@kici-dev/shared 0.1.26 → 0.2.0

package/dist/db-admin.js

@@ -2,6 +2,7 @@ import "./rolldown-runtime-ClRpJifh.js";
 import { createPool } from "./db.js";
 import { createHash } from "node:crypto";
 import pg from "pg";
+import { HoldType, unknownContributorHoldReason } from "@kici-dev/engine";
 //#region src/db-admin.ts
 /**
 * Admin/DB-operations helpers shared between `kici-admin` (orchestrator DB)
@@ -341,18 +342,18 @@ async function purgeScopedSecretsDirect(databaseUrl, orgId) {
 	}
 }
 /**
-* Bulk-delete `environments` (and their FK-dependent rows) for an org, or for
-* every org when `orgId` is omitted. `environment_bindings` /
-* `environment_variables` / `environment_source_overrides` cascade
+* Bulk-delete `contexts` (and their FK-dependent rows) for an org, or for
+* every org when `orgId` is omitted. `context_bindings` /
+* `context_variables` / `context_source_overrides` cascade
 * automatically (ON DELETE CASCADE). `held_runs` and `execution_runs` reference
-* `environments(id)` with ON DELETE SET NULL, so deleting environments alone
-* would leave orphaned `held_runs` rows carrying a null environment reference;
+* `contexts(id)` with ON DELETE SET NULL, so deleting contexts alone
+* would leave orphaned `held_runs` rows carrying a null context reference;
 * this helper deletes the org's `held_runs` too so a warm-start reset gets a
 * clean slate. Runs in a transaction so both deletes commit atomically. Used by
-* the E2E warm-start reset (so seeded environments don't leak between
-* categories) and exposed via `kici-admin environment purge`.
+* the E2E warm-start reset (so seeded contexts don't leak between
+* categories) and exposed via `kici-admin context purge`.
 */
-async function purgeEnvironmentsDirect(databaseUrl, orgId) {
+async function purgeContextsDirect(databaseUrl, orgId) {
 	const pool = createPool(databaseUrl);
 	const client = await pool.connect();
 	try {
@@ -360,10 +361,10 @@ async function purgeEnvironmentsDirect(databaseUrl, orgId) {
 		const where = orgId ? "WHERE org_id = $1" : "";
 		const params = orgId ? [orgId] : [];
 		const held = await client.query(`DELETE FROM held_runs ${where}`, params);
-		const envs = await client.query(`DELETE FROM environments ${where}`, params);
+		const envs = await client.query(`DELETE FROM contexts ${where}`, params);
 		await client.query("COMMIT");
 		return {
-			environmentsDeleted: envs.rowCount ?? 0,
+			contextsDeleted: envs.rowCount ?? 0,
 			heldRunsDeleted: held.rowCount ?? 0
 		};
 	} catch (err) {
@@ -375,7 +376,7 @@ async function purgeEnvironmentsDirect(databaseUrl, orgId) {
 	}
 }
 /**
-* Allowed policy field names for `setEnvironmentPolicyDirect`. Kept as an
+* Allowed policy field names for `setContextPolicyDirect`. Kept as an
 * explicit allowlist so the column-name interpolation in the UPDATE string
 * can never be driven by unsanitised caller input.
 */
@@ -389,13 +390,19 @@ const ENV_POLICY_COLUMNS = /* @__PURE__ */ new Set([
 	"allow_local_execution"
 ]);
 /**
-* Upsert an environment row keyed by (org_id, name). Returns the env id and
+* Upsert a context row keyed by (org_id, name). Returns the env id and
 * whether the row was newly inserted. `branchRestrictions` / `requiredReviewers`
 * are JSON-serialised server-side; pass them as plain arrays or objects.
-*/
-async function seedEnvironmentDirect(databaseUrl, opts) {
-	if (opts.waitTimerSeconds != null && opts.waitTimerSeconds < 0) throw new Error(`environment: waitTimerSeconds must be >= 0 (got ${opts.waitTimerSeconds})`);
-	if (opts.holdExpirySeconds != null && opts.holdExpirySeconds < 0) throw new Error(`environment: holdExpirySeconds must be >= 0 (got ${opts.holdExpirySeconds})`);
+*
+* An omitted `holdExpirySeconds` is written as NULL rather than a literal
+* window: the column carries no DDL default, so "never set" and "cleared" both
+* land on NULL and resolve through the one `DEFAULT_HOLD_EXPIRY_SECONDS`
+* fallback on read. Writing a literal here would give this path a second,
+* longer default that no read-side code knows about.
