@kici-dev/shared 0.1.27 → 0.2.0

package/dist/db-admin.js

@@ -2,6 +2,7 @@ import "./rolldown-runtime-ClRpJifh.js";
 import { createPool } from "./db.js";
 import { createHash } from "node:crypto";
 import pg from "pg";
+import { HoldType, unknownContributorHoldReason } from "@kici-dev/engine";
 //#region src/db-admin.ts
 /**
 * Admin/DB-operations helpers shared between `kici-admin` (orchestrator DB)
@@ -389,13 +390,19 @@ const ENV_POLICY_COLUMNS = /* @__PURE__ */ new Set([
 	"allow_local_execution"
 ]);
 /**
-* Upsert an context row keyed by (org_id, name). Returns the env id and
+* Upsert a context row keyed by (org_id, name). Returns the env id and
 * whether the row was newly inserted. `branchRestrictions` / `requiredReviewers`
 * are JSON-serialised server-side; pass them as plain arrays or objects.
+*
+* An omitted `holdExpirySeconds` is written as NULL rather than a literal
+* window: the column carries no DDL default, so "never set" and "cleared" both
+* land on NULL and resolve through the one `DEFAULT_HOLD_EXPIRY_SECONDS`
+* fallback on read. Writing a literal here would give this path a second,
+* longer default that no read-side code knows about.
 */
 async function seedContextDirect(databaseUrl, opts) {
 	if (opts.waitTimerSeconds != null && opts.waitTimerSeconds < 0) throw new Error(`context: waitTimerSeconds must be >= 0 (got ${opts.waitTimerSeconds})`);
-	if (opts.holdExpirySeconds != null && opts.holdExpirySeconds < 0) throw new Error(`context: holdExpirySeconds must be >= 0 (got ${opts.holdExpirySeconds})`);
+	if (opts.holdExpirySeconds != null && opts.holdExpirySeconds < 1) throw new Error(`context: holdExpirySeconds must be >= 1 (got ${opts.holdExpirySeconds})`);
 	const pool = new pg.Pool({
 		connectionString: databaseUrl,
 		max: 1
@@ -407,7 +414,7 @@ async function seedContextDirect(databaseUrl, opts) {
           (org_id, name, type, enabled, branch_restrictions, required_reviewers,
            wait_timer_seconds, hold_expiry_seconds, minimum_trust, glob_pattern)
         VALUES ($1, $2, COALESCE($3, 'fixed'), COALESCE($4, true), $5::jsonb, $6::jsonb,
-                $7, COALESCE($8, 86400), $9, $10)
+                $7, $8, $9, $10)
         ON CONFLICT (org_id, name) DO UPDATE SET
           type = COALESCE(EXCLUDED.type, contexts.type),
           enabled = EXCLUDED.enabled,
@@ -440,7 +447,7 @@ async function seedContextDirect(databaseUrl, opts) {
 	}
 }
 /**
-* Delete an context keyed by (org_id, name). Returns whether a row was
+* Delete a context keyed by (org_id, name). Returns whether a row was
 * removed. The `context_bindings`, `context_variables`, and
 * `context_source_overrides` children all carry
 * `FOREIGN KEY (context_id) REFERENCES contexts(id) ON DELETE CASCADE`,
@@ -499,7 +506,7 @@ async function seedContextBindingDirect(databaseUrl, opts) {
 */
 async function setContextPolicyDirect(databaseUrl, opts) {
 	if (opts.waitTimerSeconds != null && opts.waitTimerSeconds < 0) throw new Error(`context: waitTimerSeconds must be >= 0 (got ${opts.waitTimerSeconds})`);
-	if (opts.holdExpirySeconds != null && opts.holdExpirySeconds < 0) throw new Error(`context: holdExpirySeconds must be >= 0 (got ${opts.holdExpirySeconds})`);
+	if (opts.holdExpirySeconds != null && opts.holdExpirySeconds < 1) throw new Error(`context: holdExpirySeconds must be >= 1 (got ${opts.holdExpirySeconds})`);
 	const setClauses = [];
 	const params = [];
 	let idx = 1;
@@ -587,11 +594,16 @@ async function showContextDirect(databaseUrl, opts) {
 	}
 }
 /**
-* Create (or update) an context template + its seed variables in one
+* Create (or update) a context template + its seed variables in one
 * transaction. Templates are represented as contexts with `type='template'`
 * by convention. Returns `{ envId, variablesSet }`.
+*
+* An omitted `holdExpirySeconds` is written as NULL rather than a literal
+* window, for the same reason as `seedContextDirect`: the column has no DDL
+* default and every read resolves NULL through `DEFAULT_HOLD_EXPIRY_SECONDS`.
 */
 async function createContextTemplateDirect(databaseUrl, opts) {
