@kici-dev/shared 0.4.0 → 0.5.0

package/dist/db-admin.d.ts

@@ -140,6 +140,20 @@ export interface PurgeStaleExecutionResult {
  * service restarts).
  */
 export declare function clearDispatchQueueDirect(databaseUrl: string): Promise<void>;
+/**
+ * TRUNCATE the three scaler-state tables on the orchestrator DB (direct SQL).
+ *
+ * These tables (`scaler_reservations`, `scaler_spawning_agents`,
+ * `scaler_agent_jobs`) hold in-flight scaler bookkeeping that a boot / Raft
+ * leader switch rehydrates via `ScalerManager.recoverState`. A row for an agent
+ * that spawned but never registered (or whose reservation leaked) is counted as
+ * used capacity forever, so a warm-reused orchestrator DB can accumulate stale
+ * reservations that push `used` past the resource cap and stop every future
+ * scale-up. E2E setups that reuse a warm orch DB call this before the
+ * orchestrator starts so it rehydrates a clean slate — the DB analog of
+ * allocating a fresh machine-ledger directory per run.
+ */
+export declare function clearScalerStateDirect(databaseUrl: string): Promise<void>;
 /**
  * DELETE orphan execution_runs + execution_jobs for routing keys other than
  * `routingKey` (and rows with NULL routing_key). Returns row counts.
@@ -788,11 +802,25 @@ export declare function seedSyntheticGithubSourceDirect(databaseUrl: string, opt
  * encryptFn takes plaintext + AAD and returns ciphertext bytes. The
  * caller owns the crypto primitive so this helper stays decoupled from
  * the orchestrator's PgSecretStore crypto module.
+ *
+ * `customerId` is the org the source belongs to, and passing it is what makes
+ * this seed faithful to a deployed environment. `sources.customer_id` carries a
+ * column DEFAULT of `'__default__'`, so a row inserted without it lands on the
+ * no-tenant anchor — and `resolveOrgId` then reports `'__default__'` for every
+ * event on that routing key, which denies org-scoped features (global-workflow
+ * registration, the multi-provider lock fallback) for reasons that surface
+ * nowhere near the source row. Supplied on both paths so a row an earlier seed
+ * left on the default anchor is repaired rather than inherited; that is exactly
+ * what the staging deploy's own `updateSourcesCustomerId()` step does after the
+ * fact. Omit it only when the caller genuinely has no org (a single-tenant
+ * fixture), never because it is inconvenient to thread.
  */
 export declare function seedWebhookSecretDirect(databaseUrl: string, opts: {
     routingKey: string;
     webhookSecret: string;
     encryptFn: (plaintext: string, aad: string) => string | Buffer;
+    /** Org that owns the source. Written on insert and reasserted on an existing row. */
+    customerId?: string;
 }): Promise<{
     sourceId: string;
 }>;
@@ -1036,10 +1064,20 @@ export declare function seedCiSecurityFixturesDirect(databaseUrl: string, opts:
  * the landed status — a terminal failure is reported immediately rather than
  * indistinguishable from a timeout. Used by the cluster reroute tests to gate
  * on a workflow reaching a terminal state after a webhook trigger.
+ *
+ * Pass `deliveryId` to scope the poll to the caller's own delivery. A `since`
+ * window alone does NOT identify a run: any workflow reaching a terminal state
+ * inside the same window matches, so a neighbouring run — including one whose
+ * failure is the point of some other test — is reported as if it were the
+ * caller's. The stored `delivery_id` is the source-prefixed form
+ * (`generic:<org>:<source>:<caller-id>`), so the caller's id is matched as a
+ * suffix.
  */
 export declare function waitForExecutionRunReachesStatusSinceDirect(databaseUrl: string, opts: {
     since: Date;
     statuses: readonly string[];
+    /** Scope to one delivery. Omit only when the caller genuinely wants "any run". */
+    deliveryId?: string;
     timeoutMs?: number;
     intervalMs?: number;
 }): Promise<{
@@ -1049,6 +1087,10 @@ export declare function waitForExecutionRunReachesStatusSinceDirect(databaseUrl:
  * Fetch the most recent `execution_runs` row matching `status`, plus its
  * `execution_jobs`. Used by cluster reroute tests to confirm the run +
  * its jobs completed successfully.
+ *
+ * Pass `deliveryId` to scope to the caller's own delivery — "the newest run
+ * with this status" is otherwise satisfied by any concurrent workflow, so the
+ * returned `run_id` can belong to a different test.