+*/
+async function seedContextDirect(databaseUrl, opts) {
+	if (opts.waitTimerSeconds != null && opts.waitTimerSeconds < 0) throw new Error(`context: waitTimerSeconds must be >= 0 (got ${opts.waitTimerSeconds})`);
+	if (opts.holdExpirySeconds != null && opts.holdExpirySeconds < 1) throw new Error(`context: holdExpirySeconds must be >= 1 (got ${opts.holdExpirySeconds})`);
 	const pool = new pg.Pool({
 		connectionString: databaseUrl,
 		max: 1
@@ -403,20 +410,20 @@ async function seedEnvironmentDirect(databaseUrl, opts) {
 	try {
 		const branchJson = JSON.stringify(opts.branchRestrictions ?? []);
 		const reviewersJson = opts.requiredReviewers === void 0 ? null : JSON.stringify(opts.requiredReviewers);
-		const row = (await pool.query(`INSERT INTO environments
+		const row = (await pool.query(`INSERT INTO contexts
           (org_id, name, type, enabled, branch_restrictions, required_reviewers,
            wait_timer_seconds, hold_expiry_seconds, minimum_trust, glob_pattern)
         VALUES ($1, $2, COALESCE($3, 'fixed'), COALESCE($4, true), $5::jsonb, $6::jsonb,
-                $7, COALESCE($8, 86400), $9, $10)
+                $7, $8, $9, $10)
         ON CONFLICT (org_id, name) DO UPDATE SET
-          type = COALESCE(EXCLUDED.type, environments.type),
+          type = COALESCE(EXCLUDED.type, contexts.type),
           enabled = EXCLUDED.enabled,
           branch_restrictions = EXCLUDED.branch_restrictions,
           required_reviewers = EXCLUDED.required_reviewers,
           wait_timer_seconds = EXCLUDED.wait_timer_seconds,
           hold_expiry_seconds = EXCLUDED.hold_expiry_seconds,
           minimum_trust = EXCLUDED.minimum_trust,
-          glob_pattern = COALESCE(EXCLUDED.glob_pattern, environments.glob_pattern),
+          glob_pattern = COALESCE(EXCLUDED.glob_pattern, contexts.glob_pattern),
           updated_at = now()
         RETURNING id, (xmax = 0) AS inserted`, [
 			opts.orgId,
@@ -430,7 +437,7 @@ async function seedEnvironmentDirect(databaseUrl, opts) {
 			opts.minimumTrust ?? null,
 			opts.globPattern ?? null
 		])).rows[0];
-		if (!row) throw new Error(`environment: upsert returned no row for ${opts.name}`);
+		if (!row) throw new Error(`context: upsert returned no row for ${opts.name}`);
 		return {
 			envId: row.id,
 			created: row.inserted
@@ -440,47 +447,47 @@ async function seedEnvironmentDirect(databaseUrl, opts) {
 	}
 }
 /**
-* Delete an environment keyed by (org_id, name). Returns whether a row was
-* removed. The `environment_bindings`, `environment_variables`, and
-* `environment_source_overrides` children all carry
-* `FOREIGN KEY (environment_id) REFERENCES environments(id) ON DELETE CASCADE`,
-* so a single DELETE on `environments` cascades to those children. The
+* Delete a context keyed by (org_id, name). Returns whether a row was
+* removed. The `context_bindings`, `context_variables`, and
+* `context_source_overrides` children all carry
+* `FOREIGN KEY (context_id) REFERENCES contexts(id) ON DELETE CASCADE`,
+* so a single DELETE on `contexts` cascades to those children. The
 * `held_runs` FK uses `ON DELETE SET NULL`, so terminal held-run history
-* survives the delete with a null environment reference. Pending held runs
-* still reference the environment, so this helper pre-checks their count and
+* survives the delete with a null context reference. Pending held runs
+* still reference the context, so this helper pre-checks their count and
 * throws before issuing the DELETE — approve or reject them first.
 */
-async function deleteEnvironmentDirect(databaseUrl, opts) {
+async function deleteContextDirect(databaseUrl, opts) {
 	const pool = new pg.Pool({
 		connectionString: databaseUrl,
 		max: 1
 	});
 	try {
 		const pending = await pool.query(`SELECT count(*)::text AS count FROM held_runs hr
-         JOIN environments e ON e.id = hr.environment_id
+         JOIN contexts e ON e.id = hr.context_id
         WHERE e.org_id = $1 AND e.name = $2 AND hr.status = 'pending'`, [opts.orgId, opts.name]);
 		const pendingCount = Number(pending.rows[0]?.count ?? 0);
-		if (pendingCount > 0) throw new Error(`environment has ${pendingCount} pending held run(s) — approve or reject them first`);
-		return { deleted: (await pool.query(`DELETE FROM environments WHERE org_id = $1 AND name = $2 RETURNING id`, [opts.orgId, opts.name])).rows.length > 0 };
+		if (pendingCount > 0) throw new Error(`context has ${pendingCount} pending held run(s) — approve or reject them first`);
+		return { deleted: (await pool.query(`DELETE FROM contexts WHERE org_id = $1 AND name = $2 RETURNING id`, [opts.orgId, opts.name])).rows.length > 0 };
 	} finally {
 		await pool.end();
 	}
 }
 /**
-* Upsert an `environment_bindings` row connecting `envName` to `scopePattern`
-* (scoped to `hostPattern`, default `'**'`). Throws if the environment does
+* Upsert an `context_bindings` row connecting `contextName` to `scopePattern`
+* (scoped to `hostPattern`, default `'**'`). Throws if the context does
 * not exist.