+	if (opts.holdExpirySeconds != null && opts.holdExpirySeconds < 1) throw new Error(`context: holdExpirySeconds must be >= 1 (got ${opts.holdExpirySeconds})`);
 	const pool = new pg.Pool({
 		connectionString: databaseUrl,
 		max: 1
@@ -602,7 +614,7 @@ async function createContextTemplateDirect(databaseUrl, opts) {
 		const row = (await client.query(`INSERT INTO contexts
           (org_id, name, type, enabled, branch_restrictions, required_reviewers,
            wait_timer_seconds, hold_expiry_seconds, minimum_trust)
-        VALUES ($1, $2, COALESCE($3, 'template'), true, $4::jsonb, $5::jsonb, $6, COALESCE($7, 86400), $8)
+        VALUES ($1, $2, COALESCE($3, 'template'), true, $4::jsonb, $5::jsonb, $6, $7, $8)
         ON CONFLICT (org_id, name) DO UPDATE SET
           type = COALESCE(EXCLUDED.type, contexts.type),
           branch_restrictions = EXCLUDED.branch_restrictions,
@@ -800,6 +812,38 @@ async function listExecutionRunsDirect(databaseUrl, opts = {}) {
 	}
 }
 /**
+* READ-ONLY: SELECT check_run_tracking rows for a commit. One row per
+* `(provider, owner, repo, sha, check_name)`, ordered by check_name.
+*
+* Each column answers a different question. `check_run_id` is written once,
+* when the check run is created in the `queued` state, so it answers "did we
+* create it?". `terminal_sent_at` is stamped only after the provider accepts
+* the terminal `completed` PATCH, so it answers "did we complete it?". Every
+* write here is best-effort, so a null column is "no record", never proof of
+* failure — see the per-field notes for what each one does and does not prove.
+*/
+async function listCheckRunTrackingDirect(databaseUrl, opts) {
+	const pool = createPool(databaseUrl);
+	try {
+		const clauses = ["sha = $1"];
+		const params = [opts.sha];
+		if (opts.checkName !== void 0) {
+			clauses.push(`check_name = $2`);
+			params.push(opts.checkName);
+		}
+		const limit = Math.max(1, Math.min(1e3, opts.limit ?? 50));
+		return { rows: (await pool.query(`SELECT provider, owner, repo, sha, check_name,
+              check_run_id::text AS check_run_id,
+              build_creation_state, run_id, in_progress_sent_at, terminal_sent_at
+         FROM check_run_tracking
+        WHERE ${clauses.join(" AND ")}
+        ORDER BY check_name
+        LIMIT ${limit}`, params)).rows };
+	} finally {
+		await pool.end();
+	}
+}
+/**
 * READ-ONLY: fetch a single run by run_id AND its jobs. Throws if no run
 * matches the run_id. Jobs list may be empty for pending runs.
 */
@@ -1648,6 +1692,8 @@ async function seedUniversalGitSourceDirect(databaseUrl, opts) {
 		await pool.end();
 	}
 }
+/** repo_identifier used for the different-repo isolation hold. */
+const CI_SECURITY_OTHER_REPO = "other/repo";
 async function seedCiSecurityFixturesDirect(databaseUrl, opts) {
 	const contextName = opts.contextName ?? "ci-security-env";
 	const sourceName = opts.sourceName ?? "ci-security-dashboard-resolver";
@@ -1665,33 +1711,85 @@ async function seedCiSecurityFixturesDirect(databaseUrl, opts) {
        VALUES ($1, $2, \'fixed\', true)
        ON CONFLICT (org_id, name) DO UPDATE SET enabled = true
        RETURNING id`, [opts.orgId, contextName])).rows[0].id;
+		async function seedPrHold(args) {
+			await pool.query(`INSERT INTO execution_runs (
+          run_id, workflow_name, provider, repo_identifier,
+          ref, sha, delivery_id, status, trust_tier, lock_file_source,
+          contributor_username, routing_key, pr_number
+        ) VALUES ($1, \'e2e-security-wf\', \'internal\', $4, \'refs/heads/feature\',
+          $5, $2, \'pending\', \'unknown\', \'base\', \'unknown-dev\', $3, $6)`, [
+				args.runId,
+				args.deliveryId,
+				opts.runsRoutingKey,
+				args.repoIdentifier,
+				args.sha,
+				args.prNumber
+			]);
+			await pool.query(`INSERT INTO execution_jobs (job_id, run_id, job_name, status)
+         VALUES ($1, $2, \'security-test-job\', \'pending\')`, [args.jobId, args.runId]);
+			return (await pool.query(`INSERT INTO held_runs (org_id, run_id, job_id, context_id, hold_type, queue_type, reason, expires_at)
+         VALUES ($1, $2, $3, $4, $5, \'security\', $6, NOW() + INTERVAL \'72 hours\')
