@kici-dev/shared 0.1.26 → 0.2.0

package/dist/db-collation.d.ts

@@ -57,4 +57,53 @@ export declare function reindexDatabaseConcurrently(pool: pg.Pool, dbName: strin
  * Metadata-only; safe to run any time after a REINDEX has rebuilt the indexes.
  */
 export declare function refreshDatabaseCollationVersion(pool: pg.Pool, dbName: string): Promise<void>;
+/**
+ * The two-step operator remediation for collation drift on `dbName`, as a
+ * single copy-pasteable string. Surfaced in the startup ERROR line and the
+ * hard-fail message so an operator sees exactly what to run.
+ */
+export declare function collationDriftRemediation(dbName: string): string;
+/**
+ * Minimal structural logger the startup check needs. `winston.Logger`
+ * satisfies it, so both the orchestrator and Platform pass their own logger
+ * without a shared winston dependency here.
+ */
+export interface CollationDriftStartupLogger {
+    info(message: string, meta?: Record<string, unknown>): void;
+    warn(message: string, meta?: Record<string, unknown>): void;
+    error(message: string, meta?: Record<string, unknown>): void;
+}
+/** Env var name that turns a detected drift into a startup refusal. */
+export declare const FAIL_ON_COLLATION_DRIFT_ENV = "KICI_DB_FAIL_ON_COLLATION_DRIFT";
+/**
+ * Read the opt-in hard-fail toggle from an environment map. When set to
+ * `true`, {@link checkCollationDriftAtStartup} throws on detected drift instead
+ * of logging and continuing. Defaults to off (detect + warn loudly).
+ */
+export declare function shouldFailOnCollationDrift(env: NodeJS.ProcessEnv): boolean;
+/**
+ * Boot-time collation-drift guard shared by the orchestrator and Platform.
+ *
+ * Runs {@link getDatabaseCollationDrift} after the DB connection + migrations
+ * are up and before the service starts serving. Behavior:
+ *
+ * - **No drift** → logs one info line and returns `null`.
+ * - **Drift** → logs a single loud, structured ERROR line naming the database,
+ *   the recorded-vs-actual collation versions, the exact remediation command,
+ *   and the risk (text index lookups may silently miss present rows — the
+ *   failure mode that read a present source private key back as absent). Does
+ *   NOT crash by default; a drifted DB still serves most traffic and crashing
+ *   every node is worse than a loud, alertable warning. Returns the drift.
+ * - **`failOnDrift: true`** (opt-in via {@link FAIL_ON_COLLATION_DRIFT_ENV})
+ *   → throws after logging, so strict operators can refuse to boot on drift.
+ * - **Probe failure** (the query itself throws) → logs a WARN and returns
+ *   `null`. A probe bug must never take down every node; unconfirmed drift is
+ *   not a reason to crash, and `failOnDrift` gates confirmed drift only.
+ *
+ * The caller is responsible for reflecting the result into its
+ * `kici_db_collation_drift{database=…}` gauge (1 on drift, 0 clean).
+ */
+export declare function checkCollationDriftAtStartup(pool: pg.Pool, dbName: string, logger: CollationDriftStartupLogger, options?: {
+    failOnDrift?: boolean;
+}): Promise<CollationDrift | null>;
 //# sourceMappingURL=db-collation.d.ts.map

package/dist/db-collation.js

@@ -1,5 +1,6 @@
 import "./rolldown-runtime-ClRpJifh.js";
 import pg from "pg";
+import { toErrorMessage } from "@kici-dev/core";
 //#region src/db-collation.ts
 /**
 * Read `pg_database.datcollversion` and
@@ -46,7 +47,73 @@ async function refreshDatabaseCollationVersion(pool, dbName) {
 	const quoted = pg.escapeIdentifier(dbName);
 	await pool.query(`ALTER DATABASE ${quoted} REFRESH COLLATION VERSION`);
 }
+/**
+* The two-step operator remediation for collation drift on `dbName`, as a
+* single copy-pasteable string. Surfaced in the startup ERROR line and the
+* hard-fail message so an operator sees exactly what to run.
+*/
+function collationDriftRemediation(dbName) {
+	const quoted = pg.escapeIdentifier(dbName);
+	return `REINDEX DATABASE CONCURRENTLY ${quoted}; ALTER DATABASE ${quoted} REFRESH COLLATION VERSION;`;
+}
+/** Env var name that turns a detected drift into a startup refusal. */
+const FAIL_ON_COLLATION_DRIFT_ENV = "KICI_DB_FAIL_ON_COLLATION_DRIFT";
+/**
+* Read the opt-in hard-fail toggle from an environment map. When set to
+* `true`, {@link checkCollationDriftAtStartup} throws on detected drift instead
+* of logging and continuing. Defaults to off (detect + warn loudly).
+*/
+function shouldFailOnCollationDrift(env) {
+	return env[FAIL_ON_COLLATION_DRIFT_ENV] === "true";
+}
+/**
+* Boot-time collation-drift guard shared by the orchestrator and Platform.
+*
+* Runs {@link getDatabaseCollationDrift} after the DB connection + migrations
+* are up and before the service starts serving. Behavior:
+*
+* - **No drift** → logs one info line and returns `null`.
+* - **Drift** → logs a single loud, structured ERROR line naming the database,
+*   the recorded-vs-actual collation versions, the exact remediation command,
+*   and the risk (text index lookups may silently miss present rows — the
+*   failure mode that read a present source private key back as absent). Does
+*   NOT crash by default; a drifted DB still serves most traffic and crashing
+*   every node is worse than a loud, alertable warning. Returns the drift.
+* - **`failOnDrift: true`** (opt-in via {@link FAIL_ON_COLLATION_DRIFT_ENV})
+*   → throws after logging, so strict operators can refuse to boot on drift.
+* - **Probe failure** (the query itself throws) → logs a WARN and returns
+*   `null`. A probe bug must never take down every node; unconfirmed drift is
+*   not a reason to crash, and `failOnDrift` gates confirmed drift only.
+*
+* The caller is responsible for reflecting the result into its
+* `kici_db_collation_drift{database=…}` gauge (1 on drift, 0 clean).
+*/
+async function checkCollationDriftAtStartup(pool, dbName, logger, options = {}) {
+	let drift;
+	try {
+		drift = await getDatabaseCollationDrift(pool, dbName);
+	} catch (err) {
+		logger.warn("Collation-drift startup probe failed; skipping drift check", {
+			database: dbName,
+			error: toErrorMessage(err)
+		});
+		return null;
+	}
+	if (!drift) {
+		logger.info("Database collation version is consistent", { database: dbName });
+		return null;
+	}
+	logger.error("Database collation drift detected — text-column b-tree indexes may silently miss present rows (e.g. secrets/sources reads reporting present rows as missing). Repair with the remediation below.", {
+		database: dbName,
+		stampedCollationVersion: drift.stamped,
+		actualCollationVersion: drift.actual,
+		remediation: collationDriftRemediation(dbName),
+		risk: "corrupted-text-btree-index"
+	});
+	if (options.failOnDrift) throw new Error(`Database "${dbName}" has collation drift (stamped=${drift.stamped}, actual=${drift.actual}) and ${FAIL_ON_COLLATION_DRIFT_ENV} is set. Remediate: ${collationDriftRemediation(dbName)}`);
+	return drift;
+}
 //#endregion
-export { getDatabaseCollationDrift, refreshDatabaseCollationVersion, reindexDatabaseConcurrently };
+export { FAIL_ON_COLLATION_DRIFT_ENV, checkCollationDriftAtStartup, collationDriftRemediation, getDatabaseCollationDrift, refreshDatabaseCollationVersion, reindexDatabaseConcurrently, shouldFailOnCollationDrift };
 