 */
-async function seedEnvironmentBindingDirect(databaseUrl, opts) {
+async function seedContextBindingDirect(databaseUrl, opts) {
 	const pool = new pg.Pool({
 		connectionString: databaseUrl,
 		max: 1
 	});
 	try {
-		const envRow = await pool.query(`SELECT id FROM environments WHERE org_id = $1 AND name = $2`, [opts.orgId, opts.envName]);
-		if (envRow.rows.length === 0) throw new Error(`environment: not found (org=${opts.orgId}, name=${opts.envName})`);
+		const envRow = await pool.query(`SELECT id FROM contexts WHERE org_id = $1 AND name = $2`, [opts.orgId, opts.contextName]);
+		if (envRow.rows.length === 0) throw new Error(`context: not found (org=${opts.orgId}, name=${opts.contextName})`);
 		const envId = envRow.rows[0].id;
-		return { created: (await pool.query(`INSERT INTO environment_bindings (org_id, environment_id, scope_pattern, host_pattern)
+		return { created: (await pool.query(`INSERT INTO context_bindings (org_id, context_id, scope_pattern, host_pattern)
          VALUES ($1, $2, $3, $4)
          ON CONFLICT DO NOTHING
          RETURNING (xmax = 0) AS inserted`, [
@@ -495,16 +502,16 @@ async function seedEnvironmentBindingDirect(databaseUrl, opts) {
 }
 /**
 * UPDATE only the policy fields that were explicitly provided. Columns that
-* were NOT in `opts` are left untouched. Throws if the environment is missing.
+* were NOT in `opts` are left untouched. Throws if the context is missing.
 */
-async function setEnvironmentPolicyDirect(databaseUrl, opts) {
-	if (opts.waitTimerSeconds != null && opts.waitTimerSeconds < 0) throw new Error(`environment: waitTimerSeconds must be >= 0 (got ${opts.waitTimerSeconds})`);
-	if (opts.holdExpirySeconds != null && opts.holdExpirySeconds < 0) throw new Error(`environment: holdExpirySeconds must be >= 0 (got ${opts.holdExpirySeconds})`);
+async function setContextPolicyDirect(databaseUrl, opts) {
+	if (opts.waitTimerSeconds != null && opts.waitTimerSeconds < 0) throw new Error(`context: waitTimerSeconds must be >= 0 (got ${opts.waitTimerSeconds})`);
+	if (opts.holdExpirySeconds != null && opts.holdExpirySeconds < 1) throw new Error(`context: holdExpirySeconds must be >= 1 (got ${opts.holdExpirySeconds})`);
 	const setClauses = [];
 	const params = [];
 	let idx = 1;
 	const addSet = (column, value, cast) => {
-		if (!ENV_POLICY_COLUMNS.has(column)) throw new Error(`environment: unknown policy column ${column}`);
+		if (!ENV_POLICY_COLUMNS.has(column)) throw new Error(`context: unknown policy column ${column}`);
 		setClauses.push(`${column} = $${idx}${cast ? `::${cast}` : ""}`);
 		params.push(value);
 		idx += 1;
@@ -516,36 +523,36 @@ async function setEnvironmentPolicyDirect(databaseUrl, opts) {
 	if (opts.minimumTrust !== void 0) addSet("minimum_trust", opts.minimumTrust);
 	if (opts.enabled !== void 0) addSet("enabled", opts.enabled);
 	if (opts.allowLocalExecution !== void 0) addSet("allow_local_execution", opts.allowLocalExecution);
-	if (setClauses.length === 0) throw new Error("environment: setEnvironmentPolicy requires at least one policy field");
+	if (setClauses.length === 0) throw new Error("context: setContextPolicy requires at least one policy field");
 	const pool = new pg.Pool({
 		connectionString: databaseUrl,
 		max: 1
 	});
 	try {
-		params.push(opts.orgId, opts.envName);
+		params.push(opts.orgId, opts.contextName);
 		const orgParam = `$${idx}`;
 		const nameParam = `$${idx + 1}`;
-		const sql = `UPDATE environments
+		const sql = `UPDATE contexts
                     SET ${setClauses.join(", ")}, updated_at = now()
                     WHERE org_id = ${orgParam} AND name = ${nameParam}`;
-		if (((await pool.query(sql, params)).rowCount ?? 0) === 0) throw new Error(`environment: not found (org=${opts.orgId}, name=${opts.envName})`);
+		if (((await pool.query(sql, params)).rowCount ?? 0) === 0) throw new Error(`context: not found (org=${opts.orgId}, name=${opts.contextName})`);
 	} finally {
 		await pool.end();
 	}
 }
 /**
-* SELECT * FROM environments WHERE org_id = $1, ordered by name.