+         RETURNING id`, [
+				opts.orgId,
+				args.runId,
+				args.jobId,
+				args.contextId === void 0 ? envId : args.contextId,
+				args.holdType ?? HoldType.enum.security,
+				args.reason ?? unknownContributorHoldReason(contextName)
+			])).rows[0].id;
+		}
+		const heldRunId = await seedPrHold({
+			runId: opts.unknownRunId,
+			deliveryId: opts.unknownDeliveryId,
+			jobId: opts.unknownJobId,
+			repoIdentifier: ".",
+			prNumber: 1,
+			sha: "abc123"
+		});
+		const secondHeldRunId = await seedPrHold({
+			runId: opts.secondPrRunId,
+			deliveryId: opts.secondPrDeliveryId,
+			jobId: opts.secondPrJobId,
+			repoIdentifier: ".",
+			prNumber: 2,
+			sha: "bbb222"
+		});
+		const otherRepoHeldRunId = await seedPrHold({
+			runId: opts.otherRepoRunId,
+			deliveryId: opts.otherRepoDeliveryId,
+			jobId: opts.otherRepoJobId,
+			repoIdentifier: CI_SECURITY_OTHER_REPO,
+			prNumber: 1,
+			sha: "ccc333"
+		});
+		const wfModHeldRunId = await seedPrHold({
+			runId: opts.wfModRunId,
+			deliveryId: opts.wfModDeliveryId,
+			jobId: opts.wfModJobId,
+			repoIdentifier: ".",
+			prNumber: 3,
+			sha: "ddd444",
+			holdType: HoldType.enum.security,
+			reason: "workflow_modification",
+			contextId: null
+		});
+		const forkPrHeldRunId = await seedPrHold({
+			runId: opts.forkPrRunId,
+			deliveryId: opts.forkPrDeliveryId,
+			jobId: opts.forkPrJobId,
+			repoIdentifier: ".",
+			prNumber: 4,
+			sha: "eee555",
+			holdType: HoldType.enum.security,
+			reason: "fork_pr",
+			contextId: null
+		});
 		await pool.query(`INSERT INTO execution_runs (
         run_id, workflow_name, provider, repo_identifier,
         ref, sha, delivery_id, status, trust_tier, lock_file_source,
-        contributor_username, routing_key
-      ) VALUES ($1, \'e2e-security-wf\', \'internal\', \'.\', \'refs/heads/feature\',
-        \'abc123\', $2, \'pending\', \'unknown\', \'base\', \'unknown-dev\', $3)`, [
-			opts.unknownRunId,
-			opts.unknownDeliveryId,
-			opts.runsRoutingKey
-		]);
-		await pool.query(`INSERT INTO execution_jobs (job_id, run_id, job_name, status)
-       VALUES ($1, $2, \'security-test-job\', \'pending\')`, [opts.unknownJobId, opts.unknownRunId]);
-		const heldRunId = (await pool.query(`INSERT INTO held_runs (org_id, run_id, job_id, context_id, hold_type, queue_type, reason, expires_at)
-       VALUES ($1, $2, $3, $4, \'unknown_contributor\', \'security\',
-        \'Unknown contributor requires approval\', NOW() + INTERVAL \'72 hours\')
-       RETURNING id`, [
-			opts.orgId,
-			opts.unknownRunId,
-			opts.unknownJobId,
-			envId
-		])).rows[0].id;
-		await pool.query(`INSERT INTO execution_runs (
-        run_id, workflow_name, provider, repo_identifier,
-        ref, sha, delivery_id, status, trust_tier, lock_file_source,
-        contributor_username, routing_key
+        contributor_username, routing_key, pr_number
       ) VALUES ($1, \'e2e-security-wf\', \'internal\', \'.\', \'refs/heads/feature\',
-        \'def456\', $2, \'running\', \'trusted\', \'head\', \'trusted-dev\', $3)`, [
+        \'def456\', $2, \'running\', \'trusted\', \'head\', \'trusted-dev\', $3, 1)`, [
 			opts.trustedRunId,
 			opts.trustedDeliveryId,
 			opts.runsRoutingKey
@@ -1699,31 +1797,43 @@ async function seedCiSecurityFixturesDirect(databaseUrl, opts) {
 		await pool.query(`INSERT INTO execution_jobs (job_id, run_id, job_name, status)
        VALUES ($1, $2, \'security-test-job\', \'running\')`, [opts.trustedJobId, opts.trustedRunId]);
 		return {
+			contextName,
 			envId,
-			heldRunId
+			heldRunId,
+			secondHeldRunId,
+			otherRepoHeldRunId,
+			wfModHeldRunId,
+			forkPrHeldRunId
 		};
 	} finally {
 		await pool.end();
 	}
 }
 /**
-* Poll `execution_runs` for at least one row matching `status` whose
-* `started_at > since`. Used by cluster/job-reroute tests to gate on
-* a workflow reaching the terminal state after a webhook trigger.
+* Poll `execution_runs` for the newest run started since `since` whose status
+* is in `statuses`, returning that status. Resolves `{ status: null }` if the
+* deadline passes before any run reaches a target status.
