
+    pending: "pending";
+}>;
+export type PlatformAttachment = z.infer<typeof PlatformAttachment>;
+/** One org id and the data that names it. */
+export interface HeldOrg {
+    orgId: string;
+    sources: OrgIdSource[];
+}
+/**
+ * Body of `GET /api/v1/admin/org-ids`. The two Platform fields are absent when the
+ * listing was read from the database directly: only the running orchestrator
+ * knows its connection.
+ */
+export interface OrgListResponse {
+    platformAttachment?: PlatformAttachment;
+    attachedOrgId?: string | null;
+    orgs: HeldOrg[];
+}
+/** The admin API path of the listing. */
+export declare const ORG_LIST_PATH = "/api/v1/admin/org-ids";
+interface OrgIdTable {
+    table: keyof Database;
+    column: 'org_id' | 'customer_id';
+    source: Exclude<OrgIdSource, 'platform'>;
+    /** Skip soft-deleted rows (`deleted_at IS NULL`). */
+    liveOnly?: boolean;
+}
+/** The configuration and anchor tables an org-scoped command reads by org id. */
+export declare const ORG_ID_TABLES: readonly OrgIdTable[];
+/**
+ * Every other table with an `org_id` or `customer_id` column, and why the
+ * listing does not read it. A schema test fails when a migration adds an
+ * org-keyed table that is in neither this map nor {@link ORG_ID_TABLES}.
+ */
+export declare const ORG_ID_TABLES_NOT_LISTED: Readonly<Record<string, string>>;
+/** Group `(org id, source)` rows per org: org ids in byte order, sources in enum order. */
+export declare function groupOrgIdRows(rows: ReadonlyArray<{
+    org_id: string;
+    source: OrgIdSource;
+}>): HeldOrg[];
+/** Add the Platform-attached org to a listing, with the `platform` source. */
+export declare function withPlatformOrg(orgs: readonly HeldOrg[], attachedOrgId: string | null): HeldOrg[];
+/** The attachment the admin API reports, from the Platform client's org id reader. */
+export declare function readPlatformAttachment(getPlatformOrgId: (() => string | undefined) | undefined): {
+    platformAttachment: PlatformAttachment;
+    attachedOrgId: string | null;
+};
+/** Every org id the listed tables hold, in one round trip. */
+export declare function listHeldOrgIds(db: Kysely<Database>): Promise<HeldOrg[]>;
+export {};
+//# sourceMappingURL=org-ids-repo.d.ts.map

package/dist/db/schema-snapshot.generated.d.ts

@@ -0,0 +1,3 @@
+import type { SchemaFingerprint } from '@kici-dev/shared';
+export declare const SCHEMA_SNAPSHOT: SchemaFingerprint;
+//# sourceMappingURL=schema-snapshot.generated.d.ts.map

package/dist/db/types.d.ts

@@ -1212,8 +1212,7 @@ export interface HeldRunsTable {
     /**
      * Hold type — an engine `HoldType` member ('reviewer' | 'timer' |
      * 'concurrency' | 'security'). Stays `string` so a row written by a
-     * different orchestrator version is never rejected; read it through
-     * `normalizePersistedHoldType`.
+     * different orchestrator version is never rejected.
      */
     hold_type: string;
     /** Hold status: 'pending' | 'approved' | 'rejected' | 'expired' | 'released' */
@@ -1244,7 +1243,8 @@ export interface HeldRunsTable {
     trigger_source: Generated<string>;
     /**
      * Normalized `ApprovalRequirement` (clauses + expiresAt + reason) the hold
-     * must satisfy. Null for legacy rows that predate the approval model.
+     * must satisfy. Null for a hold with no requirement: security, wait and queue
+     * holds, which `security-hold-check.ts` tells apart on this column.
      */
     approval_requirement: ColumnType<ApprovalRequirement | null, ApprovalRequirement | string | null | undefined, ApprovalRequirement | string | null>;
     /**
@@ -2082,25 +2082,8 @@ export interface OrgTrustPolicyTable {
     customer_id: string;
     /** How to treat a pull request opened from a fork: ignore | hold | allow */
     fork_policy: string;
-    /**
-     * The coarse, hours-granularity view of the security-hold window.
-     *
-     * Retained and always written, because it is the only window an older peer or
-     * CLI can read. This build derives it from `approval_expiry_seconds` on every
-     * write (rounded up, never below 1), so the two columns cannot disagree.
-     */
-    approval_expiry_hours: number;
-    /**
-     * How long a security hold stays approvable before it expires, in seconds —
-     * the authoritative window, and the only granularity that can express a
-     * sub-hour hold.
-     *
-     * Nullable: NULL means no seconds value was ever written (a row predating the
-     * column, or one written by an older build), and every reader falls back to
-     * `approval_expiry_hours * 3600`. Same convention as
-     * `contexts.hold_expiry_seconds`.
-     */
-    approval_expiry_seconds: ColumnType<number | null, number | null | undefined, number | null>;
+    /** How long a security hold stays approvable before it expires, in seconds. */
+    approval_expiry_seconds: number;
     /** Which side last wrote this row: platform | local */
     source: string;
     /** When this policy was last written */