+* SELECT * FROM contexts WHERE org_id = $1, ordered by name.
 */
-async function listEnvironmentsDirect(databaseUrl, opts) {
+async function listContextsDirect(databaseUrl, opts) {
 	const pool = new pg.Pool({
 		connectionString: databaseUrl,
 		max: 1
 	});
 	try {
-		return { environments: (await pool.query(`SELECT id, org_id, name, type, enabled, branch_restrictions, required_reviewers,
+		return { contexts: (await pool.query(`SELECT id, org_id, name, type, enabled, branch_restrictions, required_reviewers,
               wait_timer_seconds, hold_expiry_seconds, minimum_trust,
               created_at, updated_at
-         FROM environments
+         FROM contexts
         WHERE org_id = $1
         ORDER BY name`, [opts.orgId])).rows };
 	} finally {
@@ -553,10 +560,10 @@ async function listEnvironmentsDirect(databaseUrl, opts) {
 	}
 }
 /**
-* Fetch a single environment row joined with its variables and bindings.
-* Throws if the environment does not exist.
+* Fetch a single context row joined with its variables and bindings.
+* Throws if the context does not exist.
 */
-async function showEnvironmentDirect(databaseUrl, opts) {
+async function showContextDirect(databaseUrl, opts) {
 	const pool = new pg.Pool({
 		connectionString: databaseUrl,
 		max: 1
@@ -565,20 +572,20 @@ async function showEnvironmentDirect(databaseUrl, opts) {
 		const envResult = await pool.query(`SELECT id, org_id, name, type, enabled, branch_restrictions, required_reviewers,
               wait_timer_seconds, hold_expiry_seconds, minimum_trust,
               created_at, updated_at
-         FROM environments
+         FROM contexts
         WHERE org_id = $1 AND name = $2`, [opts.orgId, opts.name]);
-		if (envResult.rows.length === 0) throw new Error(`environment: not found (org=${opts.orgId}, name=${opts.name})`);
+		if (envResult.rows.length === 0) throw new Error(`context: not found (org=${opts.orgId}, name=${opts.name})`);
 		const env = envResult.rows[0];
 		const variables = await pool.query(`SELECT key, value, locked, updated_at
-         FROM environment_variables
-        WHERE environment_id = $1
+         FROM context_variables
+        WHERE context_id = $1
         ORDER BY key`, [env.id]);
 		const bindings = await pool.query(`SELECT scope_pattern, host_pattern, created_at
-         FROM environment_bindings
-        WHERE environment_id = $1
+         FROM context_bindings
+        WHERE context_id = $1
         ORDER BY scope_pattern, host_pattern`, [env.id]);
 		return {
-			environment: env,
+			context: env,
 			variables: variables.rows,
 			bindings: bindings.rows
 		};
@@ -587,11 +594,16 @@ async function showEnvironmentDirect(databaseUrl, opts) {
 	}
 }
 /**
-* Create (or update) an environment template + its seed variables in one
-* transaction. Templates are represented as environments with `type='template'`
+* Create (or update) a context template + its seed variables in one
+* transaction. Templates are represented as contexts with `type='template'`
 * by convention. Returns `{ envId, variablesSet }`.
+*
+* An omitted `holdExpirySeconds` is written as NULL rather than a literal
+* window, for the same reason as `seedContextDirect`: the column has no DDL
+* default and every read resolves NULL through `DEFAULT_HOLD_EXPIRY_SECONDS`.