+*
+* Callers wanting "did the run finish?" pass the terminal status set and read
+* the landed status — a terminal failure is reported immediately rather than
+* indistinguishable from a timeout. Used by the cluster reroute tests to gate
+* on a workflow reaching a terminal state after a webhook trigger.
 */
-async function waitForExecutionRunStatusSinceDirect(databaseUrl, opts) {
-	const timeoutMs = opts.timeoutMs ?? 12e4;
+async function waitForExecutionRunReachesStatusSinceDirect(databaseUrl, opts) {
+	const timeoutMs = opts.timeoutMs ?? 24e4;
 	const intervalMs = opts.intervalMs ?? 5e3;
 	const deadline = Date.now() + timeoutMs;
 	const pool = createPool(databaseUrl);
 	try {
 		while (Date.now() < deadline) {
-			if ((await pool.query(`SELECT 1 FROM execution_runs
-         WHERE started_at > $1 AND status = $2
-         LIMIT 1`, [opts.since, opts.status])).rows.length > 0) return { found: true };
+			const result = await pool.query(`SELECT status FROM execution_runs
+         WHERE started_at > $1 AND status = ANY($2)
+         ORDER BY started_at DESC
+         LIMIT 1`, [opts.since, [...opts.statuses]]);
+			if (result.rows.length > 0) return { status: result.rows[0].status };
 			await new Promise((r) => setTimeout(r, intervalMs));
 		}
-		return { found: false };
+		return { status: null };
 	} finally {
 		await pool.end();
 	}
@@ -2269,11 +2379,15 @@ async function bumpRegistryVersionSimpleDirect(databaseUrl, opts = {}) {
 async function upsertCronLastFiredDirect(databaseUrl, opts) {
 	const pool = createPool(databaseUrl);
 	try {
-		await pool.query(`INSERT INTO cron_last_fired (registration_id, last_fired_at)
-         VALUES ($1, NOW() - ($2)::interval)
-         ON CONFLICT (registration_id) DO UPDATE SET
+		await pool.query(`INSERT INTO cron_last_fired (registration_id, schedule_key, last_fired_at)
+         VALUES ($1, $3, NOW() - ($2)::interval)
+         ON CONFLICT (registration_id, schedule_key) DO UPDATE SET
            last_fired_at = NOW() - ($2)::interval,
-           updated_at = NOW()`, [opts.registrationId, opts.agoInterval]);
+           updated_at = NOW()`, [
+			opts.registrationId,
+			opts.agoInterval,
+			opts.scheduleKey
+		]);
 	} finally {
 		await pool.end();
 	}
@@ -2297,7 +2411,7 @@ async function countCronLastFiredDirect(databaseUrl, opts) {
 async function insertCronLastFiredNowDirect(databaseUrl, opts) {
 	const pool = createPool(databaseUrl);
 	try {
-		await pool.query(`INSERT INTO cron_last_fired (registration_id, last_fired_at) VALUES ($1, NOW())`, [opts.registrationId]);
+		await pool.query(`INSERT INTO cron_last_fired (registration_id, schedule_key, last_fired_at) VALUES ($1, $2, NOW())`, [opts.registrationId, opts.scheduleKey]);
 	} finally {
 		await pool.end();
 	}
@@ -2754,6 +2868,6 @@ async function terminateIdleDbBackendsDirect(databaseUrl) {
 	}
 }
 //#endregion
-export { MIGRATION_HASH_TABLE, PROVIDER_HASH_KEY, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createContextTemplateDirect, createDbRole, createJoinTokenDirect, createReadOnlyDbUser, deleteContextDirect, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listContextsDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedContextBindingDirect, seedContextDirect, seedCrossRepoTrustDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setContextPolicyDirect, setContextSecretDirect, showContextDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };
+export { CI_SECURITY_OTHER_REPO, MIGRATION_HASH_TABLE, PROVIDER_HASH_KEY, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createContextTemplateDirect, createDbRole, createJoinTokenDirect, createReadOnlyDbUser, deleteContextDirect, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCheckRunTrackingDirect, listContextsDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedContextBindingDirect, seedContextDirect, seedCrossRepoTrustDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setContextPolicyDirect, setContextSecretDirect, showContextDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunReachesStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };
 