  */
 export interface LatestExecutionRunResult {
     run: {
@@ -1064,6 +1106,8 @@ export interface LatestExecutionRunResult {
 }
 export declare function latestExecutionRunByStatusDirect(databaseUrl: string, opts: {
     status: string;
+    /** Scope to one delivery. Omit only when the caller genuinely wants "any run". */
+    deliveryId?: string;
 }): Promise<LatestExecutionRunResult | null>;
 /**
  * Wait for a `execution_jobs` row joined against the most recent
@@ -1479,18 +1523,38 @@ export interface OrgSettingsRepoPatternEntry {
     pattern: string;
 }
 /**
- * UPSERT org_settings for a customer/org id. `globalWorkflowsEnabled` is
- * required; the three list fields are each optional. Each list is a jsonb
- * array of `{routingKey?, pattern}` entries. Pass `null` to clear a list.
+ * UPSERT the per-org global-workflow repo lists for a customer/org id. The
+ * three list fields are each optional; each list is a jsonb array of
+ * `{routingKey?, pattern}` entries. Pass `null` to clear a list.
+ *
+ * The master enable switch is NOT set here: it is fleet-wide
+ * (`cluster_settings.global_workflows_enabled`) — use
+ * {@link setClusterGlobalWorkflowsEnabledDirect}.
  */
 export interface UpsertOrgSettingsOpts {
     customerId: string;
-    globalWorkflowsEnabled: boolean;
     allowedRepos?: OrgSettingsRepoPatternEntry[] | null;
     deniedRepos?: OrgSettingsRepoPatternEntry[] | null;
     elevatedRepos?: OrgSettingsRepoPatternEntry[] | null;
 }
 export declare function upsertOrgSettingsGlobalWorkflowsDirect(databaseUrl: string, opts: UpsertOrgSettingsOpts): Promise<void>;
+/**
+ * Set (or clear) the fleet-wide global-workflows master switch directly.
+ *
+ * Direct-DB by design, matching every other `*Direct` helper here: these exist
+ * for E2E seeding, which must set the switch BEFORE an orchestrator is up and
+ * therefore cannot go through the admin HTTP API. Operators use
+ * `kici-admin cluster-settings set --global-workflows-enabled <bool>`.
+ *
+ * Passing `null` clears the override, so the orchestrator's configured default
+ * applies. Upserts the singleton `id='default'` row, so it works against a
+ * fresh database with no cluster_settings row at all.
+ *
+ * `cluster_settings.version` is left untouched: seeding happens before any
+ * worker reads the row, so there is nothing to invalidate yet — the operator
+ * PATCH path (admin-cluster-settings.ts) owns the version bump for live changes.
+ */
+export declare function setClusterGlobalWorkflowsEnabledDirect(databaseUrl: string, enabled: boolean | null): Promise<void>;
 /**
  * UPDATE org_settings.global_workflow_denied_repos for a customer/org id.
  * Assumes the row exists (upsertOrgSettingsGlobalWorkflowsDirect was

package/dist/db-admin.js

@@ -243,6 +243,27 @@ async function clearDispatchQueueDirect(databaseUrl) {
 	}
 }
 /**
+* TRUNCATE the three scaler-state tables on the orchestrator DB (direct SQL).
+*
+* These tables (`scaler_reservations`, `scaler_spawning_agents`,
+* `scaler_agent_jobs`) hold in-flight scaler bookkeeping that a boot / Raft
+* leader switch rehydrates via `ScalerManager.recoverState`. A row for an agent
+* that spawned but never registered (or whose reservation leaked) is counted as
+* used capacity forever, so a warm-reused orchestrator DB can accumulate stale
+* reservations that push `used` past the resource cap and stop every future
+* scale-up. E2E setups that reuse a warm orch DB call this before the
+* orchestrator starts so it rehydrates a clean slate — the DB analog of
+* allocating a fresh machine-ledger directory per run.
+*/
+async function clearScalerStateDirect(databaseUrl) {
+	const pool = createPool(databaseUrl);
+	try {
+		await pool.query("TRUNCATE scaler_reservations, scaler_spawning_agents, scaler_agent_jobs");
+	} finally {
+		await pool.end();
+	}
+}
+/**
 * DELETE orphan execution_runs + execution_jobs for routing keys other than
 * `routingKey` (and rows with NULL routing_key). Returns row counts.
 */
@@ -1337,6 +1358,18 @@ async function seedSyntheticGithubSourceDirect(databaseUrl, opts) {
 * encryptFn takes plaintext + AAD and returns ciphertext bytes. The
 * caller owns the crypto primitive so this helper stays decoupled from
 * the orchestrator's PgSecretStore crypto module.
+*
+* `customerId` is the org the source belongs to, and passing it is what makes
+* this seed faithful to a deployed environment. `sources.customer_id` carries a
+* column DEFAULT of `'__default__'`, so a row inserted without it lands on the
+* no-tenant anchor — and `resolveOrgId` then reports `'__default__'` for every
+* event on that routing key, which denies org-scoped features (global-workflow
+* registration, the multi-provider lock fallback) for reasons that surface
+* nowhere near the source row. Supplied on both paths so a row an earlier seed
+* left on the default anchor is repaired rather than inherited; that is exactly
+* what the staging deploy's own `updateSourcesCustomerId()` step does after the
+* fact. Omit it only when the caller genuinely has no org (a single-tenant
+* fixture), never because it is inconvenient to thread.