 */
-async function createEnvironmentTemplateDirect(databaseUrl, opts) {
+async function createContextTemplateDirect(databaseUrl, opts) {
+	if (opts.holdExpirySeconds != null && opts.holdExpirySeconds < 1) throw new Error(`context: holdExpirySeconds must be >= 1 (got ${opts.holdExpirySeconds})`);
 	const pool = new pg.Pool({
 		connectionString: databaseUrl,
 		max: 1
@@ -599,12 +611,12 @@ async function createEnvironmentTemplateDirect(databaseUrl, opts) {
 	const client = await pool.connect();
 	try {
 		await client.query("BEGIN");
-		const row = (await client.query(`INSERT INTO environments
+		const row = (await client.query(`INSERT INTO contexts
           (org_id, name, type, enabled, branch_restrictions, required_reviewers,
            wait_timer_seconds, hold_expiry_seconds, minimum_trust)
-        VALUES ($1, $2, COALESCE($3, 'template'), true, $4::jsonb, $5::jsonb, $6, COALESCE($7, 86400), $8)
+        VALUES ($1, $2, COALESCE($3, 'template'), true, $4::jsonb, $5::jsonb, $6, $7, $8)
         ON CONFLICT (org_id, name) DO UPDATE SET
-          type = COALESCE(EXCLUDED.type, environments.type),
+          type = COALESCE(EXCLUDED.type, contexts.type),
           branch_restrictions = EXCLUDED.branch_restrictions,
           required_reviewers = EXCLUDED.required_reviewers,
           wait_timer_seconds = EXCLUDED.wait_timer_seconds,
@@ -621,12 +633,12 @@ async function createEnvironmentTemplateDirect(databaseUrl, opts) {
 			opts.holdExpirySeconds ?? null,
 			opts.minimumTrust ?? null
 		])).rows[0];
-		if (!row) throw new Error(`environment: template upsert returned no row`);
+		if (!row) throw new Error(`context: template upsert returned no row`);
 		let variablesSet = 0;
 		if (opts.variables) for (const [key, value] of Object.entries(opts.variables)) {
-			await client.query(`INSERT INTO environment_variables (org_id, environment_id, key, value, locked)
+			await client.query(`INSERT INTO context_variables (org_id, context_id, key, value, locked)
              VALUES ($1, $2, $3, $4, false)
-             ON CONFLICT (org_id, environment_id, key) DO UPDATE SET
+             ON CONFLICT (org_id, context_id, key) DO UPDATE SET
                value = EXCLUDED.value,
                updated_at = now()`, [
 				opts.orgId,
@@ -651,14 +663,14 @@ async function createEnvironmentTemplateDirect(databaseUrl, opts) {
 	}
 }
 /**
-* UPSERT a scoped_secrets row keyed by (org_id, scope=environment, key).
+* UPSERT a scoped_secrets row keyed by (org_id, scope=context, key).
 * Writes the value verbatim — the caller is responsible for encryption
 * (matches the stage-4 deferral noted in the plan).
 */
-async function setEnvironmentSecretDirect(databaseUrl, opts) {
-	if (!opts.orgId) throw new Error("environment: orgId required");
-	if (!opts.environment) throw new Error("environment: environment name required");
-	if (!opts.key) throw new Error("environment: key required");
+async function setContextSecretDirect(databaseUrl, opts) {
+	if (!opts.orgId) throw new Error("context: orgId required");
+	if (!opts.context) throw new Error("context: context name required");
+	if (!opts.key) throw new Error("context: key required");
 	const pool = new pg.Pool({
 		connectionString: databaseUrl,
 		max: 1
@@ -671,7 +683,7 @@ async function setEnvironmentSecretDirect(databaseUrl, opts) {
            updated_at = now()
          RETURNING (xmax = 0) AS inserted`, [
 			opts.orgId,
-			opts.environment,
+			opts.context,
 			opts.key,
 			opts.encryptedValue
 		])).rows[0]?.inserted ?? false };
@@ -789,7 +801,7 @@ async function listExecutionRunsDirect(databaseUrl, opts = {}) {
 		const limit = Math.max(1, Math.min(1e3, opts.limit ?? 100));
 		const where = clauses.length > 0 ? `WHERE ${clauses.join(" AND ")}` : "";
 		return { runs: (await pool.query(`SELECT id, run_id, workflow_name, status, provider, repo_identifier,
-              ref, sha, routing_key, environment, trust_tier, created_at,
+              ref, sha, routing_key, context, trust_tier, created_at,
               started_at, completed_at, duration_ms
          FROM execution_runs
          ${where}
@@ -800,6 +812,38 @@ async function listExecutionRunsDirect(databaseUrl, opts = {}) {
 	}
 }
 /**
+* READ-ONLY: SELECT check_run_tracking rows for a commit. One row per
+* `(provider, owner, repo, sha, check_name)`, ordered by check_name.
+*
+* Each column answers a different question. `check_run_id` is written once,
+* when the check run is created in the `queued` state, so it answers "did we
+* create it?". `terminal_sent_at` is stamped only after the provider accepts
+* the terminal `completed` PATCH, so it answers "did we complete it?". Every
+* write here is best-effort, so a null column is "no record", never proof of
+* failure — see the per-field notes for what each one does and does not prove.