 //# sourceMappingURL=db-admin.js.map

package/dist/db.d.ts

@@ -2,6 +2,15 @@ import pg from 'pg';
 import { Kysely } from 'kysely';
 /** Where a pg connection error surfaced. */
 export type PgPoolErrorSource = 'idle-pool' | 'client';
+/**
+ * Outcome of a single pool acquire.
+ *
+ * `'timeout'` means the caller waited the pool's full `connectionTimeoutMillis`
+ * and was refused a connection — a load condition. A backend that cannot be
+ * reached rejects with a connection error instead and is deliberately NOT
+ * reported here; that is a different condition with a different owner.
+ */
+export type PoolAcquireOutcome = 'ok' | 'timeout';
 export interface CreatePoolOptions {
     /** Extra pg.Pool config merged over the connection string (e.g. max, connectionTimeoutMillis). */
     config?: Omit<pg.PoolConfig, 'connectionString'>;
@@ -11,6 +20,23 @@ export interface CreatePoolOptions {
      * never replaces the log.
      */
     onError?: (err: Error, source: PgPoolErrorSource) => void;
+    /**
+     * Optional hook invoked once per `pool.connect()` acquire on this pool, with
+     * the outcome and how long the caller waited.
+     *
+     * Only the promise form of `connect` is instrumented, so an acquire made via
+     * `pool.query(...)` is NOT reported — pg implements `query` on top of the
+     * callback form of `connect`. The exclusion is symmetric (neither outcome is
+     * reported), so a ratio derived from this hook stays well-formed; but work
+     * whose acquires must be counted has to go through `pool.connect()`, as
+     * Kysely's PostgresDialect does.
+     *
+     * Opt-in: a pool created without it behaves exactly as before. A consumer
+     * that derives a load signal from acquire outcomes wires it on the pool whose
+     * saturation actually matters to it — one hook shared across unrelated pools
+     * would attribute one pool's exhaustion to another pool's traffic.
+     */
+    onAcquire?: (outcome: PoolAcquireOutcome, waitedMs: number) => void;
 }
 /**
  * Create PostgreSQL connection pool.
@@ -23,6 +49,14 @@ export interface CreatePoolOptions {
  * the next acquire. In-flight query failures still reject to their callers.
  */
 export declare function createPool(databaseUrl: string, options?: CreatePoolOptions): pg.Pool;
+/**
+ * node-postgres rejects a pool-acquire timeout (the `connectionTimeoutMillis`
+ * window elapsed with no free connection) with this exact message. It is the
+ * only signal pg exposes to tell "pool busy (load)" apart from "backend
+ * unreachable". Centralized here + covered by one unit test so a pg-version
+ * bump that changes the string fails loudly in one place.
+ */
+export declare function isPoolAcquireTimeout(err: unknown): boolean;
 /**
  * Create Kysely database instance (PostgreSQL only).
  *

package/dist/db.js

@@ -38,9 +38,38 @@ function createPool(databaseUrl, options) {
 	pool.on("connect", (client) => {
 		client.on("error", (err) => handle(err, "client"));
 	});
+	if (options?.onAcquire) {
+		const report = options.onAcquire;
+		const original = pool.connect.bind(pool);
+		pool.connect = function connect(cb) {
+			if (typeof cb === "function") return original(cb);
+			const startedAt = Date.now();
+			return original().then((client) => {
+				try {
+					report("ok", Date.now() - startedAt);
+				} catch {}
+				return client;
+			}, (err) => {
+				try {
+					if (isPoolAcquireTimeout(err)) report("timeout", Date.now() - startedAt);
+				} catch {}
+				throw err;
+			});
+		};
+	}
 	return pool;
 }
 /**
+* node-postgres rejects a pool-acquire timeout (the `connectionTimeoutMillis`
+* window elapsed with no free connection) with this exact message. It is the
+* only signal pg exposes to tell "pool busy (load)" apart from "backend
+* unreachable". Centralized here + covered by one unit test so a pg-version
+* bump that changes the string fails loudly in one place.
+*/
+function isPoolAcquireTimeout(err) {
+	return err instanceof Error && err.message === "timeout exceeded when trying to connect";
+}
+/**
 * Create Kysely database instance (PostgreSQL only).
 *
 * Generic over the database type so each consumer can provide
@@ -50,6 +79,6 @@ function createDb(pool) {
 	return new Kysely({ dialect: new PostgresDialect({ pool }) });
 }
 //#endregion
-export { createDb, createPool };
+export { createDb, createPool, isPoolAcquireTimeout };
 
 //# sourceMappingURL=db.js.map

package/dist/diagnostics/bundle-archive.js

@@ -1,6 +1,6 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import * as fs from "node:fs";
-import * as path from "node:path";
+import * as path$1 from "node:path";
 //#region src/diagnostics/bundle-archive.ts
 /**
 * Shared debug-bundle archive primitives.
@@ -103,18 +103,18 @@ async function addLogsToArchive(archive, logDir, logWindowHours) {
 	const cutoff = Date.now() - logWindowHours * 60 * 60 * 1e3;
 	const entries = fs.readdirSync(logDir).filter((f) => {
 		if (!f.endsWith(".log")) return false;
-		return fs.statSync(path.join(logDir, f)).mtimeMs >= cutoff;
+		return fs.statSync(path$1.join(logDir, f)).mtimeMs >= cutoff;
 	});
 	entries.sort((a, b) => {
-		const aStat = fs.statSync(path.join(logDir, a));
-		return fs.statSync(path.join(logDir, b)).mtimeMs - aStat.mtimeMs;
+		const aStat = fs.statSync(path$1.join(logDir, a));
+		return fs.statSync(path$1.join(logDir, b)).mtimeMs - aStat.mtimeMs;
 	});
 	let totalBytes = 0;
 	let totalLines = 0;
 	let errors = 0;
 	let warnings = 0;
 	for (const entry of entries) {
-		const filePath = path.join(logDir, entry);
+		const filePath = path$1.join(logDir, entry);
 		const stat = fs.statSync(filePath);
 		if (totalBytes + stat.size > 52428800) break;
 		const content = fs.readFileSync(filePath, "utf-8");

package/dist/env/allowlist.d.ts

@@ -71,6 +71,11 @@
  *                           dashboard's vite.config consults to disable
  *                           the dev proxy), HEADED (Playwright convention
  *                           for `--headed` runs).
+ *   - Vitest runtime      — VITEST_* (vitest's own names, which it reads
+ *                           after config resolution: VITEST_MAX_WORKERS
+ *                           carries the per-process worker ceiling
+ *                           `hack/lib/vitest-workers.ts` publishes, and
+ *                           VITEST_POOL_ID marks a pool worker).
  */
 export declare const OS_SDK_ALLOWLIST_REGEX: RegExp;
 /**

package/dist/env/allowlist.js

@@ -73,8 +73,13 @@ import "../rolldown-runtime-ClRpJifh.js";
 *                           dashboard's vite.config consults to disable
 *                           the dev proxy), HEADED (Playwright convention
 *                           for `--headed` runs).
+*   - Vitest runtime      — VITEST_* (vitest's own names, which it reads
+*                           after config resolution: VITEST_MAX_WORKERS
+*                           carries the per-process worker ceiling
+*                           `hack/lib/vitest-workers.ts` publishes, and
+*                           VITEST_POOL_ID marks a pool worker).
 */
-const OS_SDK_ALLOWLIST_REGEX = /^(KICI_.*|NODE_ENV|HOME|PATH|TZ|LANG|TMPDIR|USER|USERNAME|SHELL|COMSPEC|PWD|OLDPWD|HOSTNAME|PROCESSOR_ARCHITECTURE|COLUMNS|LINES|TERM|COLORTERM|DISPLAY|WAYLAND_DISPLAY|LOCALAPPDATA|XDG_CACHE_HOME|XDG_CONFIG_HOME|XDG_DATA_HOME|XDG_RUNTIME_DIR|XDG_STATE_HOME|INIT_CWD|npm_.*|SSH_.*|CI|GITHUB_ACTIONS|GITHUB_ENV|GITHUB_OUTPUT|GITHUB_PATH|GITHUB_STEP_SUMMARY|GITLAB_CI|AWS_.*|REDIS_.*|OTEL_.*|STRIPE_.*|DOCKER_.*|GIT_.*|CONTAINER_HOST|container|PGHOST|PGPORT|PGUSER|PGPASSWORD|PGDATABASE|PGSERVICEFILE|PGSSLMODE|FORGEJO_URL|FORGEJO_CONTAINER|KEYCLOAK_.*|VITE_.*|PLAYWRIGHT|HEADED)$/;
+const OS_SDK_ALLOWLIST_REGEX = /^(KICI_.*|NODE_ENV|HOME|PATH|TZ|LANG|TMPDIR|USER|USERNAME|SHELL|COMSPEC|PWD|OLDPWD|HOSTNAME|PROCESSOR_ARCHITECTURE|COLUMNS|LINES|TERM|COLORTERM|DISPLAY|WAYLAND_DISPLAY|LOCALAPPDATA|XDG_CACHE_HOME|XDG_CONFIG_HOME|XDG_DATA_HOME|XDG_RUNTIME_DIR|XDG_STATE_HOME|INIT_CWD|npm_.*|SSH_.*|CI|GITHUB_ACTIONS|GITHUB_ENV|GITHUB_OUTPUT|GITHUB_PATH|GITHUB_STEP_SUMMARY|GITLAB_CI|AWS_.*|REDIS_.*|OTEL_.*|STRIPE_.*|DOCKER_.*|GIT_.*|CONTAINER_HOST|container|PGHOST|PGPORT|PGUSER|PGPASSWORD|PGDATABASE|PGSERVICEFILE|PGSSLMODE|FORGEJO_URL|FORGEJO_CONTAINER|KEYCLOAK_.*|VITE_.*|VITEST_.*|PLAYWRIGHT|HEADED)$/;
 /**
 * Returns true when `name` is allowed under the KiCI env-var convention:
 * it matches the OS/SDK allowlist regex (which includes the `KICI_*`

package/dist/env/define-env.d.ts

@@ -66,8 +66,15 @@ export interface DefineEnvOptions<TShape extends z.ZodRawShape> {
     descriptions?: Record<string, string>;
 }
 export interface DefineEnvResult<T> {
-    /** Parse `env` (defaults to `process.env`) into a typed config. */
-    parse(env?: NodeJS.ProcessEnv): T;
+    /**
+     * Parse `env` (defaults to `process.env`) into a typed config.
+     *
+     * `parserOverride` is an optional per-call parser (e.g. a scope-narrowed
+     * `.superRefine`) that replaces the default parser for this parse only —
+     * used to validate the same env map under a looser/stricter cross-field
+     * rule set without duplicating the envMap.
+     */
+    parse(env?: NodeJS.ProcessEnv, parserOverride?: z.ZodType): T;
     /** Machine-readable field specs for docs generation. */
     describe(): EnvFieldSpec[];
     /** Flat list of every env var the schema reads (for the unknown-var scanner). */
@@ -101,6 +108,16 @@ export declare function defineEnv<TShape extends z.ZodRawShape>(opts: DefineEnvO
  *   (on POSIX it's a shell-local var that doesn't leak).
  * - `KICI_DEV`: the dev-mode toggle itself — read by the scanner to flip
  *   to warn-only, so it must not trip the scanner.
+ * - `KICI_BUILD_COUNTER_NO_COMMIT`: a build-tooling flag read only by
+ *   `hack/lib/commit-build-counter.mjs` (skip the per-build `.build-counter`
+ *   commit on a force-synced checkout, e.g. a remote E2E executor). Set in the
+ *   ambient shell for `pnpm build`; the native orchestrator spawn inherits it.
+ * - `KICI_TEST_ISOLATION`: the test-isolation marker set at config-eval time
+ *   by every vitest config in this repository (`hack/lib/vitest-isolation.ts`,
+ *   enforced by `hack/check-vitest-isolation.ts`). It makes the CLI's
+ *   `getConfigDir` refuse the developer machine's ambient `~/.kici` config, and
+ *   it is inherited by every service a test spawns — same leak-by-inheritance
+ *   shape as the `KICI_E2E_` prefix below.
  *
  * Keep this list small and well-justified. Every addition is a typo we can
  * no longer catch, so only list things that are (a) actually set in the