 //# sourceMappingURL=db-collation.js.map

package/dist/db.d.ts

@@ -2,6 +2,15 @@ import pg from 'pg';
 import { Kysely } from 'kysely';
 /** Where a pg connection error surfaced. */
 export type PgPoolErrorSource = 'idle-pool' | 'client';
+/**
+ * Outcome of a single pool acquire.
+ *
+ * `'timeout'` means the caller waited the pool's full `connectionTimeoutMillis`
+ * and was refused a connection — a load condition. A backend that cannot be
+ * reached rejects with a connection error instead and is deliberately NOT
+ * reported here; that is a different condition with a different owner.
+ */
+export type PoolAcquireOutcome = 'ok' | 'timeout';
 export interface CreatePoolOptions {
     /** Extra pg.Pool config merged over the connection string (e.g. max, connectionTimeoutMillis). */
     config?: Omit<pg.PoolConfig, 'connectionString'>;
@@ -11,6 +20,23 @@ export interface CreatePoolOptions {
      * never replaces the log.
      */
     onError?: (err: Error, source: PgPoolErrorSource) => void;
+    /**
+     * Optional hook invoked once per `pool.connect()` acquire on this pool, with
+     * the outcome and how long the caller waited.
+     *
+     * Only the promise form of `connect` is instrumented, so an acquire made via
+     * `pool.query(...)` is NOT reported — pg implements `query` on top of the
+     * callback form of `connect`. The exclusion is symmetric (neither outcome is
+     * reported), so a ratio derived from this hook stays well-formed; but work
+     * whose acquires must be counted has to go through `pool.connect()`, as
+     * Kysely's PostgresDialect does.
+     *
+     * Opt-in: a pool created without it behaves exactly as before. A consumer
+     * that derives a load signal from acquire outcomes wires it on the pool whose
+     * saturation actually matters to it — one hook shared across unrelated pools
+     * would attribute one pool's exhaustion to another pool's traffic.
+     */
+    onAcquire?: (outcome: PoolAcquireOutcome, waitedMs: number) => void;
 }
 /**
  * Create PostgreSQL connection pool.
@@ -23,6 +49,14 @@ export interface CreatePoolOptions {
  * the next acquire. In-flight query failures still reject to their callers.
  */
 export declare function createPool(databaseUrl: string, options?: CreatePoolOptions): pg.Pool;
+/**
+ * node-postgres rejects a pool-acquire timeout (the `connectionTimeoutMillis`
+ * window elapsed with no free connection) with this exact message. It is the
+ * only signal pg exposes to tell "pool busy (load)" apart from "backend
+ * unreachable". Centralized here + covered by one unit test so a pg-version
+ * bump that changes the string fails loudly in one place.
+ */
+export declare function isPoolAcquireTimeout(err: unknown): boolean;
 /**
  * Create Kysely database instance (PostgreSQL only).
  *

package/dist/db.js

@@ -38,9 +38,38 @@ function createPool(databaseUrl, options) {
 	pool.on("connect", (client) => {
 		client.on("error", (err) => handle(err, "client"));
 	});
+	if (options?.onAcquire) {
+		const report = options.onAcquire;
+		const original = pool.connect.bind(pool);
+		pool.connect = function connect(cb) {
+			if (typeof cb === "function") return original(cb);
+			const startedAt = Date.now();
+			return original().then((client) => {
+				try {
+					report("ok", Date.now() - startedAt);
+				} catch {}
+				return client;
+			}, (err) => {
+				try {
+					if (isPoolAcquireTimeout(err)) report("timeout", Date.now() - startedAt);
+				} catch {}
+				throw err;
+			});
+		};
+	}
 	return pool;
 }
 /**
+* node-postgres rejects a pool-acquire timeout (the `connectionTimeoutMillis`
+* window elapsed with no free connection) with this exact message. It is the
+* only signal pg exposes to tell "pool busy (load)" apart from "backend
+* unreachable". Centralized here + covered by one unit test so a pg-version
+* bump that changes the string fails loudly in one place.
+*/
+function isPoolAcquireTimeout(err) {
+	return err instanceof Error && err.message === "timeout exceeded when trying to connect";
+}
+/**
 * Create Kysely database instance (PostgreSQL only).
 *
 * Generic over the database type so each consumer can provide
@@ -50,6 +79,6 @@ function createDb(pool) {
 	return new Kysely({ dialect: new PostgresDialect({ pool }) });
 }
 //#endregion
-export { createDb, createPool };
+export { createDb, createPool, isPoolAcquireTimeout };
 