+*/
+async function listCheckRunTrackingDirect(databaseUrl, opts) {
+	const pool = createPool(databaseUrl);
+	try {
+		const clauses = ["sha = $1"];
+		const params = [opts.sha];
+		if (opts.checkName !== void 0) {
+			clauses.push(`check_name = $2`);
+			params.push(opts.checkName);
+		}
+		const limit = Math.max(1, Math.min(1e3, opts.limit ?? 50));
+		return { rows: (await pool.query(`SELECT provider, owner, repo, sha, check_name,
+              check_run_id::text AS check_run_id,
+              build_creation_state, run_id, in_progress_sent_at, terminal_sent_at
+         FROM check_run_tracking
+        WHERE ${clauses.join(" AND ")}
+        ORDER BY check_name
+        LIMIT ${limit}`, params)).rows };
+	} finally {
+		await pool.end();
+	}
+}
+/**
 * READ-ONLY: fetch a single run by run_id AND its jobs. Throws if no run
 * matches the run_id. Jobs list may be empty for pending runs.
 */
@@ -807,7 +851,7 @@ async function showExecutionRunDirect(databaseUrl, opts) {
 	const pool = createPool(databaseUrl);
 	try {
 		const runResult = await pool.query(`SELECT id, run_id, workflow_name, status, provider, repo_identifier,
-              ref, sha, routing_key, environment, trust_tier, created_at,
+              ref, sha, routing_key, context, trust_tier, created_at,
               started_at, completed_at, duration_ms
          FROM execution_runs
         WHERE run_id = $1`, [opts.runId]);
@@ -816,7 +860,7 @@ async function showExecutionRunDirect(databaseUrl, opts) {
 		return {
 			run,
 			jobs: (await pool.query(`SELECT id, run_id, job_id, job_name, status, agent_id,
-              started_at, completed_at, duration_ms, created_at, error_message, environments
+              started_at, completed_at, duration_ms, created_at, error_message, contexts
          FROM execution_jobs
         WHERE run_id = $1
         ORDER BY created_at ASC`, [run.run_id])).rows
@@ -834,7 +878,7 @@ async function listExecutionJobsDirect(databaseUrl, opts) {
 	try {
 		return { jobs: (await pool.query(`SELECT j.id, j.run_id, j.job_id, j.job_name, j.status, j.agent_id,
               j.started_at, j.completed_at, j.duration_ms, j.created_at, j.error_message,
-              j.environments
+              j.contexts
          FROM execution_jobs j
          INNER JOIN execution_runs r ON r.run_id = j.run_id
         WHERE r.run_id::text = $1 OR r.id::text = $1
@@ -1648,8 +1692,10 @@ async function seedUniversalGitSourceDirect(databaseUrl, opts) {
 		await pool.end();
 	}
 }
+/** repo_identifier used for the different-repo isolation hold. */
+const CI_SECURITY_OTHER_REPO = "other/repo";
 async function seedCiSecurityFixturesDirect(databaseUrl, opts) {
-	const envName = opts.envName ?? "ci-security-env";
+	const contextName = opts.contextName ?? "ci-security-env";
 	const sourceName = opts.sourceName ?? "ci-security-dashboard-resolver";
 	const sourceRoutingKey = opts.sourceRoutingKey ?? `generic:${opts.orgId}:ci-security-dashboard`;
 	const pool = createPool(databaseUrl);
@@ -1661,37 +1707,89 @@ async function seedCiSecurityFixturesDirect(databaseUrl, opts) {
 			sourceRoutingKey,
 			opts.orgId
 		]);
-		const envId = (await pool.query(`INSERT INTO environments (org_id, name, type, enabled)
+		const envId = (await pool.query(`INSERT INTO contexts (org_id, name, type, enabled)
        VALUES ($1, $2, \'fixed\', true)
        ON CONFLICT (org_id, name) DO UPDATE SET enabled = true
-       RETURNING id`, [opts.orgId, envName])).rows[0].id;
-		await pool.query(`INSERT INTO execution_runs (
-        run_id, workflow_name, provider, repo_identifier,
-        ref, sha, delivery_id, status, trust_tier, lock_file_source,
-        contributor_username, routing_key
-      ) VALUES ($1, \'e2e-security-wf\', \'internal\', \'.\', \'refs/heads/feature\',
-        \'abc123\', $2, \'pending\', \'unknown\', \'base\', \'unknown-dev\', $3)`, [
-			opts.unknownRunId,
-			opts.unknownDeliveryId,
-			opts.runsRoutingKey
-		]);
-		await pool.query(`INSERT INTO execution_jobs (job_id, run_id, job_name, status)
-       VALUES ($1, $2, \'security-test-job\', \'pending\')`, [opts.unknownJobId, opts.unknownRunId]);