package/dist/fault-injection-types.d.ts

@@ -9,7 +9,6 @@
  * TS2307s. Only the declaration lives here — its one dependency is a type from
  * `@kici-dev/engine`, so nothing test-only is pulled along with it.
  */
-import type { OrchCapabilities } from '@kici-dev/engine';
 /**
  * The set of synthetic faults a test-only entrypoint can inject into the
  * orchestrator. Every field is optional: an absent field means "no fault at
@@ -44,10 +43,5 @@ export interface OrchestratorFaultInjection {
      * the first coordinator slow enough that the Platform relay fails over.
      */
     beforeRerun?: () => Promise<void>;
-    /**
-     * Transform the advertised capability manifest — used to reproduce an older
-     * / sourceless orchestrator that predates a given dashboard capability.
-     */
-    capabilitiesTransform?: (c: OrchCapabilities) => OrchCapabilities;
 }
 //# sourceMappingURL=fault-injection-types.d.ts.map

package/dist/git/dispatch-git-auth.d.ts

@@ -2,21 +2,15 @@ import type { ProviderGitAuth } from '@kici-dev/engine';
 import type { ProviderBundle, ProviderRegistry } from '../provider-registry.js';
 /** Auth the dispatch message carries; every field is optional on the wire. */
 export interface DispatchCloneAuth {
-    /** Bare source-repository token, kept for agents that read only `token`. */
-    token?: string;
     sourceAuth?: ProviderGitAuth;
     workflowAuth?: ProviderGitAuth;
 }
 /**
- * Mint structured auth (and a bare token when it is basic auth) for one
- * repository through one bundle. Providers that implement `issueGitAuth()`
- * return the auth kind directly; otherwise a clone token is wrapped in a
- * basic-auth envelope.
+ * Mint structured auth for one repository through one bundle. Providers that
+ * implement `issueGitAuth()` return the auth kind directly; otherwise a clone
+ * token is wrapped in a basic-auth envelope.
  */
-export declare function mintRepoGitAuth(bundle: ProviderBundle, repoIdentifier: string, providerContext: unknown): Promise<{
-    token: string | null;
-    structuredAuth: ProviderGitAuth | null;
-}>;
+export declare function mintRepoGitAuth(bundle: ProviderBundle, repoIdentifier: string, providerContext: unknown): Promise<ProviderGitAuth | null>;
 /** The job fields the auth resolution reads. */
 export interface DispatchAuthJob {
     id: string;
@@ -35,8 +29,8 @@ export declare function gitHostOf(url: string): string | undefined;
  * it may.
  *
  * The agent falls back across the two clones: it clones the source repository
- * with `sourceAuth ?? workflowAuth ?? token` and the workflow repository with
- * `workflowAuth ?? sourceAuth ?? token`. When only one repository's credential is
+ * with `sourceAuth ?? workflowAuth` and the workflow repository with
+ * `workflowAuth ?? sourceAuth`. When only one repository's credential is
  * present, the other clone sends it to that repository's host. On the same host
  * that is a credential the host issued; on another host it hands one provider's
  * credential to another, so the job is refused instead. A job with no source URL

package/dist/helpers/json.d.ts

@@ -0,0 +1,3 @@
+/** Parse JSON, returning null for empty, nullish or invalid input. */
+export declare function safeJsonParse(value: string | null | undefined): unknown;
+//# sourceMappingURL=json.d.ts.map