 //# sourceMappingURL=db.js.map

package/dist/diagnostics/bundle-archive.js

@@ -1,6 +1,6 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import * as fs from "node:fs";
-import * as path from "node:path";
+import * as path$1 from "node:path";
 //#region src/diagnostics/bundle-archive.ts
 /**
 * Shared debug-bundle archive primitives.
@@ -103,18 +103,18 @@ async function addLogsToArchive(archive, logDir, logWindowHours) {
 	const cutoff = Date.now() - logWindowHours * 60 * 60 * 1e3;
 	const entries = fs.readdirSync(logDir).filter((f) => {
 		if (!f.endsWith(".log")) return false;
-		return fs.statSync(path.join(logDir, f)).mtimeMs >= cutoff;
+		return fs.statSync(path$1.join(logDir, f)).mtimeMs >= cutoff;
 	});
 	entries.sort((a, b) => {
-		const aStat = fs.statSync(path.join(logDir, a));
-		return fs.statSync(path.join(logDir, b)).mtimeMs - aStat.mtimeMs;
+		const aStat = fs.statSync(path$1.join(logDir, a));
+		return fs.statSync(path$1.join(logDir, b)).mtimeMs - aStat.mtimeMs;
 	});
 	let totalBytes = 0;
 	let totalLines = 0;
 	let errors = 0;
 	let warnings = 0;
 	for (const entry of entries) {
-		const filePath = path.join(logDir, entry);
+		const filePath = path$1.join(logDir, entry);
 		const stat = fs.statSync(filePath);
 		if (totalBytes + stat.size > 52428800) break;
 		const content = fs.readFileSync(filePath, "utf-8");

package/dist/env/allowlist.d.ts

@@ -71,6 +71,11 @@
  *                           dashboard's vite.config consults to disable
  *                           the dev proxy), HEADED (Playwright convention
  *                           for `--headed` runs).
+ *   - Vitest runtime      — VITEST_* (vitest's own names, which it reads
+ *                           after config resolution: VITEST_MAX_WORKERS
+ *                           carries the per-process worker ceiling
+ *                           `hack/lib/vitest-workers.ts` publishes, and
+ *                           VITEST_POOL_ID marks a pool worker).
  */
 export declare const OS_SDK_ALLOWLIST_REGEX: RegExp;
 /**

package/dist/env/allowlist.js

@@ -73,8 +73,13 @@ import "../rolldown-runtime-ClRpJifh.js";
 *                           dashboard's vite.config consults to disable
 *                           the dev proxy), HEADED (Playwright convention
 *                           for `--headed` runs).
+*   - Vitest runtime      — VITEST_* (vitest's own names, which it reads
+*                           after config resolution: VITEST_MAX_WORKERS
+*                           carries the per-process worker ceiling
+*                           `hack/lib/vitest-workers.ts` publishes, and
+*                           VITEST_POOL_ID marks a pool worker).
 */
-const OS_SDK_ALLOWLIST_REGEX = /^(KICI_.*|NODE_ENV|HOME|PATH|TZ|LANG|TMPDIR|USER|USERNAME|SHELL|COMSPEC|PWD|OLDPWD|HOSTNAME|PROCESSOR_ARCHITECTURE|COLUMNS|LINES|TERM|COLORTERM|DISPLAY|WAYLAND_DISPLAY|LOCALAPPDATA|XDG_CACHE_HOME|XDG_CONFIG_HOME|XDG_DATA_HOME|XDG_RUNTIME_DIR|XDG_STATE_HOME|INIT_CWD|npm_.*|SSH_.*|CI|GITHUB_ACTIONS|GITHUB_ENV|GITHUB_OUTPUT|GITHUB_PATH|GITHUB_STEP_SUMMARY|GITLAB_CI|AWS_.*|REDIS_.*|OTEL_.*|STRIPE_.*|DOCKER_.*|GIT_.*|CONTAINER_HOST|container|PGHOST|PGPORT|PGUSER|PGPASSWORD|PGDATABASE|PGSERVICEFILE|PGSSLMODE|FORGEJO_URL|FORGEJO_CONTAINER|KEYCLOAK_.*|VITE_.*|PLAYWRIGHT|HEADED)$/;
+const OS_SDK_ALLOWLIST_REGEX = /^(KICI_.*|NODE_ENV|HOME|PATH|TZ|LANG|TMPDIR|USER|USERNAME|SHELL|COMSPEC|PWD|OLDPWD|HOSTNAME|PROCESSOR_ARCHITECTURE|COLUMNS|LINES|TERM|COLORTERM|DISPLAY|WAYLAND_DISPLAY|LOCALAPPDATA|XDG_CACHE_HOME|XDG_CONFIG_HOME|XDG_DATA_HOME|XDG_RUNTIME_DIR|XDG_STATE_HOME|INIT_CWD|npm_.*|SSH_.*|CI|GITHUB_ACTIONS|GITHUB_ENV|GITHUB_OUTPUT|GITHUB_PATH|GITHUB_STEP_SUMMARY|GITLAB_CI|AWS_.*|REDIS_.*|OTEL_.*|STRIPE_.*|DOCKER_.*|GIT_.*|CONTAINER_HOST|container|PGHOST|PGPORT|PGUSER|PGPASSWORD|PGDATABASE|PGSERVICEFILE|PGSSLMODE|FORGEJO_URL|FORGEJO_CONTAINER|KEYCLOAK_.*|VITE_.*|VITEST_.*|PLAYWRIGHT|HEADED)$/;
 /**
 * Returns true when `name` is allowed under the KiCI env-var convention:
 * it matches the OS/SDK allowlist regex (which includes the `KICI_*`