package/dist/env/define-env.js

@@ -155,8 +155,8 @@ function describeFieldRecursive(shape, envMap, fieldPath, descriptions, out) {
 *   const config = envDef.parse();
 */
 function defineEnv(opts) {
-	const parserSchema = opts.parser ?? opts.schema;
-	function parse(env = process.env) {
+	function parse(env = process.env, parserOverride) {
+		const parserSchema = parserOverride ?? opts.parser ?? opts.schema;
 		const raw = readEnv(opts.envMap, env);
 		const result = parserSchema.safeParse(raw);
 		if (!result.success) {
@@ -227,12 +227,27 @@ function suggestClosest(name, candidates) {
 *   (on POSIX it's a shell-local var that doesn't leak).
 * - `KICI_DEV`: the dev-mode toggle itself — read by the scanner to flip
 *   to warn-only, so it must not trip the scanner.
+* - `KICI_BUILD_COUNTER_NO_COMMIT`: a build-tooling flag read only by
+*   `hack/lib/commit-build-counter.mjs` (skip the per-build `.build-counter`
+*   commit on a force-synced checkout, e.g. a remote E2E executor). Set in the
+*   ambient shell for `pnpm build`; the native orchestrator spawn inherits it.
+* - `KICI_TEST_ISOLATION`: the test-isolation marker set at config-eval time
+*   by every vitest config in this repository (`hack/lib/vitest-isolation.ts`,
+*   enforced by `hack/check-vitest-isolation.ts`). It makes the CLI's
+*   `getConfigDir` refuse the developer machine's ambient `~/.kici` config, and
+*   it is inherited by every service a test spawns — same leak-by-inheritance
+*   shape as the `KICI_E2E_` prefix below.
 *
 * Keep this list small and well-justified. Every addition is a typo we can
 * no longer catch, so only list things that are (a) actually set in the
 * wild by our own tooling and (b) could never be a config typo.
 */
-const RESERVED_NON_SCHEMA_KICI_VARS = ["KICI_CACHE", "KICI_DEV"];
+const RESERVED_NON_SCHEMA_KICI_VARS = [
+	"KICI_CACHE",
+	"KICI_DEV",
+	"KICI_BUILD_COUNTER_NO_COMMIT",
+	"KICI_TEST_ISOLATION"
+];
 /**
 * `KICI_*` prefixes that are entirely outside the service-config namespace —
 * usually set by our own test / dev tooling and inherited into a child

package/dist/env/logger-env.d.ts

@@ -1,13 +1,14 @@
 /**
  * Shared LoggerEnv schema.
  *
- * The logger (packages/shared/src/logger.ts) reads these env vars *before*
- * the per-service config loads, so we can't include them in the service
- * schemas the normal way. We still want them in `docs/operator/env-reference.md`
- * and in `validateUnknownKiciVars()`'s known-var set, so this schema documents
- * them in one place. Each service includes the keys here when computing its
- * "known KICI_* vars" list, and the docs generator emits a "Logger / shared"
- * section from this schema.
+ * The logger (packages/core/src/logger.ts) reads these env vars *before*
+ * the per-service config loads — as does `kiciTmpBase()`
+ * (packages/core/src/tmp.ts) for the `KICI_TMPDIR` entry below — so we can't
+ * include them in the service schemas the normal way. We still want them in
+ * `docs/operator/env-reference.md` and in `validateUnknownKiciVars()`'s
+ * known-var set, so this schema documents them in one place. Each service
+ * includes the keys here when computing its "known KICI_* vars" list, and the
+ * docs generator emits a "Logger / shared" section from this schema.
  *
  * IMPORTANT: do not change the runtime behaviour of `logger.ts` from this
  * schema — the schema is documentation + the unknown-var allowlist, not the
@@ -20,16 +21,17 @@ export declare const LoggerEnvSchema: z.ZodObject<{
     KICI_LOG_MAX_SIZE: z.ZodDefault<z.ZodString>;
     KICI_LOG_RETENTION_DAYS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     KICI_LOG_FORMAT: z.ZodDefault<z.ZodEnum<{
-        json: "json";
         auto: "auto";
+        json: "json";
         plain: "plain";
     }>>;
     KICI_CLUSTER_INSTANCE_ID: z.ZodOptional<z.ZodString>;
     KICI_AGENT_ID: z.ZodOptional<z.ZodString>;
     KICI_PLATFORM_INSTANCE_ID: z.ZodOptional<z.ZodString>;
+    KICI_TMPDIR: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /** All env vars the logger reads, for the unknown-KICI-var scanner. */
-export declare const LOGGER_ENV_VARS: readonly ["KICI_LOG_DIR", "KICI_LOG_MAX_SIZE", "KICI_LOG_RETENTION_DAYS", "KICI_LOG_FORMAT", "KICI_CLUSTER_INSTANCE_ID", "KICI_AGENT_ID", "KICI_PLATFORM_INSTANCE_ID"];
+export declare const LOGGER_ENV_VARS: readonly ['KICI_LOG_DIR', 'KICI_LOG_MAX_SIZE', 'KICI_LOG_RETENTION_DAYS', 'KICI_LOG_FORMAT', 'KICI_CLUSTER_INSTANCE_ID', 'KICI_AGENT_ID', 'KICI_PLATFORM_INSTANCE_ID', 'KICI_TMPDIR'];
 /** Doc-friendly description map (consumed by the env-reference generator). */
 export declare const LOGGER_ENV_FIELD_SPECS: EnvFieldSpec[];
 //# sourceMappingURL=logger-env.d.ts.map