 */
 async function seedWebhookSecretDirect(databaseUrl, opts) {
 	const { randomBytes } = await import("node:crypto");
@@ -1344,18 +1377,21 @@ async function seedWebhookSecretDirect(databaseUrl, opts) {
 	try {
 		let sourceId;
 		const sourceResult = await pool.query("SELECT id FROM sources WHERE routing_key = $1", [opts.routingKey]);
-		if (sourceResult.rows.length > 0) sourceId = sourceResult.rows[0].id;
-		else {
+		if (sourceResult.rows.length > 0) {
+			sourceId = sourceResult.rows[0].id;
+			if (opts.customerId) await pool.query("UPDATE sources SET customer_id = $1, updated_at = now() WHERE routing_key = $2", [opts.customerId, opts.routingKey]);
+		} else {
 			sourceId = randomBytes(16).toString("hex");
 			const [provider, appId] = opts.routingKey.split(":");
-			await pool.query(`INSERT INTO sources (id, provider, name, routing_key, config)
-         VALUES ($1, $2, $3, $4, $5)
-         ON CONFLICT (routing_key) DO NOTHING`, [
+			await pool.query(`INSERT INTO sources (id, provider, name, routing_key, config${opts.customerId ? ", customer_id" : ""})
+         VALUES ($1, $2, $3, $4, $5${opts.customerId ? ", $6" : ""})
+         ${opts.customerId ? "ON CONFLICT (routing_key) DO UPDATE SET customer_id = EXCLUDED.customer_id, updated_at = now()" : "ON CONFLICT (routing_key) DO NOTHING"}`, [
 				sourceId,
 				provider || "github",
 				`e2e-${appId}`,
 				opts.routingKey,
-				JSON.stringify({ appId: appId || "" })
+				JSON.stringify({ appId: appId || "" }),
+				...opts.customerId ? [opts.customerId] : []
 			]);
 			sourceId = (await pool.query("SELECT id FROM sources WHERE routing_key = $1", [opts.routingKey])).rows[0].id;
 		}
@@ -1818,6 +1854,14 @@ async function seedCiSecurityFixturesDirect(databaseUrl, opts) {
 * the landed status — a terminal failure is reported immediately rather than
 * indistinguishable from a timeout. Used by the cluster reroute tests to gate
 * on a workflow reaching a terminal state after a webhook trigger.
+*
+* Pass `deliveryId` to scope the poll to the caller's own delivery. A `since`
+* window alone does NOT identify a run: any workflow reaching a terminal state
+* inside the same window matches, so a neighbouring run — including one whose
+* failure is the point of some other test — is reported as if it were the
+* caller's. The stored `delivery_id` is the source-prefixed form
+* (`generic:<org>:<source>:<caller-id>`), so the caller's id is matched as a
+* suffix.
 */
 async function waitForExecutionRunReachesStatusSinceDirect(databaseUrl, opts) {
 	const timeoutMs = opts.timeoutMs ?? 24e4;
@@ -1827,9 +1871,13 @@ async function waitForExecutionRunReachesStatusSinceDirect(databaseUrl, opts) {
 	try {
 		while (Date.now() < deadline) {
 			const result = await pool.query(`SELECT status FROM execution_runs
-         WHERE started_at > $1 AND status = ANY($2)
+         WHERE started_at > $1 AND status = ANY($2)${opts.deliveryId ? " AND delivery_id LIKE $3" : ""}
          ORDER BY started_at DESC
-         LIMIT 1`, [opts.since, [...opts.statuses]]);
+         LIMIT 1`, opts.deliveryId ? [
+				opts.since,
+				[...opts.statuses],
+				`%${opts.deliveryId}`
+			] : [opts.since, [...opts.statuses]]);
 			if (result.rows.length > 0) return { status: result.rows[0].status };
 			await new Promise((r) => setTimeout(r, intervalMs));
 		}
@@ -1842,8 +1890,8 @@ async function latestExecutionRunByStatusDirect(databaseUrl, opts) {
 	const pool = createPool(databaseUrl);
 	try {
 		const runResult = await pool.query(`SELECT run_id, workflow_name, status FROM execution_runs
-       WHERE status = $1
-       ORDER BY started_at DESC LIMIT 1`, [opts.status]);