package/dist/env/define-env.d.ts

@@ -66,8 +66,15 @@ export interface DefineEnvOptions<TShape extends z.ZodRawShape> {
     descriptions?: Record<string, string>;
 }
 export interface DefineEnvResult<T> {
-    /** Parse `env` (defaults to `process.env`) into a typed config. */
-    parse(env?: NodeJS.ProcessEnv): T;
+    /**
+     * Parse `env` (defaults to `process.env`) into a typed config.
+     *
+     * `parserOverride` is an optional per-call parser (e.g. a scope-narrowed
+     * `.superRefine`) that replaces the default parser for this parse only —
+     * used to validate the same env map under a looser/stricter cross-field
+     * rule set without duplicating the envMap.
+     */
+    parse(env?: NodeJS.ProcessEnv, parserOverride?: z.ZodType): T;
     /** Machine-readable field specs for docs generation. */
     describe(): EnvFieldSpec[];
     /** Flat list of every env var the schema reads (for the unknown-var scanner). */
@@ -101,6 +108,16 @@ export declare function defineEnv<TShape extends z.ZodRawShape>(opts: DefineEnvO
  *   (on POSIX it's a shell-local var that doesn't leak).
  * - `KICI_DEV`: the dev-mode toggle itself — read by the scanner to flip
  *   to warn-only, so it must not trip the scanner.
+ * - `KICI_BUILD_COUNTER_NO_COMMIT`: a build-tooling flag read only by
+ *   `hack/lib/commit-build-counter.mjs` (skip the per-build `.build-counter`
+ *   commit on a force-synced checkout, e.g. a remote E2E executor). Set in the
+ *   ambient shell for `pnpm build`; the native orchestrator spawn inherits it.
+ * - `KICI_TEST_ISOLATION`: the test-isolation marker set at config-eval time
+ *   by every vitest config in this repository (`hack/lib/vitest-isolation.ts`,
+ *   enforced by `hack/check-vitest-isolation.ts`). It makes the CLI's
+ *   `getConfigDir` refuse the developer machine's ambient `~/.kici` config, and
+ *   it is inherited by every service a test spawns — same leak-by-inheritance
+ *   shape as the `KICI_E2E_` prefix below.
  *
  * Keep this list small and well-justified. Every addition is a typo we can
  * no longer catch, so only list things that are (a) actually set in the

package/dist/env/define-env.js

@@ -155,8 +155,8 @@ function describeFieldRecursive(shape, envMap, fieldPath, descriptions, out) {
 *   const config = envDef.parse();
 */
 function defineEnv(opts) {
-	const parserSchema = opts.parser ?? opts.schema;
-	function parse(env = process.env) {
+	function parse(env = process.env, parserOverride) {
+		const parserSchema = parserOverride ?? opts.parser ?? opts.schema;
 		const raw = readEnv(opts.envMap, env);
 		const result = parserSchema.safeParse(raw);
 		if (!result.success) {
@@ -227,12 +227,27 @@ function suggestClosest(name, candidates) {
 *   (on POSIX it's a shell-local var that doesn't leak).
 * - `KICI_DEV`: the dev-mode toggle itself — read by the scanner to flip
 *   to warn-only, so it must not trip the scanner.
+* - `KICI_BUILD_COUNTER_NO_COMMIT`: a build-tooling flag read only by
+*   `hack/lib/commit-build-counter.mjs` (skip the per-build `.build-counter`
+*   commit on a force-synced checkout, e.g. a remote E2E executor). Set in the
+*   ambient shell for `pnpm build`; the native orchestrator spawn inherits it.
+* - `KICI_TEST_ISOLATION`: the test-isolation marker set at config-eval time
+*   by every vitest config in this repository (`hack/lib/vitest-isolation.ts`,
+*   enforced by `hack/check-vitest-isolation.ts`). It makes the CLI's
+*   `getConfigDir` refuse the developer machine's ambient `~/.kici` config, and
+*   it is inherited by every service a test spawns — same leak-by-inheritance
+*   shape as the `KICI_E2E_` prefix below.
 *
 * Keep this list small and well-justified. Every addition is a typo we can
 * no longer catch, so only list things that are (a) actually set in the
 * wild by our own tooling and (b) could never be a config typo.
 */
-const RESERVED_NON_SCHEMA_KICI_VARS = ["KICI_CACHE", "KICI_DEV"];
+const RESERVED_NON_SCHEMA_KICI_VARS = [
+	"KICI_CACHE",
+	"KICI_DEV",
+	"KICI_BUILD_COUNTER_NO_COMMIT",
+	"KICI_TEST_ISOLATION"
+];
 /**
 * `KICI_*` prefixes that are entirely outside the service-config namespace —
 * usually set by our own test / dev tooling and inherited into a child

package/dist/env/logger-env.d.ts

@@ -1,13 +1,14 @@
 /**
  * Shared LoggerEnv schema.
  *
- * The logger (packages/shared/src/logger.ts) reads these env vars *before*
- * the per-service config loads, so we can't include them in the service
- * schemas the normal way. We still want them in `docs/operator/env-reference.md`
- * and in `validateUnknownKiciVars()`'s known-var set, so this schema documents
- * them in one place. Each service includes the keys here when computing its
- * "known KICI_* vars" list, and the docs generator emits a "Logger / shared"
- * section from this schema.
+ * The logger (packages/core/src/logger.ts) reads these env vars *before*
+ * the per-service config loads — as does `kiciTmpBase()`
+ * (packages/core/src/tmp.ts) for the `KICI_TMPDIR` entry below — so we can't
+ * include them in the service schemas the normal way. We still want them in
+ * `docs/operator/env-reference.md` and in `validateUnknownKiciVars()`'s
+ * known-var set, so this schema documents them in one place. Each service
+ * includes the keys here when computing its "known KICI_* vars" list, and the
+ * docs generator emits a "Logger / shared" section from this schema.
  *
  * IMPORTANT: do not change the runtime behaviour of `logger.ts` from this
  * schema — the schema is documentation + the unknown-var allowlist, not the
@@ -20,16 +21,17 @@ export declare const LoggerEnvSchema: z.ZodObject<{
     KICI_LOG_MAX_SIZE: z.ZodDefault<z.ZodString>;
     KICI_LOG_RETENTION_DAYS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     KICI_LOG_FORMAT: z.ZodDefault<z.ZodEnum<{
-        json: "json";
         auto: "auto";
+        json: "json";
         plain: "plain";
     }>>;
     KICI_CLUSTER_INSTANCE_ID: z.ZodOptional<z.ZodString>;
     KICI_AGENT_ID: z.ZodOptional<z.ZodString>;
     KICI_PLATFORM_INSTANCE_ID: z.ZodOptional<z.ZodString>;
+    KICI_TMPDIR: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /** All env vars the logger reads, for the unknown-KICI-var scanner. */
-export declare const LOGGER_ENV_VARS: readonly ["KICI_LOG_DIR", "KICI_LOG_MAX_SIZE", "KICI_LOG_RETENTION_DAYS", "KICI_LOG_FORMAT", "KICI_CLUSTER_INSTANCE_ID", "KICI_AGENT_ID", "KICI_PLATFORM_INSTANCE_ID"];
+export declare const LOGGER_ENV_VARS: readonly ['KICI_LOG_DIR', 'KICI_LOG_MAX_SIZE', 'KICI_LOG_RETENTION_DAYS', 'KICI_LOG_FORMAT', 'KICI_CLUSTER_INSTANCE_ID', 'KICI_AGENT_ID', 'KICI_PLATFORM_INSTANCE_ID', 'KICI_TMPDIR'];
 /** Doc-friendly description map (consumed by the env-reference generator). */
 export declare const LOGGER_ENV_FIELD_SPECS: EnvFieldSpec[];
 //# sourceMappingURL=logger-env.d.ts.map