-		const heldRunId = (await pool.query(`INSERT INTO held_runs (org_id, run_id, job_id, environment_id, hold_type, queue_type, reason, expires_at)
-       VALUES ($1, $2, $3, $4, \'unknown_contributor\', \'security\',
-        \'Unknown contributor requires approval\', NOW() + INTERVAL \'72 hours\')
-       RETURNING id`, [
-			opts.orgId,
-			opts.unknownRunId,
-			opts.unknownJobId,
-			envId
-		])).rows[0].id;
+       RETURNING id`, [opts.orgId, contextName])).rows[0].id;
+		async function seedPrHold(args) {
+			await pool.query(`INSERT INTO execution_runs (
+          run_id, workflow_name, provider, repo_identifier,
+          ref, sha, delivery_id, status, trust_tier, lock_file_source,
+          contributor_username, routing_key, pr_number
+        ) VALUES ($1, \'e2e-security-wf\', \'internal\', $4, \'refs/heads/feature\',
+          $5, $2, \'pending\', \'unknown\', \'base\', \'unknown-dev\', $3, $6)`, [
+				args.runId,
+				args.deliveryId,
+				opts.runsRoutingKey,
+				args.repoIdentifier,
+				args.sha,
+				args.prNumber
+			]);
+			await pool.query(`INSERT INTO execution_jobs (job_id, run_id, job_name, status)
+         VALUES ($1, $2, \'security-test-job\', \'pending\')`, [args.jobId, args.runId]);
+			return (await pool.query(`INSERT INTO held_runs (org_id, run_id, job_id, context_id, hold_type, queue_type, reason, expires_at)
+         VALUES ($1, $2, $3, $4, $5, \'security\', $6, NOW() + INTERVAL \'72 hours\')
+         RETURNING id`, [
+				opts.orgId,
+				args.runId,
+				args.jobId,
+				args.contextId === void 0 ? envId : args.contextId,
+				args.holdType ?? HoldType.enum.security,
+				args.reason ?? unknownContributorHoldReason(contextName)
+			])).rows[0].id;
+		}
+		const heldRunId = await seedPrHold({
+			runId: opts.unknownRunId,
+			deliveryId: opts.unknownDeliveryId,
+			jobId: opts.unknownJobId,
+			repoIdentifier: ".",
+			prNumber: 1,
+			sha: "abc123"
+		});
+		const secondHeldRunId = await seedPrHold({
+			runId: opts.secondPrRunId,
+			deliveryId: opts.secondPrDeliveryId,
+			jobId: opts.secondPrJobId,
+			repoIdentifier: ".",
+			prNumber: 2,
+			sha: "bbb222"
+		});
+		const otherRepoHeldRunId = await seedPrHold({
+			runId: opts.otherRepoRunId,
+			deliveryId: opts.otherRepoDeliveryId,
+			jobId: opts.otherRepoJobId,
+			repoIdentifier: CI_SECURITY_OTHER_REPO,
+			prNumber: 1,
+			sha: "ccc333"
+		});
+		const wfModHeldRunId = await seedPrHold({
+			runId: opts.wfModRunId,
+			deliveryId: opts.wfModDeliveryId,
+			jobId: opts.wfModJobId,
+			repoIdentifier: ".",
+			prNumber: 3,
+			sha: "ddd444",
+			holdType: HoldType.enum.security,
+			reason: "workflow_modification",
+			contextId: null
+		});
+		const forkPrHeldRunId = await seedPrHold({
+			runId: opts.forkPrRunId,
+			deliveryId: opts.forkPrDeliveryId,
+			jobId: opts.forkPrJobId,
+			repoIdentifier: ".",
+			prNumber: 4,
+			sha: "eee555",
+			holdType: HoldType.enum.security,
+			reason: "fork_pr",
+			contextId: null
+		});
 		await pool.query(`INSERT INTO execution_runs (
         run_id, workflow_name, provider, repo_identifier,
         ref, sha, delivery_id, status, trust_tier, lock_file_source,
-        contributor_username, routing_key
+        contributor_username, routing_key, pr_number
       ) VALUES ($1, \'e2e-security-wf\', \'internal\', \'.\', \'refs/heads/feature\',
-        \'def456\', $2, \'running\', \'trusted\', \'head\', \'trusted-dev\', $3)`, [
+        \'def456\', $2, \'running\', \'trusted\', \'head\', \'trusted-dev\', $3, 1)`, [
 			opts.trustedRunId,
 			opts.trustedDeliveryId,
 			opts.runsRoutingKey
@@ -1699,31 +1797,43 @@ async function seedCiSecurityFixturesDirect(databaseUrl, opts) {
 		await pool.query(`INSERT INTO execution_jobs (job_id, run_id, job_name, status)
        VALUES ($1, $2, \'security-test-job\', \'running\')`, [opts.trustedJobId, opts.trustedRunId]);
 		return {
+			contextName,
 			envId,
-			heldRunId
+			heldRunId,
+			secondHeldRunId,
+			otherRepoHeldRunId,
+			wfModHeldRunId,
+			forkPrHeldRunId
 		};
 	} finally {
 		await pool.end();
 	}
 }
 /**
-* Poll `execution_runs` for at least one row matching `status` whose
-* `started_at > since`. Used by cluster/job-reroute tests to gate on
-* a workflow reaching the terminal state after a webhook trigger.
+* Poll `execution_runs` for the newest run started since `since` whose status
+* is in `statuses`, returning that status. Resolves `{ status: null }` if the
+* deadline passes before any run reaches a target status.
+*
+* Callers wanting "did the run finish?" pass the terminal status set and read
+* the landed status — a terminal failure is reported immediately rather than
+* indistinguishable from a timeout. Used by the cluster reroute tests to gate
+* on a workflow reaching a terminal state after a webhook trigger.
 */
-async function waitForExecutionRunStatusSinceDirect(databaseUrl, opts) {
-	const timeoutMs = opts.timeoutMs ?? 12e4;
+async function waitForExecutionRunReachesStatusSinceDirect(databaseUrl, opts) {
+	const timeoutMs = opts.timeoutMs ?? 24e4;
 	const intervalMs = opts.intervalMs ?? 5e3;
 	const deadline = Date.now() + timeoutMs;
 	const pool = createPool(databaseUrl);
 	try {
 		while (Date.now() < deadline) {
-			if ((await pool.query(`SELECT 1 FROM execution_runs
-         WHERE started_at > $1 AND status = $2
-         LIMIT 1`, [opts.since, opts.status])).rows.length > 0) return { found: true };
+			const result = await pool.query(`SELECT status FROM execution_runs
+         WHERE started_at > $1 AND status = ANY($2)
+         ORDER BY started_at DESC
+         LIMIT 1`, [opts.since, [...opts.statuses]]);
+			if (result.rows.length > 0) return { status: result.rows[0].status };
 			await new Promise((r) => setTimeout(r, intervalMs));
 		}
-		return { found: false };
+		return { status: null };
 	} finally {
 		await pool.end();
 	}
@@ -2269,11 +2379,15 @@ async function bumpRegistryVersionSimpleDirect(databaseUrl, opts = {}) {
 async function upsertCronLastFiredDirect(databaseUrl, opts) {
 	const pool = createPool(databaseUrl);
 	try {
-		await pool.query(`INSERT INTO cron_last_fired (registration_id, last_fired_at)
-         VALUES ($1, NOW() - ($2)::interval)
-         ON CONFLICT (registration_id) DO UPDATE SET
+		await pool.query(`INSERT INTO cron_last_fired (registration_id, schedule_key, last_fired_at)
+         VALUES ($1, $3, NOW() - ($2)::interval)
+         ON CONFLICT (registration_id, schedule_key) DO UPDATE SET
            last_fired_at = NOW() - ($2)::interval,
-           updated_at = NOW()`, [opts.registrationId, opts.agoInterval]);
+           updated_at = NOW()`, [
+			opts.registrationId,
+			opts.agoInterval,
+			opts.scheduleKey
+		]);
 	} finally {
 		await pool.end();
 	}
@@ -2297,7 +2411,7 @@ async function countCronLastFiredDirect(databaseUrl, opts) {
 async function insertCronLastFiredNowDirect(databaseUrl, opts) {
 	const pool = createPool(databaseUrl);
 	try {
-		await pool.query(`INSERT INTO cron_last_fired (registration_id, last_fired_at) VALUES ($1, NOW())`, [opts.registrationId]);
+		await pool.query(`INSERT INTO cron_last_fired (registration_id, schedule_key, last_fired_at) VALUES ($1, $2, NOW())`, [opts.registrationId, opts.scheduleKey]);
 	} finally {
 		await pool.end();
 	}
@@ -2754,6 +2868,6 @@ async function terminateIdleDbBackendsDirect(databaseUrl) {
 	}
 }
 //#endregion
-export { MIGRATION_HASH_TABLE, PROVIDER_HASH_KEY, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createDbRole, createEnvironmentTemplateDirect, createJoinTokenDirect, createReadOnlyDbUser, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteEnvironmentDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listEnvironmentsDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeEnvironmentsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedCrossRepoTrustDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, showEnvironmentDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };
+export { CI_SECURITY_OTHER_REPO, MIGRATION_HASH_TABLE, PROVIDER_HASH_KEY, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createContextTemplateDirect, createDbRole, createJoinTokenDirect, createReadOnlyDbUser, deleteContextDirect, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCheckRunTrackingDirect, listContextsDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedContextBindingDirect, seedContextDirect, seedCrossRepoTrustDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setContextPolicyDirect, setContextSecretDirect, showContextDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunReachesStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };
 
 //# sourceMappingURL=db-admin.js.map