+       WHERE status = $1${opts.deliveryId ? " AND delivery_id LIKE $2" : ""}
+       ORDER BY started_at DESC LIMIT 1`, opts.deliveryId ? [opts.status, `%${opts.deliveryId}`] : [opts.status]);
 		if (runResult.rows.length === 0) return null;
 		const run = runResult.rows[0];
 		return {
@@ -2176,7 +2224,9 @@ async function deleteWorkflowRegistrationsDirect(databaseUrl, opts) {
 		if (opts.id) result = await pool.query(`DELETE FROM workflow_registrations WHERE id = $1`, [opts.id]);
 		else if (opts.routingKey) result = await pool.query(`DELETE FROM workflow_registrations WHERE routing_key = $1`, [opts.routingKey]);
 		else result = await pool.query(`DELETE FROM workflow_registrations WHERE repo_identifier = $1`, [opts.repoIdentifier]);
-		return { deleted: result.rowCount ?? 0 };
+		const deleted = result.rowCount ?? 0;
+		if (deleted > 0) await pool.query(`UPDATE registry_versions SET version = version + 1, updated_at = NOW() WHERE id = 'default'`);
+		return { deleted };
 	} finally {
 		await pool.end();
 	}
@@ -2512,19 +2562,17 @@ async function upsertOrgSettingsGlobalWorkflowsDirect(databaseUrl, opts) {
 	const pool = createPool(databaseUrl);
 	try {
 		await pool.query(`INSERT INTO org_settings (
-         customer_id, global_workflows_enabled,
+         customer_id,
          global_workflow_allowed_repos,
          global_workflow_denied_repos,
          global_workflow_elevated_repos
-       ) VALUES ($1, $2, $3::jsonb, $4::jsonb, $5::jsonb)
+       ) VALUES ($1, $2::jsonb, $3::jsonb, $4::jsonb)
        ON CONFLICT (customer_id) DO UPDATE SET
-         global_workflows_enabled = EXCLUDED.global_workflows_enabled,
          global_workflow_allowed_repos = EXCLUDED.global_workflow_allowed_repos,
          global_workflow_denied_repos = EXCLUDED.global_workflow_denied_repos,
          global_workflow_elevated_repos = EXCLUDED.global_workflow_elevated_repos,
          updated_at = NOW()`, [
 			opts.customerId,
-			opts.globalWorkflowsEnabled,
 			opts.allowedRepos == null ? null : JSON.stringify(opts.allowedRepos),
 			opts.deniedRepos == null ? null : JSON.stringify(opts.deniedRepos),
 			opts.elevatedRepos == null ? null : JSON.stringify(opts.elevatedRepos)
@@ -2534,6 +2582,33 @@ async function upsertOrgSettingsGlobalWorkflowsDirect(databaseUrl, opts) {
 	}
 }
 /**
+* Set (or clear) the fleet-wide global-workflows master switch directly.
+*
+* Direct-DB by design, matching every other `*Direct` helper here: these exist
+* for E2E seeding, which must set the switch BEFORE an orchestrator is up and
+* therefore cannot go through the admin HTTP API. Operators use
+* `kici-admin cluster-settings set --global-workflows-enabled <bool>`.
+*
+* Passing `null` clears the override, so the orchestrator's configured default
+* applies. Upserts the singleton `id='default'` row, so it works against a
+* fresh database with no cluster_settings row at all.
+*
+* `cluster_settings.version` is left untouched: seeding happens before any
+* worker reads the row, so there is nothing to invalidate yet — the operator
+* PATCH path (admin-cluster-settings.ts) owns the version bump for live changes.
+*/
+async function setClusterGlobalWorkflowsEnabledDirect(databaseUrl, enabled) {
+	const pool = createPool(databaseUrl);
+	try {
+		await pool.query(`INSERT INTO cluster_settings (id, global_workflows_enabled)
+       VALUES ('default', $1)
+       ON CONFLICT (id) DO UPDATE SET
+         global_workflows_enabled = EXCLUDED.global_workflows_enabled`, [enabled]);
+	} finally {
+		await pool.end();
+	}
+}
+/**
 * UPDATE org_settings.global_workflow_denied_repos for a customer/org id.
 * Assumes the row exists (upsertOrgSettingsGlobalWorkflowsDirect was
 * called earlier in the test).
@@ -2868,6 +2943,6 @@ async function terminateIdleDbBackendsDirect(databaseUrl) {
 	}
 }
 //#endregion
-export { CI_SECURITY_OTHER_REPO, MIGRATION_HASH_TABLE, PROVIDER_HASH_KEY, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createContextTemplateDirect, createDbRole, createJoinTokenDirect, createReadOnlyDbUser, deleteContextDirect, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCheckRunTrackingDirect, listContextsDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedContextBindingDirect, seedContextDirect, seedCrossRepoTrustDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setContextPolicyDirect, setContextSecretDirect, showContextDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunReachesStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };
+export { CI_SECURITY_OTHER_REPO, MIGRATION_HASH_TABLE, PROVIDER_HASH_KEY, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, clearScalerStateDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createContextTemplateDirect, createDbRole, createJoinTokenDirect, createReadOnlyDbUser, deleteContextDirect, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCheckRunTrackingDirect, listContextsDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedContextBindingDirect, seedContextDirect, seedCrossRepoTrustDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setClusterGlobalWorkflowsEnabledDirect, setContextPolicyDirect, setContextSecretDirect, showContextDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunReachesStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };
 
 //# sourceMappingURL=db-admin.js.map

package/dist/index.d.ts

@@ -6,7 +6,7 @@ export { redactConfig, addLogsToArchive, MAX_LOG_BYTES } from './diagnostics/bun
 export { chunkBuffer, BundleChunkAssembler, ChunkRequestWaiter, FLEET_CHUNK_BYTES, type BundleChunkFrame, } from './diagnostics/bundle-chunks.js';
 export { createPool, createDb, isPoolAcquireTimeout, type CreatePoolOptions, type PgPoolErrorSource, type PoolAcquireOutcome, } from './db.js';
 export { isPgUniqueViolation } from './pg-errors.js';
-export { parseDatabaseUrl, maskDatabaseUrl, dropAndCreateDatabase, dropDatabaseDirect, ensureDatabase, type EnsureDatabaseOpts, createDbRole, createReadOnlyDbUser, computeMigrationsHash, storeMigrationContentHash, readStoredMigrationContentHash, isSchemaCurrent, clearDispatchQueueDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, purgeScopedSecretsDirect, purgeContextsDirect, seedContextDirect, deleteContextDirect, seedContextBindingDirect, setContextPolicyDirect, listContextsDirect, showContextDirect, createContextTemplateDirect, setContextSecretDirect, listQueueDirect, showQueueEntryDirect, listExecutionRunsDirect, showExecutionRunDirect, listCheckRunTrackingDirect, listExecutionJobsDirect, listRegistrationsDirect, showRegistrationDirect, registerWorkflowManualDirect, resetRaftStateDirect, emitKiciEventDirect, seedGenericWebhookSourceDirect, purgeSecretBackendsDirect, apiKeyExistsDirect, seedApiKeyInlineDirect, platformConnectionExistsDirect, countWebhookSourcesByConnectionIdDirect, getWebhookSourceByRoutingKeyDirect, findAnyUserApiKeyIdDirect, seedSyntheticGithubSourceDirect, seedWebhookSecretDirect, seedSourcePrivateKeyDirect, bumpRegistryVersionDirect, pollKiciEventsDirect, waitForPostgresDirect, waitForRunCompletionDirect, cleanupExecutionRowsDirect, isSchemaCurrentFromFilesDirect, storeMigrationContentHashInTableDirect, createJoinTokenDirect, deleteJoinTokensByCreatedByDirect, updateSourceRoutingKeyDirect, prunePeerCredentialsDirect, waitForPlatformRegistrationsDirect, seedUniversalGitSourceDirect, seedCiSecurityFixturesDirect, CI_SECURITY_OTHER_REPO, waitForExecutionRunReachesStatusSinceDirect, latestExecutionRunByStatusDirect, waitForLatestExecutionJobStatusDirect, describeTableColumnsDirect, tableExistsDirect, insertKiciEventRawDirect, showKiciEventDirect, listKiciEventsDirect, deleteKiciEventsDirect, insertKiciEventAtDirect, paginateUnprocessedEventsKeysetDirect, verifyKiciEventNotifyDirect, seedCrossRepoTrustDirect, listCrossRepoTrustBySourceRoutingKeyDirect, deleteCrossRepoTrustDirect, insertCrossRepoTrustStrictDirect, deleteWorkflowRegistrationsDirect, getWorkflowRegistrationByIdDirect, listRegistrationsByRoutingKeyDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, updateWorkflowRegistrationCommitShaDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, getRegistryVersionDirect, bumpRegistryVersionSimpleDirect, upsertCronLastFiredDirect, countCronLastFiredDirect, insertCronLastFiredNowDirect, deleteCronLastFiredDirect, deleteExecutionRunsByWorkflowNameDirect, getGenericWebhookSourceByRoutingKeyDirect, listActiveGenericWebhookSourcesDirect, updateGenericWebhookVerificationConfigDirect, deleteGenericWebhookSourcesByNameDirect, restoreSoftDeletedGenericWebhookSourceDirect, upsertOrgSettingsGlobalWorkflowsDirect, updateOrgSettingsDeniedReposDirect, deleteOrgSettingsByCustomerIdDirect, getExecutionRunSecurityDirect, getHeldRunByIdDirect, listHeldRunApprovalsDirect, countHeldRunsByRunIdDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForEventLogRowByDeliveryIdDirect, resolvePlatformWebhookSourceRoutingKeyDirect, ensureOrgOwnerMemberDirect, deletePeerCredentialsByInstanceIdLikeDirect, insertPeerCredentialExpiredDirect, getPeerCredentialRevokedAtDirect, listActivePeerCredentialsExcludingDirect, clearPeerCredentialsRevokedAtByIdsDirect, countActivePeerCredentialsByInstanceDirect, terminateIdleDbBackendsDirect, type ColumnInfo, type KiciEventRow, type CrossRepoTrustRow, type WorkflowRegistrationFullRow, type RegistrationsScopedResult, type LatestExecutionRunResult, type WaitForLatestJobResult, type ExecutionRunSecurityRow, type HeldRunSecurityRow, type EventLogRow as PlatformEventLogRow, type UpsertOrgSettingsOpts, type OrgSettingsRepoPatternEntry, type InsertKiciEventRawOpts, type EmitKiciEventOpts, type SeedGenericWebhookSourceOpts, REGISTERABLE_TRIGGER_TYPES, MIGRATION_HASH_TABLE, type PurgeStaleExecutionResult, type PurgeStaleSourcesResult, type SeedContextOpts, type SeedContextResult, type SeedContextBindingOpts, type SetContextPolicyOpts, type ContextRow, type ContextVariableRow, type ContextBindingRow, type ShowContextResult, type CreateContextTemplateOpts, type SetContextSecretOpts, type DispatchQueueRow, type ListQueueOpts, type ExecutionRunRow, type ExecutionJobRow, type ListExecutionRunsOpts, type CheckRunTrackingDirectRow, type ListCheckRunTrackingOpts, type WorkflowRegistrationRow, type ListRegistrationsOpts, type ListRegistrationsResult, type ShowRegistrationResult, type RegisterWorkflowManualOpts, type RegisterWorkflowManualResult, } from './db-admin.js';
+export { parseDatabaseUrl, maskDatabaseUrl, dropAndCreateDatabase, dropDatabaseDirect, ensureDatabase, type EnsureDatabaseOpts, createDbRole, createReadOnlyDbUser, computeMigrationsHash, storeMigrationContentHash, readStoredMigrationContentHash, isSchemaCurrent, clearDispatchQueueDirect, clearScalerStateDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, purgeScopedSecretsDirect, purgeContextsDirect, seedContextDirect, deleteContextDirect, seedContextBindingDirect, setContextPolicyDirect, listContextsDirect, showContextDirect, createContextTemplateDirect, setContextSecretDirect, listQueueDirect, showQueueEntryDirect, listExecutionRunsDirect, showExecutionRunDirect, listCheckRunTrackingDirect, listExecutionJobsDirect, listRegistrationsDirect, showRegistrationDirect, registerWorkflowManualDirect, resetRaftStateDirect, emitKiciEventDirect, seedGenericWebhookSourceDirect, purgeSecretBackendsDirect, apiKeyExistsDirect, seedApiKeyInlineDirect, platformConnectionExistsDirect, countWebhookSourcesByConnectionIdDirect, getWebhookSourceByRoutingKeyDirect, findAnyUserApiKeyIdDirect, seedSyntheticGithubSourceDirect, seedWebhookSecretDirect, seedSourcePrivateKeyDirect, bumpRegistryVersionDirect, pollKiciEventsDirect, waitForPostgresDirect, waitForRunCompletionDirect, cleanupExecutionRowsDirect, isSchemaCurrentFromFilesDirect, storeMigrationContentHashInTableDirect, createJoinTokenDirect, deleteJoinTokensByCreatedByDirect, updateSourceRoutingKeyDirect, prunePeerCredentialsDirect, waitForPlatformRegistrationsDirect, seedUniversalGitSourceDirect, seedCiSecurityFixturesDirect, CI_SECURITY_OTHER_REPO, waitForExecutionRunReachesStatusSinceDirect, latestExecutionRunByStatusDirect, waitForLatestExecutionJobStatusDirect, describeTableColumnsDirect, tableExistsDirect, insertKiciEventRawDirect, showKiciEventDirect, listKiciEventsDirect, deleteKiciEventsDirect, insertKiciEventAtDirect, paginateUnprocessedEventsKeysetDirect, verifyKiciEventNotifyDirect, seedCrossRepoTrustDirect, listCrossRepoTrustBySourceRoutingKeyDirect, deleteCrossRepoTrustDirect, insertCrossRepoTrustStrictDirect, deleteWorkflowRegistrationsDirect, getWorkflowRegistrationByIdDirect, listRegistrationsByRoutingKeyDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, updateWorkflowRegistrationCommitShaDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, getRegistryVersionDirect, bumpRegistryVersionSimpleDirect, upsertCronLastFiredDirect, countCronLastFiredDirect, insertCronLastFiredNowDirect, deleteCronLastFiredDirect, deleteExecutionRunsByWorkflowNameDirect, getGenericWebhookSourceByRoutingKeyDirect, listActiveGenericWebhookSourcesDirect, updateGenericWebhookVerificationConfigDirect, deleteGenericWebhookSourcesByNameDirect, restoreSoftDeletedGenericWebhookSourceDirect, upsertOrgSettingsGlobalWorkflowsDirect, setClusterGlobalWorkflowsEnabledDirect, updateOrgSettingsDeniedReposDirect, deleteOrgSettingsByCustomerIdDirect, getExecutionRunSecurityDirect, getHeldRunByIdDirect, listHeldRunApprovalsDirect, countHeldRunsByRunIdDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForEventLogRowByDeliveryIdDirect, resolvePlatformWebhookSourceRoutingKeyDirect, ensureOrgOwnerMemberDirect, deletePeerCredentialsByInstanceIdLikeDirect, insertPeerCredentialExpiredDirect, getPeerCredentialRevokedAtDirect, listActivePeerCredentialsExcludingDirect, clearPeerCredentialsRevokedAtByIdsDirect, countActivePeerCredentialsByInstanceDirect, terminateIdleDbBackendsDirect, type ColumnInfo, type KiciEventRow, type CrossRepoTrustRow, type WorkflowRegistrationFullRow, type RegistrationsScopedResult, type LatestExecutionRunResult, type WaitForLatestJobResult, type ExecutionRunSecurityRow, type HeldRunSecurityRow, type EventLogRow as PlatformEventLogRow, type UpsertOrgSettingsOpts, type OrgSettingsRepoPatternEntry, type InsertKiciEventRawOpts, type EmitKiciEventOpts, type SeedGenericWebhookSourceOpts, REGISTERABLE_TRIGGER_TYPES, MIGRATION_HASH_TABLE, type PurgeStaleExecutionResult, type PurgeStaleSourcesResult, type SeedContextOpts, type SeedContextResult, type SeedContextBindingOpts, type SetContextPolicyOpts, type ContextRow, type ContextVariableRow, type ContextBindingRow, type ShowContextResult, type CreateContextTemplateOpts, type SetContextSecretOpts, type DispatchQueueRow, type ListQueueOpts, type ExecutionRunRow, type ExecutionJobRow, type ListExecutionRunsOpts, type CheckRunTrackingDirectRow, type ListCheckRunTrackingOpts, type WorkflowRegistrationRow, type ListRegistrationsOpts, type ListRegistrationsResult, type ShowRegistrationResult, type RegisterWorkflowManualOpts, type RegisterWorkflowManualResult, } from './db-admin.js';