package/dist/env/logger-env.js

@@ -4,13 +4,14 @@ import { z } from "zod";
 /**
 * Shared LoggerEnv schema.
 *
-* The logger (packages/shared/src/logger.ts) reads these env vars *before*
-* the per-service config loads, so we can't include them in the service
-* schemas the normal way. We still want them in `docs/operator/env-reference.md`
-* and in `validateUnknownKiciVars()`'s known-var set, so this schema documents
-* them in one place. Each service includes the keys here when computing its
-* "known KICI_* vars" list, and the docs generator emits a "Logger / shared"
-* section from this schema.
+* The logger (packages/core/src/logger.ts) reads these env vars *before*
+* the per-service config loads — as does `kiciTmpBase()`
+* (packages/core/src/tmp.ts) for the `KICI_TMPDIR` entry below — so we can't
+* include them in the service schemas the normal way. We still want them in
+* `docs/operator/env-reference.md` and in `validateUnknownKiciVars()`'s
+* known-var set, so this schema documents them in one place. Each service
+* includes the keys here when computing its "known KICI_* vars" list, and the
+* docs generator emits a "Logger / shared" section from this schema.
 *
 * IMPORTANT: do not change the runtime behaviour of `logger.ts` from this
 * schema — the schema is documentation + the unknown-var allowlist, not the
@@ -36,7 +37,13 @@ const LoggerEnvSchema = z.object({
 	/** Set by the agent process; used as a filename suffix. */
 	KICI_AGENT_ID: z.string().optional(),
 	/** Set by the platform process; used as a filename suffix. */
-	KICI_PLATFORM_INSTANCE_ID: z.string().optional()
+	KICI_PLATFORM_INSTANCE_ID: z.string().optional(),
+	/**
+	* Base directory for KiCI-created temp files (repo clones, build scratch,
+	* deploy render dirs). Read by `kiciTmpBase()` before any service config
+	* loads; defaults to the OS temp dir when unset.
+	*/
+	KICI_TMPDIR: z.string().optional()
 });
 /** All env vars the logger reads, for the unknown-KICI-var scanner. */
 const LOGGER_ENV_VARS = [
@@ -46,7 +53,8 @@ const LOGGER_ENV_VARS = [
 	"KICI_LOG_FORMAT",
 	"KICI_CLUSTER_INSTANCE_ID",
 	"KICI_AGENT_ID",
-	"KICI_PLATFORM_INSTANCE_ID"
+	"KICI_PLATFORM_INSTANCE_ID",
+	"KICI_TMPDIR"
 ];
 /** Doc-friendly description map (consumed by the env-reference generator). */
 const LOGGER_ENV_FIELD_SPECS = [
@@ -108,6 +116,14 @@ const LOGGER_ENV_FIELD_SPECS = [
 		required: false,
 		type: "string",
 		description: "Stable Platform identifier; appended to the platform log filename so multiple instances can share one KICI_LOG_DIR."
+	},
+	{
+		envVar: "KICI_TMPDIR",
+		aliases: [],
+		fieldPath: "KICI_TMPDIR",
+		required: false,
+		type: "string",
+		description: "Base directory for KiCI-created temporary files (repo clones, build scratch, deploy render dirs). Defaults to the operating system temp directory. Set it to a path on a volume with free space when the default temp filesystem is small."
 	}
 ];
 //#endregion

package/dist/idempotency-files.d.ts

@@ -63,6 +63,13 @@ export interface FileDriftEntry {
     remoteContent?: string;
     /** Set when content capture was intentionally skipped — used by the renderer to explain the gap. */
     contentSkipped?: ContentSkipReason;
+    /**
+     * Fleet machine the remote side of this comparison lives on. Stamped by the
+     * preview helpers, which already know the box. Consumers that aggregate
+     * drift across a whole fleet need it to attribute a file to a machine —
+     * `remotePath` alone is identical on every box.
+     */
+    box?: string;
     /**
      * Renderer hint. When omitted, the renderer auto-detects from
      * `remotePath`: `.env` → `'env-semantic'`, `.yaml` / `.yml` →

package/dist/index.d.ts

@@ -1,17 +1,19 @@
 export * from '@kici-dev/core';
+export * from './agent-platform.js';
 export { encrypt, decrypt, deriveKey, generateMasterKey, type EncryptedValue, } from './secret-crypto.js';
 export { RingBuffer } from './ring-buffer.js';
 export { redactConfig, addLogsToArchive, MAX_LOG_BYTES } from './diagnostics/bundle-archive.js';
 export { chunkBuffer, BundleChunkAssembler, ChunkRequestWaiter, FLEET_CHUNK_BYTES, type BundleChunkFrame, } from './diagnostics/bundle-chunks.js';
-export { createPool, createDb, type CreatePoolOptions, type PgPoolErrorSource } from './db.js';
+export { createPool, createDb, isPoolAcquireTimeout, type CreatePoolOptions, type PgPoolErrorSource, type PoolAcquireOutcome, } from './db.js';
 export { isPgUniqueViolation } from './pg-errors.js';
-export { parseDatabaseUrl, maskDatabaseUrl, dropAndCreateDatabase, dropDatabaseDirect, ensureDatabase, type EnsureDatabaseOpts, createDbRole, createReadOnlyDbUser, computeMigrationsHash, storeMigrationContentHash, readStoredMigrationContentHash, isSchemaCurrent, clearDispatchQueueDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, purgeScopedSecretsDirect, purgeEnvironmentsDirect, seedEnvironmentDirect, deleteEnvironmentDirect, seedEnvironmentBindingDirect, setEnvironmentPolicyDirect, listEnvironmentsDirect, showEnvironmentDirect, createEnvironmentTemplateDirect, setEnvironmentSecretDirect, listQueueDirect, showQueueEntryDirect, listExecutionRunsDirect, showExecutionRunDirect, listExecutionJobsDirect, listRegistrationsDirect, showRegistrationDirect, registerWorkflowManualDirect, resetRaftStateDirect, emitKiciEventDirect, seedGenericWebhookSourceDirect, purgeSecretBackendsDirect, apiKeyExistsDirect, seedApiKeyInlineDirect, platformConnectionExistsDirect, countWebhookSourcesByConnectionIdDirect, getWebhookSourceByRoutingKeyDirect, findAnyUserApiKeyIdDirect, seedSyntheticGithubSourceDirect, seedWebhookSecretDirect, seedSourcePrivateKeyDirect, bumpRegistryVersionDirect, pollKiciEventsDirect, waitForPostgresDirect, waitForRunCompletionDirect, cleanupExecutionRowsDirect, isSchemaCurrentFromFilesDirect, storeMigrationContentHashInTableDirect, createJoinTokenDirect, deleteJoinTokensByCreatedByDirect, updateSourceRoutingKeyDirect, prunePeerCredentialsDirect, waitForPlatformRegistrationsDirect, seedUniversalGitSourceDirect, seedCiSecurityFixturesDirect, waitForExecutionRunStatusSinceDirect, latestExecutionRunByStatusDirect, waitForLatestExecutionJobStatusDirect, describeTableColumnsDirect, tableExistsDirect, insertKiciEventRawDirect, showKiciEventDirect, listKiciEventsDirect, deleteKiciEventsDirect, insertKiciEventAtDirect, paginateUnprocessedEventsKeysetDirect, verifyKiciEventNotifyDirect, seedCrossRepoTrustDirect, listCrossRepoTrustBySourceRoutingKeyDirect, deleteCrossRepoTrustDirect, insertCrossRepoTrustStrictDirect, deleteWorkflowRegistrationsDirect, getWorkflowRegistrationByIdDirect, listRegistrationsByRoutingKeyDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, updateWorkflowRegistrationCommitShaDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, getRegistryVersionDirect, bumpRegistryVersionSimpleDirect, upsertCronLastFiredDirect, countCronLastFiredDirect, insertCronLastFiredNowDirect, deleteCronLastFiredDirect, deleteExecutionRunsByWorkflowNameDirect, getGenericWebhookSourceByRoutingKeyDirect, listActiveGenericWebhookSourcesDirect, updateGenericWebhookVerificationConfigDirect, deleteGenericWebhookSourcesByNameDirect, restoreSoftDeletedGenericWebhookSourceDirect, upsertOrgSettingsGlobalWorkflowsDirect, updateOrgSettingsDeniedReposDirect, deleteOrgSettingsByCustomerIdDirect, getExecutionRunSecurityDirect, getHeldRunByIdDirect, listHeldRunApprovalsDirect, countHeldRunsByRunIdDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForEventLogRowByDeliveryIdDirect, resolvePlatformWebhookSourceRoutingKeyDirect, ensureOrgOwnerMemberDirect, deletePeerCredentialsByInstanceIdLikeDirect, insertPeerCredentialExpiredDirect, getPeerCredentialRevokedAtDirect, listActivePeerCredentialsExcludingDirect, clearPeerCredentialsRevokedAtByIdsDirect, countActivePeerCredentialsByInstanceDirect, terminateIdleDbBackendsDirect, type ColumnInfo, type KiciEventRow, type CrossRepoTrustRow, type WorkflowRegistrationFullRow, type RegistrationsScopedResult, type LatestExecutionRunResult, type WaitForLatestJobResult, type ExecutionRunSecurityRow, type HeldRunSecurityRow, type EventLogRow as PlatformEventLogRow, type UpsertOrgSettingsOpts, type OrgSettingsRepoPatternEntry, type InsertKiciEventRawOpts, type EmitKiciEventOpts, type SeedGenericWebhookSourceOpts, REGISTERABLE_TRIGGER_TYPES, MIGRATION_HASH_TABLE, type PurgeStaleExecutionResult, type PurgeStaleSourcesResult, type SeedEnvironmentOpts, type SeedEnvironmentResult, type SeedEnvironmentBindingOpts, type SetEnvironmentPolicyOpts, type EnvironmentRow, type EnvironmentVariableRow, type EnvironmentBindingRow, type ShowEnvironmentResult, type CreateEnvironmentTemplateOpts, type SetEnvironmentSecretOpts, type DispatchQueueRow, type ListQueueOpts, type ExecutionRunRow, type ExecutionJobRow, type ListExecutionRunsOpts, type WorkflowRegistrationRow, type ListRegistrationsOpts, type ListRegistrationsResult, type ShowRegistrationResult, type RegisterWorkflowManualOpts, type RegisterWorkflowManualResult, } from './db-admin.js';
+export { parseDatabaseUrl, maskDatabaseUrl, dropAndCreateDatabase, dropDatabaseDirect, ensureDatabase, type