 export { createMetricsRoutes, type MetricsRoutesDeps } from './routes/metrics.js';
 export { createHealthRoutes, type HealthRoutesDeps } from './routes/health.js';
 export { getReconnectDelay } from './reconnect-delay.js';

package/dist/index.js

@@ -1,7 +1,7 @@
 import "./rolldown-runtime-ClRpJifh.js";
 import { AgentDeliveryMode, AgentPlatform, splitAgentPlatform } from "./agent-platform.js";
 import { createDb, createPool, isPoolAcquireTimeout } from "./db.js";
-import { CI_SECURITY_OTHER_REPO, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createContextTemplateDirect, createDbRole, createJoinTokenDirect, createReadOnlyDbUser, deleteContextDirect, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCheckRunTrackingDirect, listContextsDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedContextBindingDirect, seedContextDirect, seedCrossRepoTrustDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setContextPolicyDirect, setContextSecretDirect, showContextDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunReachesStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect } from "./db-admin.js";
+import { CI_SECURITY_OTHER_REPO, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, clearScalerStateDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createContextTemplateDirect, createDbRole, createJoinTokenDirect, createReadOnlyDbUser, deleteContextDirect, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCheckRunTrackingDirect, listContextsDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedContextBindingDirect, seedContextDirect, seedCrossRepoTrustDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setClusterGlobalWorkflowsEnabledDirect, setContextPolicyDirect, setContextSecretDirect, showContextDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunReachesStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect } from "./db-admin.js";
 import { setupGracefulShutdown } from "./graceful-shutdown.js";
 import { decrypt, deriveKey, encrypt, generateMasterKey } from "./secret-crypto.js";
 import { RingBuffer } from "./ring-buffer.js";
@@ -28,4 +28,4 @@ import { BaseColdStore } from "./cold-store/cold-store.js";
 import { ChunkLru } from "./cold-store/lru.js";
 import "./cold-store/index.js";
 export * from "@kici-dev/core";
-export { AgentDeliveryMode, AgentPlatform, BaseColdStore, BundleChunkAssembler, CI_SECURITY_OTHER_REPO, COLD_BUCKET_NAMES, ChunkLru, ChunkRequestWaiter, DEFAULT_TABLE_CONFIG, FLEET_CHUNK_BYTES, MAX_LOG_BYTES, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, RingBuffer, addLogsToArchive, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, chunkBuffer, chunkObjectKey, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, coldDaysToBucket, coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal, collectRuntimeMetricNames, computeChunkId, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createContextTemplateDirect, createDb, createDbRole, createHealthRoutes, createJoinTokenDirect, createMeter, createMetricsRoutes, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, decrypt, deleteContextDirect, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, deriveKey, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, encodeChunk, encodeKeySegment, encrypt, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, generateMasterKey, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getPrometheusExporter, getReconnectDelay, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, initTelemetry, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isLongerColdRetention, isPgUniqueViolation, isPoolAcquireTimeout, isSchemaCurrent, isSchemaCurrentFromFilesDirect, kiciMkdtemp, kiciTmpBase, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCheckRunTrackingDirect, listContextsDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, parseManifest, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, redactConfig, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, resolveTableConfig, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedContextBindingDirect, seedContextDirect, seedCrossRepoTrustDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, serializeManifest, setContextPolicyDirect, setContextSecretDirect, setupGracefulShutdown, showContextDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, splitAgentPlatform, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, validateRequiredTools, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunReachesStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };
+export { AgentDeliveryMode, AgentPlatform, BaseColdStore, BundleChunkAssembler, CI_SECURITY_OTHER_REPO, COLD_BUCKET_NAMES, ChunkLru, ChunkRequestWaiter, DEFAULT_TABLE_CONFIG, FLEET_CHUNK_BYTES, MAX_LOG_BYTES, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, RingBuffer, addLogsToArchive, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, chunkBuffer, chunkObjectKey, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, clearScalerStateDirect, coldDaysToBucket, coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal, collectRuntimeMetricNames, computeChunkId, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createContextTemplateDirect, createDb, createDbRole, createHealthRoutes, createJoinTokenDirect, createMeter, createMetricsRoutes, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, decrypt, deleteContextDirect, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, deriveKey, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, encodeChunk, encodeKeySegment, encrypt, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, generateMasterKey, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getPrometheusExporter, getReconnectDelay, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, initTelemetry, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isLongerColdRetention, isPgUniqueViolation, isPoolAcquireTimeout, isSchemaCurrent, isSchemaCurrentFromFilesDirect, kiciMkdtemp, kiciTmpBase, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCheckRunTrackingDirect, listContextsDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, parseManifest, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, redactConfig, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, resolveTableConfig, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedContextBindingDirect, seedContextDirect, seedCrossRepoTrustDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, serializeManifest, setClusterGlobalWorkflowsEnabledDirect, setContextPolicyDirect, setContextSecretDirect, setupGracefulShutdown, showContextDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, splitAgentPlatform, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, validateRequiredTools, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunReachesStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/shared",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
   "keywords": [
     "ci",
@@ -113,8 +113,8 @@
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
     "zx": "^8.8.5",
-    "@kici-dev/core": "0.4.0",
-    "@kici-dev/engine": "0.4.0"
+    "@kici-dev/core": "0.5.0",
+    "@kici-dev/engine": "0.5.0"
   },
   "devDependencies": {
     "@opentelemetry/sdk-trace-base": "^2.10.0",

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/shared@0.4.0",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fshared/0.4.0/b813759a-3662-428c-bff8-940dfd6f0035",
+  "name": "@kici-dev/shared@0.5.0",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fshared/0.5.0/1f964606-bca6-4c8b-be5f-6106283dd9a5",
   "creationInfo": {
-    "created": "2026-08-09T16:02:36Z",
+    "created": "2026-08-15T19:15:28Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -564,9 +564,9 @@
       "homepage": "https://ericsmekens.github.io/jsep/tree/master/packages/regex#readme"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-core-0.4.0",
+      "SPDXID": "SPDXRef-Package--kici-dev-core-0.5.0",
       "name": "@kici-dev/core",
-      "versionInfo": "0.4.0",
+      "versionInfo": "0.5.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -577,16 +577,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/core@0.4.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/core@0.5.0"
         }
       ],
       "description": "Light shared utilities for the KiCI stack (logging, errors, formatting, crypto, zx init, the TypeScript ESM loader hook). No server-side dependencies.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.4.0",
+      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.5.0",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.4.0",
+      "versionInfo": "0.5.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -597,7 +597,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.4.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.5.0"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
@@ -606,7 +606,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/shared",
-      "versionInfo": "0.4.0",
+      "versionInfo": "0.5.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -617,7 +617,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.4.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.5.0"
         }
       ],
       "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
@@ -4896,57 +4896,62 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.4.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.5.0",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.140.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.4.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.5.0",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.4.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.5.0",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.4.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.5.0",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.4.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.5.0",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.4.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.5.0",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.4.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.5.0",
       "relatedSpdxElement": "SPDXRef-Package-jose-6.2.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.4.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.5.0",
       "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.4.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.5.0",
       "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.4.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.5.0",
       "relatedSpdxElement": "SPDXRef-Package-safe-regex-2.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.4.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.5.0",
+      "relatedSpdxElement": "SPDXRef-Package-yaml-2.9.0",
+      "relationshipType": "DEPENDS_ON"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.5.0",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
@@ -4957,12 +4962,12 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.4.0",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.5.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.4.0",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.5.0",
       "relationshipType": "DEPENDS_ON"
     },
     {