EnsureDatabaseOpts, createDbRole, createReadOnlyDbUser, computeMigrationsHash, storeMigrationContentHash, readStoredMigrationContentHash, isSchemaCurrent, clearDispatchQueueDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, purgeScopedSecretsDirect, purgeContextsDirect, seedContextDirect, deleteContextDirect, seedContextBindingDirect, setContextPolicyDirect, listContextsDirect, showContextDirect, createContextTemplateDirect, setContextSecretDirect, listQueueDirect, showQueueEntryDirect, listExecutionRunsDirect, showExecutionRunDirect, listCheckRunTrackingDirect, listExecutionJobsDirect, listRegistrationsDirect, showRegistrationDirect, registerWorkflowManualDirect, resetRaftStateDirect, emitKiciEventDirect, seedGenericWebhookSourceDirect, purgeSecretBackendsDirect, apiKeyExistsDirect, seedApiKeyInlineDirect, platformConnectionExistsDirect, countWebhookSourcesByConnectionIdDirect, getWebhookSourceByRoutingKeyDirect, findAnyUserApiKeyIdDirect, seedSyntheticGithubSourceDirect, seedWebhookSecretDirect, seedSourcePrivateKeyDirect, bumpRegistryVersionDirect, pollKiciEventsDirect, waitForPostgresDirect, waitForRunCompletionDirect, cleanupExecutionRowsDirect, isSchemaCurrentFromFilesDirect, storeMigrationContentHashInTableDirect, createJoinTokenDirect, deleteJoinTokensByCreatedByDirect, updateSourceRoutingKeyDirect, prunePeerCredentialsDirect, waitForPlatformRegistrationsDirect, seedUniversalGitSourceDirect, seedCiSecurityFixturesDirect, CI_SECURITY_OTHER_REPO, waitForExecutionRunReachesStatusSinceDirect, latestExecutionRunByStatusDirect, waitForLatestExecutionJobStatusDirect, describeTableColumnsDirect, tableExistsDirect, insertKiciEventRawDirect, showKiciEventDirect, listKiciEventsDirect, deleteKiciEventsDirect, insertKiciEventAtDirect, paginateUnprocessedEventsKeysetDirect, verifyKiciEventNotifyDirect, seedCrossRepoTrustDirect, listCrossRepoTrustBySourceRoutingKeyDirect, deleteCrossRepoTrustDirect, insertCrossRepoTrustStrictDirect, deleteWorkflowRegistrationsDirect, getWorkflowRegistrationByIdDirect, listRegistrationsByRoutingKeyDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, updateWorkflowRegistrationCommitShaDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, getRegistryVersionDirect, bumpRegistryVersionSimpleDirect, upsertCronLastFiredDirect, countCronLastFiredDirect, insertCronLastFiredNowDirect, deleteCronLastFiredDirect, deleteExecutionRunsByWorkflowNameDirect, getGenericWebhookSourceByRoutingKeyDirect, listActiveGenericWebhookSourcesDirect, updateGenericWebhookVerificationConfigDirect, deleteGenericWebhookSourcesByNameDirect, restoreSoftDeletedGenericWebhookSourceDirect, upsertOrgSettingsGlobalWorkflowsDirect, updateOrgSettingsDeniedReposDirect, deleteOrgSettingsByCustomerIdDirect, getExecutionRunSecurityDirect, getHeldRunByIdDirect, listHeldRunApprovalsDirect, countHeldRunsByRunIdDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForEventLogRowByDeliveryIdDirect, resolvePlatformWebhookSourceRoutingKeyDirect, ensureOrgOwnerMemberDirect, deletePeerCredentialsByInstanceIdLikeDirect, insertPeerCredentialExpiredDirect, getPeerCredentialRevokedAtDirect, listActivePeerCredentialsExcludingDirect, clearPeerCredentialsRevokedAtByIdsDirect, countActivePeerCredentialsByInstanceDirect, terminateIdleDbBackendsDirect, type ColumnInfo, type KiciEventRow, type CrossRepoTrustRow, type WorkflowRegistrationFullRow, type RegistrationsScopedResult, type LatestExecutionRunResult, type WaitForLatestJobResult, type ExecutionRunSecurityRow, type HeldRunSecurityRow, type EventLogRow as PlatformEventLogRow, type UpsertOrgSettingsOpts, type OrgSettingsRepoPatternEntry, type InsertKiciEventRawOpts, type EmitKiciEventOpts, type SeedGenericWebhookSourceOpts, REGISTERABLE_TRIGGER_TYPES, MIGRATION_HASH_TABLE, type PurgeStaleExecutionResult, type PurgeStaleSourcesResult, type SeedContextOpts, type SeedContextResult, type SeedContextBindingOpts, type SetContextPolicyOpts, type ContextRow, type ContextVariableRow, type ContextBindingRow, type ShowContextResult, type CreateContextTemplateOpts, type SetContextSecretOpts, type DispatchQueueRow, type ListQueueOpts, type ExecutionRunRow, type ExecutionJobRow, type ListExecutionRunsOpts, type CheckRunTrackingDirectRow, type ListCheckRunTrackingOpts, type WorkflowRegistrationRow, type ListRegistrationsOpts, type ListRegistrationsResult, type ShowRegistrationResult, type RegisterWorkflowManualOpts, type RegisterWorkflowManualResult, } from './db-admin.js';
 export { createMetricsRoutes, type MetricsRoutesDeps } from './routes/metrics.js';
 export { createHealthRoutes, type HealthRoutesDeps } from './routes/health.js';
 export { getReconnectDelay } from './reconnect-delay.js';
 export { initTelemetry, getPrometheusExporter, collectRuntimeMetricNames, createMeter, type TelemetryConfig, } from './telemetry/index.js';
 export { setupGracefulShutdown, type ShutdownStep, type ShutdownLogger, type ShutdownHandle, type GracefulShutdownOptions, } from './graceful-shutdown.js';
 export { validateRequiredTools, type ToolRequirement } from './tool-check.js';
+export { kiciTmpBase, kiciMkdtemp } from './tmp-dir.js';
 export { createS3Client, type CreateS3ClientOptions, type SharedS3Config } from './s3-client.js';
 export { BaseColdStore, ChunkLru, COLD_BUCKET_NAMES, DEFAULT_TABLE_CONFIG, chunkObjectKey, coldDaysToBucket, coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal, computeChunkId, decodeChunk, encodeChunk, encodeKeySegment, isLongerColdRetention, parseManifest, resolveTableConfig, serializeManifest, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix, type ArchiveCycleSummary, type BaseColdStoreDeps, type ChunkCommitMetadata, type ChunkLruOptions, type ChunkManifest, type ColdBucketName, type ColdRetention, type ColdStore, type ColdStoreConfig, type ColdStoreFetchRangeArgs, type ColdStoreReplayChunkArgs, type ColdStoreReplayResult, type ColdStoreReplayRowArgs, type ColdStoreTableConfig, type DbKind, type DecodeChunkArgs, type EligiblePartition, type EncodeChunkArgs, type EncodedChunk, type PurgeableChunk, type PurgeChunkResult, type PurgeExpiredChunksOpts, type PurgeExpiredChunksSummary, type TableAdapter, } from './cold-store/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,6 +1,7 @@
 import "./rolldown-runtime-ClRpJifh.js";
-import { createDb, createPool } from "./db.js";
-import { MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createDbRole, createEnvironmentTemplateDirect, createJoinTokenDirect, createReadOnlyDbUser, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteEnvironmentDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listEnvironmentsDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeEnvironmentsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedCrossRepoTrustDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, showEnvironmentDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect } from "./db-admin.js";
+import { AgentDeliveryMode, AgentPlatform, splitAgentPlatform } from "./agent-platform.js";
+import { createDb, createPool, isPoolAcquireTimeout } from "./db.js";
+import { CI_SECURITY_OTHER_REPO, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createContextTemplateDirect, createDbRole, createJoinTokenDirect, createReadOnlyDbUser, deleteContextDirect, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCheckRunTrackingDirect, listContextsDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedContextBindingDirect, seedContextDirect, seedCrossRepoTrustDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setContextPolicyDirect, setContextSecretDirect, showContextDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunReachesStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect } from "./db-admin.js";
 import { setupGracefulShutdown } from "./graceful-shutdown.js";
 import { decrypt, deriveKey, encrypt, generateMasterKey } from "./secret-crypto.js";
 import { RingBuffer } from "./ring-buffer.js";
@@ -14,6 +15,7 @@ import { collectRuntimeMetricNames, getPrometheusExporter, initTelemetry } from
 import { createMeter } from "./telemetry/metrics.js";
 import "./telemetry/index.js";
 import { validateRequiredTools } from "./tool-check.js";
+import { kiciMkdtemp, kiciTmpBase } from "./tmp-dir.js";
 import { createS3Client } from "./s3-client.js";
 import { chunkObjectKey, encodeKeySegment, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix } from "./cold-store/key.js";
 import { COLD_BUCKET_NAMES, coldDaysToBucket, isLongerColdRetention } from "./cold-store/bucket.js";
@@ -21,9 +23,9 @@ import { computeChunkId } from "./cold-store/chunk-id.js";
 import { decodeChunk, encodeChunk } from "./cold-store/chunk-encoder.js";
 import { parseManifest, serializeManifest } from "./cold-store/manifest.js";
 import { coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal } from "./cold-store/metrics.js";
+import { DEFAULT_TABLE_CONFIG, resolveTableConfig } from "./cold-store/config.js";
 import { BaseColdStore } from "./cold-store/cold-store.js";
 import { ChunkLru } from "./cold-store/lru.js";
-import { DEFAULT_TABLE_CONFIG, resolveTableConfig } from "./cold-store/config.js";
 import "./cold-store/index.js";
 export * from "@kici-dev/core";
-export { BaseColdStore, BundleChunkAssembler, COLD_BUCKET_NAMES, ChunkLru, ChunkRequestWaiter, DEFAULT_TABLE_CONFIG, FLEET_CHUNK_BYTES, MAX_LOG_BYTES, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, RingBuffer, addLogsToArchive, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, chunkBuffer, chunkObjectKey, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, coldDaysToBucket, coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal, collectRuntimeMetricNames, computeChunkId, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createDb, createDbRole, createEnvironmentTemplateDirect, createHealthRoutes, createJoinTokenDirect, createMeter, createMetricsRoutes, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, decrypt, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteEnvironmentDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, deriveKey, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, encodeChunk, encodeKeySegment, encrypt, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, generateMasterKey, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getPrometheusExporter, getReconnectDelay, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, initTelemetry, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isLongerColdRetention, isPgUniqueViolation, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listEnvironmentsDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, parseManifest, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeEnvironmentsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, redactConfig, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, resolveTableConfig, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedCrossRepoTrustDirect, seedEnvironmentBindingDirect, seedEnvironmentDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, serializeManifest, setEnvironmentPolicyDirect, setEnvironmentSecretDirect, setupGracefulShutdown, showEnvironmentDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, validateRequiredTools, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };
+export { AgentDeliveryMode, AgentPlatform, BaseColdStore, BundleChunkAssembler, CI_SECURITY_OTHER_REPO, COLD_BUCKET_NAMES, ChunkLru, ChunkRequestWaiter, DEFAULT_TABLE_CONFIG, FLEET_CHUNK_BYTES, MAX_LOG_BYTES, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, RingBuffer, addLogsToArchive, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, chunkBuffer, chunkObjectKey, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, coldDaysToBucket, coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal, collectRuntimeMetricNames, computeChunkId, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createContextTemplateDirect, createDb, createDbRole, createHealthRoutes, createJoinTokenDirect, createMeter, createMetricsRoutes, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, decrypt, deleteContextDirect, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, deriveKey, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, encodeChunk, encodeKeySegment, encrypt, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, generateMasterKey, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getPrometheusExporter, getReconnectDelay, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, initTelemetry, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isLongerColdRetention, isPgUniqueViolation, isPoolAcquireTimeout, isSchemaCurrent, isSchemaCurrentFromFilesDirect, kiciMkdtemp, kiciTmpBase, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCheckRunTrackingDirect, listContextsDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, parseManifest, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, redactConfig, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, resolveTableConfig, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedContextBindingDirect, seedContextDirect, seedCrossRepoTrustDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, serializeManifest, setContextPolicyDirect, setContextSecretDirect, setupGracefulShutdown, showContextDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, splitAgentPlatform, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, validateRequiredTools, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunReachesStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };