@kici-dev/shared 0.5.0 → 0.6.1

package/dist/db-admin.d.ts

@@ -26,16 +26,6 @@ export declare function parseDatabaseUrl(databaseUrl: string): ParsedDatabaseUrl
  * Redact the password from a libpq URL for safe logging.
  */
 export declare function maskDatabaseUrl(databaseUrl: string): string;
-/**
- * DROP `dbName` (if it exists). Terminates existing backend connections
- * so the DROP doesn't block. Idempotent — drops are IF EXISTS.
- *
- * Used by e2e cleanup after a full-lifecycle service-deploy test tears
- * down its isolated database. Shares the same admin-URL + identifier-
- * validation + backend-termination scaffolding as dropAndCreateDatabase
- * so the two helpers cannot drift.
- */
-export declare function dropDatabaseDirect(databaseUrl: string): Promise<void>;
 /**
  * Drop `dbName` (if it exists), then recreate it owned by `owner`. Terminates
  * existing backend connections so the DROP doesn't block.
@@ -140,20 +130,6 @@ export interface PurgeStaleExecutionResult {
  * service restarts).
  */
 export declare function clearDispatchQueueDirect(databaseUrl: string): Promise<void>;
-/**
- * TRUNCATE the three scaler-state tables on the orchestrator DB (direct SQL).
- *
- * These tables (`scaler_reservations`, `scaler_spawning_agents`,
- * `scaler_agent_jobs`) hold in-flight scaler bookkeeping that a boot / Raft
- * leader switch rehydrates via `ScalerManager.recoverState`. A row for an agent
- * that spawned but never registered (or whose reservation leaked) is counted as
- * used capacity forever, so a warm-reused orchestrator DB can accumulate stale
- * reservations that push `used` past the resource cap and stop every future
- * scale-up. E2E setups that reuse a warm orch DB call this before the
- * orchestrator starts so it rehydrates a clean slate — the DB analog of
- * allocating a fresh machine-ledger directory per run.
- */
-export declare function clearScalerStateDirect(databaseUrl: string): Promise<void>;
 /**
  * DELETE orphan execution_runs + execution_jobs for routing keys other than
  * `routingKey` (and rows with NULL routing_key). Returns row counts.
@@ -542,15 +518,6 @@ export declare function showExecutionRunDirect(databaseUrl: string, opts: {
     run: ExecutionRunRow;
     jobs: ExecutionJobRow[];
 }>;
-/**
- * READ-ONLY: list execution_jobs for a given execution_runs.id. Ordered by
- * created_at ASC so downstream diffs show timeline order.
- */
-export declare function listExecutionJobsDirect(databaseUrl: string, opts: {
-    runId: string;
-}): Promise<{
-    jobs: ExecutionJobRow[];
-}>;
 export interface WorkflowRegistrationRow {
     id: string;
     repo_identifier: string;
@@ -678,33 +645,6 @@ export interface EmitKiciEventOpts {
 export declare function emitKiciEventDirect(databaseUrl: string, opts: EmitKiciEventOpts): Promise<{
     eventId: string;
 }>;
-export interface SeedGenericWebhookSourceOpts {
-    orgId: string;
-    name: string;
-    /** Pre-computed deterministic UUID (caller derives via sha256(orgId:name)) */
-    sourceId: string;
-    /** Pre-computed routing key (caller uses `generic:${orgId}:${name}`) */
-    routingKey: string;
-    verificationMethod?: string;
-    /** 'generic' (Stripe-shaped) or 'local' (github-shaped via LocalWebhookNormalizer,
-     *  a git repo present on the agent filesystem cloned via file://). */
-    providerType?: 'generic' | 'local';
-    /** For `providerType='local'`: the per-source `{ repoBasePath, cloneUrlBase? }`
-     *  stored in `git_config`. The orchestrator reads `repoBasePath` from this row
-     *  at registration time to build the local provider bundle. */
-    gitConfig?: Record<string, unknown>;
-}
-/**
- * Upsert a row into `generic_webhook_sources`. Uses
- * `ON CONFLICT (routing_key) DO UPDATE` so warm-start mode (where the source
- * may already exist from a prior run) is idempotent.
- *
- * IMPORTANT: callers must invoke this BEFORE the orchestrator starts, because
- * GenericSourceManager caches sources at boot and does not reload them later.
- * This helper supersedes seedGenericWebhookSource() in
- * e2e/helpers/local-webhook.ts.
- */
-export declare function seedGenericWebhookSourceDirect(databaseUrl: string, opts: SeedGenericWebhookSourceOpts): Promise<void>;
 /**
  * Return `{ current: true }` if the applied migration count matches the
  * provider's migration count AND the content hash in `_migration_content_hash`
@@ -731,215 +671,6 @@ export declare function isSchemaCurrent(pool: pg.Pool, provider: MigrationProvid
 export declare function purgeSecretBackendsDirect(databaseUrl: string): Promise<{
     deleted: number;
 }>;
-/**
- * Check if an API key exists in the Platform DB (api_keys table — orchestrator-
- * managed, NOT user_api_keys). Returns true when a row matches the hashed key.
- */
-export declare function apiKeyExistsDirect(databaseUrl: string, apiKey: string): Promise<boolean>;
-/**
- * Insert an api_keys row (Platform-side orchestrator credential). Used by
- * e2e setup to seed an orchestrator authentication token. Returns the id.
- */
-export declare function seedApiKeyInlineDirect(databaseUrl: string, opts: {
-    keyName: string;
-    orgId: string;
-    fullKey: string;
-}): Promise<{
-    keyId: string;
-}>;
-/**
- * Lookup a `platform_connections` row by connection_id. Returns true when
- * present. Used by the orphan-sweeper e2e test.
- */
-export declare function platformConnectionExistsDirect(databaseUrl: string, connectionId: string): Promise<boolean>;
-/**
- * Count `webhook_sources` rows for a given orchestrator_connection_id.
- * Used by the orphan-sweeper e2e test to assert the FK CASCADE introduced
- * by Platform migration 017 actually fires when the parent
- * `platform_connections` row is deleted.
- */
-/**
- * Look up a Platform-side `webhook_sources` row by routing key. Returns the
- * row (org_id + provider + connection) or null. Used by E2E to assert that a
- * source added at runtime on the orchestrator propagated to the Platform's
- * `webhook_sources` table (the dashboard-visible source list) without a
- * restart.
- */
-export declare function getWebhookSourceByRoutingKeyDirect(databaseUrl: string, routingKey: string): Promise<{
-    routing_key: string;
-    org_id: string;
-    provider: string;
-} | null>;
-export declare function countWebhookSourcesByConnectionIdDirect(databaseUrl: string, connectionId: string): Promise<number>;
-/**
- * Find a `user_api_keys.id` preferring rows scoped to `preferredOrgId`, else
- * any row in the table. Used by orphan-sweeper test to get a realistic
- * `key_id` for platform_connections seeding.
- */
-export declare function findAnyUserApiKeyIdDirect(databaseUrl: string, preferredOrgId: string): Promise<string | null>;
-/**
- * Seed or refresh a synthetic GitHub webhook source on the Platform DB.
- * Used by HMAC E2E tests that post to `/webhook/:orgId/github`.
- * Idempotent — refreshes the secret/org_id via ON CONFLICT DO UPDATE,
- * and clears stale rows with a different routing_key under the same
- * (org_id, provider, connection_id) triple.
- */
-export declare function seedSyntheticGithubSourceDirect(databaseUrl: string, opts: {
-    routingKey: string;
-    orgId: string;
-    /** Display name pushed by the orchestrator on register. Optional. */
-    name?: string;
-    /** Fine-grained subtype (e.g. 'github_app'). Optional. */
-    subtype?: string;
-    /** GitHub App slug. Optional. */
-    slug?: string;
-}): Promise<void>;
-/**
- * Seed a webhook secret into the orchestrator's `scoped_secrets` table,
- * encrypted with the caller-supplied key. Ensures a `sources` row exists
- * for the routing_key. Used by e2e setup on the orchestrator DB side.
- *
- * encryptFn takes plaintext + AAD and returns ciphertext bytes. The
- * caller owns the crypto primitive so this helper stays decoupled from
- * the orchestrator's PgSecretStore crypto module.
- *
- * `customerId` is the org the source belongs to, and passing it is what makes
- * this seed faithful to a deployed environment. `sources.customer_id` carries a
- * column DEFAULT of `'__default__'`, so a row inserted without it lands on the
- * no-tenant anchor — and `resolveOrgId` then reports `'__default__'` for every
- * event on that routing key, which denies org-scoped features (global-workflow
- * registration, the multi-provider lock fallback) for reasons that surface
- * nowhere near the source row. Supplied on both paths so a row an earlier seed
- * left on the default anchor is repaired rather than inherited; that is exactly
- * what the staging deploy's own `updateSourcesCustomerId()` step does after the
- * fact. Omit it only when the caller genuinely has no org (a single-tenant
- * fixture), never because it is inconvenient to thread.
- */
-export declare function seedWebhookSecretDirect(databaseUrl: string, opts: {
-    routingKey: string;
-    webhookSecret: string;
-    encryptFn: (plaintext: string, aad: string) => string | Buffer;
-    /** Org that owns the source. Written on insert and reasserted on an existing row. */
-    customerId?: string;
-}): Promise<{
-    sourceId: string;
-}>;
-/**
- * Seed a source private key into the orchestrator's `scoped_secrets` table.
- * encryptFn signature matches seedWebhookSecretDirect. Returns null if the
- * sources row is missing (matches legacy warning-and-skip behaviour).
- */
-export declare function seedSourcePrivateKeyDirect(databaseUrl: string, opts: {
-    routingKey: string;
-    privateKey: string;
-    encryptFn: (plaintext: string, aad: string) => string | Buffer;
-}): Promise<{
-    sourceId: string;
-} | null>;
-/**
- * Bump `registry_versions.version` for the default registry and return the
- * new value. Used by cron-scheduler e2e to retrigger index after a manual
- * workflow change.
- */
-export declare function bumpRegistryVersionDirect(databaseUrl: string): Promise<number>;
-/**
- * Poll `kici_events` for an event matching `eventName` created after `since`.
- * Returns the newest match, or throws on timeout. Used by e2e event-routing tests.
- */
-export declare function pollKiciEventsDirect(databaseUrl: string, opts: {
-    eventName: string;
-    since: Date;
-    timeoutMs?: number;
-    pollIntervalMs?: number;
-    payloadFilter?: {
-        key: string;
-        value: string;
-    };
-}): Promise<Record<string, unknown>>;
-/**
- * Ping a PostgreSQL database; retries until `SELECT 1` succeeds or the
- * timeout expires. Used by e2e startup to wait for Postgres readiness.
- */
-export declare function waitForPostgresDirect(databaseUrl: string, opts?: {
-    timeoutMs?: number;
-    intervalMs?: number;
-}): Promise<void>;
-/**
- * Wait for a specific execution_runs row to reach a terminal status.
- * Used by test-pipeline e2e to gate on run completion. Terminal statuses
- * are success / failed / cancelled / timed_out_stale.
- */
-export declare function waitForRunCompletionDirect(databaseUrl: string, runId: string, opts?: {
-    timeoutMs?: number;
-    intervalMs?: number;
-}): Promise<{
-    status: string;
-}>;
-/**
- * DELETE from execution_jobs + execution_runs where started_at > since.
- * Used by e2e cleanup for tests that want explicit post-test row cleanup.
- */
-export declare function cleanupExecutionRowsDirect(databaseUrl: string, since: Date): Promise<{
-    runs: number;
-    jobs: number;
-}>;
-/**
- * Check whether the schema is "current" by comparing applied migration count
- * and content hash against a caller-supplied set of migration files.
- * Returns false if the migration table is missing, counts mismatch, or the
- * stored hash differs from the caller-supplied hash. Used by e2e warm-start.
- */
-export declare function isSchemaCurrentFromFilesDirect(databaseUrl: string, opts: {
-    tableName?: string;
-    expectedCount: number;
-    expectedContentHash: string;
-}): Promise<boolean>;
-/**
- * Store a migration content hash in the `_migration_content_hash` marker
- * table. Creates the table if missing. Used by e2e freshDatabase() after
- * migrations run so warm-start detection can compare on next run.
- */
-export declare function storeMigrationContentHashInTableDirect(databaseUrl: string, opts: {
-    tableName?: string;
-    contentHash: string;
-}): Promise<void>;
-/**
- * Insert a join_tokens row (orchestrator DB) for cluster peer auth.
- * Used by cluster e2e helpers to provision a shared secret the second
- * orchestrator will use when joining the cluster.
- */
-export declare function createJoinTokenDirect(databaseUrl: string, opts: {
-    id: string;
-    tokenHash: string;
-    routingInfo: Record<string, unknown>;
-    role: string;
-    createdBy: string;
-    expiresAt: Date;
-}): Promise<void>;
-/**
- * Delete join_tokens rows by `created_by` (orchestrator DB). Used by cluster
- * E2E tests to clean up test-provisioned tokens between runs.
- */
-export declare function deleteJoinTokensByCreatedByDirect(databaseUrl: string, opts: {
-    createdBy: string;
-}): Promise<void>;
-/**
- * Update the routing_key on `sources` rows for a given provider. Used by
- * cluster e2e to swap the staging routing key for an isolated test key
- * (and to restore it on teardown).
- *
- * `whereRoutingKey`: optional filter on the current routing_key. When
- * present only rows matching it are updated; when absent the provider
- * filter alone is used (with an implicit `!= newRoutingKey` guard so the
- * update is idempotent).
- */
-export declare function updateSourceRoutingKeyDirect(databaseUrl: string, opts: {
-    provider: string;
-    newRoutingKey: string;
-    whereRoutingKey?: string;
-}): Promise<{
-    updated: number;
-}>;
 /**
  * Delete peer_credentials rows whose instance_id does NOT match a pattern.
  * Used by cluster e2e to wipe stale staging peer credentials while leaving
@@ -950,569 +681,6 @@ export declare function prunePeerCredentialsDirect(databaseUrl: string, opts: {
 }): Promise<{
     deleted: number;
 }>;
-/**
- * Poll Platform until at least `minRegistrations` distinct orchestrator
- * connections are BOTH registered for the routing key (row in webhook_sources)
- * AND live (row in platform_connections with status='connected'). The live-
- * connection join is critical — Platform's webhook_sources rows persist after
- * a connection disconnects (the orphan sweeper eventually reaps them), so a
- * naive COUNT(DISTINCT) on webhook_sources alone would inflate the number
- * and mask a missing coordinator registration.
- */
-export declare function waitForPlatformRegistrationsDirect(platformDbUrl: string, routingKey: string, opts?: {
-    minRegistrations?: number;
-    timeoutMs?: number;
-    intervalMs?: number;
-}): Promise<void>;
-/**
- * Seed a generic_webhook_sources row with a custom `event_type_header` and
- * `git_config` payload. Used by universal-git e2e (Forgejo) to register
- * an ingest endpoint that extracts the event type from Gitea-style headers.
- */
-export interface SeedUniversalGitSourceOpts {
-    orgId: string;
-    sourceId: string;
-    sourceName: string;
-    routingKey: string;
-    gitConfig: Record<string, unknown>;
-    eventTypeHeader?: string;
-}
-export declare function seedUniversalGitSourceDirect(databaseUrl: string, opts: SeedUniversalGitSourceOpts): Promise<void>;
-/**
- * Seed the ci-security orchestrator fixtures expected by the security
- * pipeline e2e: sources row for dashboard orgId resolution, context,
- * two execution_runs (unknown + trusted), two execution_jobs, and a
- * security held_run for the unknown contributor.
- *
- * Returns the ids so the caller can assert downstream.
- */
-export interface SeedCiSecurityFixturesOpts {
-    orgId: string;
-    contextName?: string;
-    sourceName?: string;
-    sourceRoutingKey?: string;
-    runsRoutingKey: string;
-    unknownRunId: string;
-    unknownDeliveryId: string;
-    unknownJobId: string;
-    trustedRunId: string;
-    trustedDeliveryId: string;
-    trustedJobId: string;
-    /**
-     * Second PR on the SAME repo (`repo_identifier='.'`, `pr_number=2`) with its
-     * own pending security hold. Seeded so PR-scoping tests can prove that a
-     * `/kici approve` on the first PR (pr_number=1) leaves this one held.
-     */
-    secondPrRunId: string;
-    secondPrDeliveryId: string;
-    secondPrJobId: string;
-    /**
-     * Hold on a DIFFERENT repo (`repo_identifier='other/repo'`, `pr_number=1`) —
-     * same PR number as the first hold but a different repo, proving the scoping
-     * isolates on repo as well as PR number.
-     */
-    otherRepoRunId: string;
-    otherRepoDeliveryId: string;
-    otherRepoJobId: string;
-    /**
-     * Workflow-modification hold (`repo_identifier='.'`, `pr_number=3`,
-     * `reason='workflow_modification'`) — the hold a non-trusted contributor's
-     * workflow-editing PR produces. Seeded so the PR-scoped `/kici approve`
-     * (which joins on `pr_number`) can find and resolve it.
-     */
-    wfModRunId: string;
-    wfModDeliveryId: string;
-    wfModJobId: string;
-    /**
-     * Fork-PR hold (`repo_identifier='.'`, `pr_number=4`, `reason='fork_pr'`) —
-     * the hold the org trust policy's fork arm produces. Reachable only since the
-     * policy became enforced, so it is seeded to prove PR-scoped selection and
-     * approval work for it exactly as they do for the workflow-modification hold.
-     */
-    forkPrRunId: string;
-    forkPrDeliveryId: string;
-    forkPrJobId: string;
-}
-export interface SeedCiSecurityFixturesResult {
-    /**
-     * The context name the fixture seeded (the `contextName` option, or its
-     * default). Assertions build the expected `held_runs.reason` from this rather
-     * than re-deriving the name, so an override cannot desync them.
-     */
-    contextName: string;
-    envId: string;
-    /** Held run for the unknown contributor (repo `.`, pr_number 1). */
-    heldRunId: string;
-    /** Held run for the same-repo second PR (repo `.`, pr_number 2). */
-    secondHeldRunId: string;
-    /** Held run for the different-repo run (repo `other/repo`, pr_number 1). */
-    otherRepoHeldRunId: string;
-    /** Held run for the workflow-modification PR (repo `.`, pr_number 3). */
-    wfModHeldRunId: string;
-    /** Held run for the fork PR (repo `.`, pr_number 4). */
-    forkPrHeldRunId: string;
-}
-/** repo_identifier used for the different-repo isolation hold. */
-export declare const CI_SECURITY_OTHER_REPO = "other/repo";
-export declare function seedCiSecurityFixturesDirect(databaseUrl: string, opts: SeedCiSecurityFixturesOpts): Promise<SeedCiSecurityFixturesResult>;
-/**
- * Poll `execution_runs` for the newest run started since `since` whose status
- * is in `statuses`, returning that status. Resolves `{ status: null }` if the
- * deadline passes before any run reaches a target status.
- *
- * Callers wanting "did the run finish?" pass the terminal status set and read
- * the landed status — a terminal failure is reported immediately rather than
- * indistinguishable from a timeout. Used by the cluster reroute tests to gate
- * on a workflow reaching a terminal state after a webhook trigger.
- *
- * Pass `deliveryId` to scope the poll to the caller's own delivery. A `since`
- * window alone does NOT identify a run: any workflow reaching a terminal state
- * inside the same window matches, so a neighbouring run — including one whose
- * failure is the point of some other test — is reported as if it were the
- * caller's. The stored `delivery_id` is the source-prefixed form
- * (`generic:<org>:<source>:<caller-id>`), so the caller's id is matched as a
- * suffix.
- */
-export declare function waitForExecutionRunReachesStatusSinceDirect(databaseUrl: string, opts: {
-    since: Date;
-    statuses: readonly string[];
-    /** Scope to one delivery. Omit only when the caller genuinely wants "any run". */
-    deliveryId?: string;
-    timeoutMs?: number;
-    intervalMs?: number;
-}): Promise<{
-    status: string | null;
-}>;
-/**
- * Fetch the most recent `execution_runs` row matching `status`, plus its
- * `execution_jobs`. Used by cluster reroute tests to confirm the run +
- * its jobs completed successfully.
- *
- * Pass `deliveryId` to scope to the caller's own delivery — "the newest run
- * with this status" is otherwise satisfied by any concurrent workflow, so the
- * returned `run_id` can belong to a different test.
- */
-export interface LatestExecutionRunResult {
-    run: {
-        run_id: string;
-        workflow_name: string;
-        status: string;
-    };
-    jobs: Array<{
-        job_id: string;
-        job_name: string;
-        status: string;
-    }>;
-}
-export declare function latestExecutionRunByStatusDirect(databaseUrl: string, opts: {
-    status: string;
-    /** Scope to one delivery. Omit only when the caller genuinely wants "any run". */
-    deliveryId?: string;
-}): Promise<LatestExecutionRunResult | null>;
-/**
- * Wait for a `execution_jobs` row joined against the most recent
- * `execution_runs` for a given workflow name with started_at >= since,
- * returning the job's status + error + run_id. Used by secrets-pipeline
- * to gate on terminal job status.
- */
-export interface WaitForLatestJobResult {
-    status: string | null;
-    errorMessage: string | null;
-    runId: string | null;
-}
-export declare function waitForLatestExecutionJobStatusDirect(databaseUrl: string, opts: {
-    workflowName: string;
-    since: Date;
-    terminalStatuses?: readonly string[];
-    timeoutMs?: number;
-    intervalMs?: number;
-}): Promise<WaitForLatestJobResult>;
-/**
- * READ-ONLY: return information_schema column names for `tableName`,
- * ordered by ordinal_position. Used by e2e tests to verify migrations
- * produced expected schema shape. Returns empty array if the table
- * doesn't exist.
- */
-export interface ColumnInfo {
-    name: string;
-    dataType: string;
-}
-export declare function describeTableColumnsDirect(databaseUrl: string, opts: {
-    tableName: string;
-}): Promise<ColumnInfo[]>;
-/**
- * READ-ONLY: return true if a table exists in the public schema.
- */
-export declare function tableExistsDirect(databaseUrl: string, opts: {
-    tableName: string;
-    schema?: string;
-}): Promise<boolean>;
-/**
- * Raw INSERT into kici_events with custom chain_depth + expiry window.
- * Used by event-routing e2e to test circuit-breaker + TTL behavior
- * beyond what `emitKiciEventDirect` exposes (which hardcodes depth=0
- * and 1h expiry). Returns the inserted id.
- */
-export interface InsertKiciEventRawOpts {
-    eventName: string;
-    payload: Record<string, unknown>;
-    sourceRoutingKey?: string;
-    chainDepth?: number;
-    /** ISO string or relative '1 hour' / '-1 hour'. Use negative for expired. */
-    expiresIn?: string;
-}
-export declare function insertKiciEventRawDirect(databaseUrl: string, opts: InsertKiciEventRawOpts): Promise<{
-    id: string;
-}>;
-/**
- * READ-ONLY: return a kici_events row by id, or null. Callers decode
- * `payload` as they need. Used by event-routing e2e after an INSERT.
- */
-export interface KiciEventRow {
-    id: string;
-    event_name: string;
-    payload: Record<string, unknown>;
-    chain_depth: number;
-    source_routing_key: string | null;
-    source_repo: string | null;
-    processed: boolean | null;
-    expires_at: string;
-    created_at: string;
-}
-export declare function showKiciEventDirect(databaseUrl: string, opts: {
-    id: string;
-}): Promise<KiciEventRow | null>;
-/**
- * READ-ONLY: list kici_events with filter hooks used by e2e tests:
- * by `event_name`, minimum `chain_depth`, expiry window. Returns the
- * rows with chain_depth ordered ascending. Callers apply assertions.
- */
-export declare function listKiciEventsDirect(databaseUrl: string, opts?: {
-    eventName?: string;
-    minChainDepth?: number;
-    /** When true, return only rows past their expires_at. */
-    onlyExpired?: boolean;
-    /** When set, cap to this many rows. */
-    limit?: number;
-}): Promise<KiciEventRow[]>;
-/**
- * DELETE kici_events by id or event_name. Returns the number of rows
- * deleted. Used by event-routing teardown.
- */
-export declare function deleteKiciEventsDirect(databaseUrl: string, opts: {
-    id?: string;
-    eventName?: string;
-}): Promise<{
-    deleted: number;
-}>;
-/**
- * INSERT a kici_events row with an explicit created_at. Lets a test place
- * many events on the exact same timestamp so the catch-up keyset cursor's
- * same-created_at tie handling is genuinely exercised (the default-NOW insert
- * path cannot force ties deterministically). Returns the inserted id.
- */
-export declare function insertKiciEventAtDirect(databaseUrl: string, opts: {
-    eventName: string;
-    createdAt: Date;
-    payload?: Record<string, unknown>;
-    chainDepth?: number;
-    sourceRoutingKey?: string | null;
-    expiresIn?: string;
-}): Promise<{
-    id: string;
-}>;
-/**
- * Page through unprocessed, non-DLQ kici_events for a given event_name using
- * the same composite `(created_at, id)` keyset cursor + `ORDER BY created_at
- * ASC, id ASC` that EventStore.getUnprocessedSince runs. Keep this SQL in sync
- * with `packages/orchestrator/src/events/event-store.ts`.
- *
- * Returns every id seen across all pages in traversal order (with duplicates
- * preserved so the caller can assert none occur) plus the page count. This is
- * the real-Postgres guard that the keyset cursor pages the entire backlog —
- * including same-created_at ties across a page boundary — with no skip and no
- * duplicate.
- */
-export declare function paginateUnprocessedEventsKeysetDirect(databaseUrl: string, opts: {
-    eventName: string;
-    batchSize?: number;
-}): Promise<{
-    ids: string[];
-    pages: number;
-}>;
-/**
- * Simulate a NOTIFY on `kici_event_channel` and verify a LISTEN client
- * receives it. Used by event-routing e2e to prove the infrastructure
- * the EventRouter uses for real-time delivery is functional. Owns the
- * pool for the full test to keep the listen/notify correlated.
- */
-export declare function verifyKiciEventNotifyDirect(databaseUrl: string, opts: {
-    payload: string;
-    waitMs?: number;
-}): Promise<{
-    received: string[];
-}>;
-export interface CrossRepoTrustRow {
-    id: string;
-    source_repo: string;
-    source_routing_key: string;
-    target_repo: string;
-    target_routing_key: string;
-    allowed_events: string[] | null;
-}
-/**
- * INSERT a cross_repo_trust row. Returns the new id and allowed_events
- * array. Used by generic-webhook + event-routing e2e until a proper
- * `kici-admin trust` CLI ships.
- */
-export declare function seedCrossRepoTrustDirect(databaseUrl: string, opts: {
-    sourceRepo: string;
-    sourceRoutingKey: string;
-    targetRepo: string;
-    targetRoutingKey: string;
-    allowedEvents?: string[];
-}): Promise<{
-    id: string;
-    allowedEvents: string[] | null;
-}>;
-/**
- * READ-ONLY: list cross_repo_trust rows by source_routing_key. Used by
- * generic-webhook e2e to find a trust row it just inserted.
- */
-export declare function listCrossRepoTrustBySourceRoutingKeyDirect(databaseUrl: string, opts: {
-    sourceRoutingKey: string;
-}): Promise<CrossRepoTrustRow[]>;
-/**
- * DELETE cross_repo_trust rows. Deletes by id, or asserts uniqueness
- * check error on duplicate INSERT (handled by caller). Returns row count.
- */
-export declare function deleteCrossRepoTrustDirect(databaseUrl: string, opts: {
-    id: string;
-}): Promise<{
-    deleted: number;
-}>;
-/**
- * Direct INSERT with duplicate-key detection. Used by event-routing
- * e2e to verify the unique constraint enforces. Throws on duplicate;
- * caller asserts the error message matches /unique/i.
- */
-export declare function insertCrossRepoTrustStrictDirect(databaseUrl: string, opts: {
-    sourceRepo: string;
-    sourceRoutingKey: string;
-    targetRepo: string;
-    targetRoutingKey: string;
-}): Promise<void>;
-/**
- * Cleanup helper for workflow_registrations. Accepts id, routingKey,
- * or repoIdentifier filter (exactly one). Returns delete count.
- */
-export declare function deleteWorkflowRegistrationsDirect(databaseUrl: string, opts: {
-    id?: string;
-    routingKey?: string;
-    repoIdentifier?: string;
-}): Promise<{
-    deleted: number;
-}>;
-/**
- * READ-ONLY: workflow_registrations by id — returns null when missing.
- * Pulls the full row so tests can assert lock_entry contents + trigger_types.
- */
-export interface WorkflowRegistrationFullRow extends WorkflowRegistrationRow {
-    lock_entry: unknown;
-}
-export declare function getWorkflowRegistrationByIdDirect(databaseUrl: string, opts: {
-    id: string;
-}): Promise<WorkflowRegistrationFullRow | null>;
-/**
- * READ-ONLY: return the count + optional rows + latest updated_at for
- * workflow_registrations scoped to a routing key. Used by forgejo e2e
- * to wait for extraction + verify re-extraction bumped updated_at.
- */
-export interface RegistrationsScopedResult {
-    count: number;
-    latestUpdatedAt: Date | null;
-    rows: Array<{
-        workflow_name: string;
-        is_global: boolean;
-    }>;
-}
-export declare function listRegistrationsByRoutingKeyDirect(databaseUrl: string, opts: {
-    routingKey: string;
-    onlyGlobal?: boolean;
-}): Promise<RegistrationsScopedResult>;
-/**
- * Poll `workflow_registrations` for at least `minCount` rows for a
- * routing key. Returns the rows or throws on timeout (keeps parity with
- * the forgejo helper pattern it replaces).
- */
-export declare function waitForRegistrationsByRoutingKeyDirect(databaseUrl: string, opts: {
-    routingKey: string;
-    minCount?: number;
-    onlyGlobal?: boolean;
-    timeoutMs?: number;
-    intervalMs?: number;
-}): Promise<Array<{
-    workflow_name: string;
-    is_global: boolean;
-}>>;
-/**
- * Wait for `workflow_registrations.updated_at` for a routing key to
- * exceed `baselineUpdatedAt`. Used by forgejo rotated-PAT e2e.
- */
-export declare function waitForRegistrationsUpdatedAtAdvanceDirect(databaseUrl: string, opts: {
-    routingKey: string;
-    baselineUpdatedAt: Date | null;
-    timeoutMs?: number;
-    intervalMs?: number;
-}): Promise<{
-    advanced: boolean;
-    latestUpdatedAt: Date | null;
-}>;
-/**
- * UPDATE a workflow_registrations row's commit_sha. Used by cron-scheduler
- * e2e where the manual-schedule handler rejects null commit SHAs.
- */
-export declare function updateWorkflowRegistrationCommitShaDirect(databaseUrl: string, opts: {
-    id: string;
-    commitSha: string;
-}): Promise<void>;
-/**
- * Lock-entry seeding for the admin-API e2e, which uses a custom
- * shape (cron schedule). Returns the inserted id.
- */
-export declare function insertWorkflowRegistrationRawDirect(databaseUrl: string, opts: {
-    routingKey: string;
-    repoIdentifier: string;
-    workflowName: string;
-    lockEntry: Record<string, unknown>;
-    triggerTypes: string[];
-    customerId: string;
-    isGlobal?: boolean;
-    disabled?: boolean;
-    commitSha?: string;
-    id?: string;
-}): Promise<{
-    id: string;
-}>;
-/**
- * INSERT with a STRICT shape (no ON CONFLICT). Used by registration-schema
- * e2e to prove the unique constraint rejects duplicates. Throws the raw
- * DB error (caller matches /unique/i).
- */
-export declare function insertWorkflowRegistrationStrictDirect(databaseUrl: string, opts: {
-    routingKey: string;
-    repoIdentifier: string;
-    workflowName: string;
-    lockEntryJson?: string;
-    triggerTypes: readonly string[];
-    customerId: string;
-}): Promise<{
-    id: string | null;
-}>;
-/**
- * READ-ONLY: latest registry_versions.version, or null if the default
- * row is missing. Used by registration-admin-api e2e to bracket a
- * refresh call.
- */
-export declare function getRegistryVersionDirect(databaseUrl: string, opts?: {
-    id?: string;
-}): Promise<number | null>;
-/**
- * UPDATE `registry_versions.version = version + 1` WHERE id (default).
- * Simpler than `bumpRegistryVersionDirect` — used by global-workflow
- * e2e which wants the side-effect (force index refresh) without the
- * return value.
- */
-export declare function bumpRegistryVersionSimpleDirect(databaseUrl: string, opts?: {
-    id?: string;
-}): Promise<void>;
-/**
- * Seed cron_last_fired for a registration with an `-INTERVAL` offset so
- * the scheduler fires on the next evaluation. Upsert via ON CONFLICT.
- */
-export declare function upsertCronLastFiredDirect(databaseUrl: string, opts: {
-    registrationId: string;
-    agoInterval: string;
-    scheduleKey: string;
-}): Promise<void>;
-/**
- * READ-ONLY: count cron_last_fired rows for a registration. Used by
- * registration-schema e2e to assert the FK cascade deletes the row.
- */
-export declare function countCronLastFiredDirect(databaseUrl: string, opts: {
-    registrationId: string;
-}): Promise<number>;
-/**
- * INSERT a cron_last_fired row with an explicit timestamp. Used by
- * registration-schema e2e to set up the FK cascade test.
- */
-export declare function insertCronLastFiredNowDirect(databaseUrl: string, opts: {
-    registrationId: string;
-    scheduleKey: string;
-}): Promise<void>;
-/**
- * DELETE cron_last_fired rows for a registration. Teardown helper.
- */
-export declare function deleteCronLastFiredDirect(databaseUrl: string, opts: {
-    registrationId: string;
-}): Promise<void>;
-/**
- * DELETE execution_runs by workflow_name. Teardown helper for
- * manual-schedule e2e.
- */
-export declare function deleteExecutionRunsByWorkflowNameDirect(databaseUrl: string, opts: {
-    workflowName: string;
-}): Promise<{
-    deleted: number;
-}>;
-/**
- * READ-ONLY: SELECT generic_webhook_sources by routing_key.
- * Used by forgejo e2e to assert the source exists with correct git_config.
- */
-export declare function getGenericWebhookSourceByRoutingKeyDirect(databaseUrl: string, opts: {
-    routingKey: string;
-}): Promise<{
-    id: string;
-    git_config: unknown;
-    customer_id: string | null;
-} | null>;
-/**
- * READ-ONLY: list active (enabled=true) generic_webhook_sources.
- * Used by cluster-leader-failover e2e to prove the seeded source exists
- * before a leader crash.
- */
-export declare function listActiveGenericWebhookSourcesDirect(databaseUrl: string): Promise<Array<{
-    id: string;
-    customer_id: string | null;
-    routing_key: string;
-}>>;
-/**
- * UPDATE generic_webhook_sources.verification_config for a source by
- * name + customer_id. Used by the generic-webhook-auth e2e which seeds
- * sources and then writes custom auth configs.
- */
-export declare function updateGenericWebhookVerificationConfigDirect(databaseUrl: string, opts: {
-    name: string;
-    customerId: string;
-    verificationConfig: Record<string, unknown>;
-}): Promise<void>;
-/**
- * DELETE generic_webhook_sources by name list. Teardown for the auth
- * e2e, which seeded 3 sources by name.
- */
-export declare function deleteGenericWebhookSourcesByNameDirect(databaseUrl: string, opts: {
-    names: readonly string[];
-}): Promise<{
-    deleted: number;
-}>;
-/**
- * UPDATE generic_webhook_sources.deleted_at = NULL for a row by id.
- * Used by the generic-webhook e2e to restore a soft-deleted source
- * after the soft-delete test ran — there is no CLI-level undelete.
- */
-export declare function restoreSoftDeletedGenericWebhookSourceDirect(databaseUrl: string, opts: {
-    id: string;
-}): Promise<void>;
 /**
  * One entry in any of the three repo-pattern lists stored on `org_settings`.
  * `routingKey` is the source-qualifier; when absent, the entry applies to
@@ -1522,144 +690,6 @@ export interface OrgSettingsRepoPatternEntry {
     routingKey?: string;
     pattern: string;
 }
-/**
- * UPSERT the per-org global-workflow repo lists for a customer/org id. The
- * three list fields are each optional; each list is a jsonb array of
- * `{routingKey?, pattern}` entries. Pass `null` to clear a list.
- *
- * The master enable switch is NOT set here: it is fleet-wide
- * (`cluster_settings.global_workflows_enabled`) — use
- * {@link setClusterGlobalWorkflowsEnabledDirect}.
- */
-export interface UpsertOrgSettingsOpts {
-    customerId: string;
-    allowedRepos?: OrgSettingsRepoPatternEntry[] | null;
-    deniedRepos?: OrgSettingsRepoPatternEntry[] | null;
-    elevatedRepos?: OrgSettingsRepoPatternEntry[] | null;
-}
-export declare function upsertOrgSettingsGlobalWorkflowsDirect(databaseUrl: string, opts: UpsertOrgSettingsOpts): Promise<void>;
-/**
- * Set (or clear) the fleet-wide global-workflows master switch directly.
- *
- * Direct-DB by design, matching every other `*Direct` helper here: these exist
- * for E2E seeding, which must set the switch BEFORE an orchestrator is up and
- * therefore cannot go through the admin HTTP API. Operators use
- * `kici-admin cluster-settings set --global-workflows-enabled <bool>`.
- *
- * Passing `null` clears the override, so the orchestrator's configured default
- * applies. Upserts the singleton `id='default'` row, so it works against a
- * fresh database with no cluster_settings row at all.
- *
- * `cluster_settings.version` is left untouched: seeding happens before any
- * worker reads the row, so there is nothing to invalidate yet — the operator
- * PATCH path (admin-cluster-settings.ts) owns the version bump for live changes.
- */
-export declare function setClusterGlobalWorkflowsEnabledDirect(databaseUrl: string, enabled: boolean | null): Promise<void>;
-/**
- * UPDATE org_settings.global_workflow_denied_repos for a customer/org id.
- * Assumes the row exists (upsertOrgSettingsGlobalWorkflowsDirect was
- * called earlier in the test).
- */
-export declare function updateOrgSettingsDeniedReposDirect(databaseUrl: string, opts: {
-    customerId: string;
-    deniedRepos: OrgSettingsRepoPatternEntry[] | null;
-}): Promise<void>;
-/**
- * DELETE org_settings by customer/org id. Teardown helper.
- */
-export declare function deleteOrgSettingsByCustomerIdDirect(databaseUrl: string, opts: {
-    customerId: string;
-}): Promise<{
-    deleted: number;
-}>;
-/**
- * READ-ONLY: fetch an execution_runs row by run_id, returning the
- * security-relevant columns the ci-security e2e asserts on. Throws
- * when the row is missing.
- */
-export interface ExecutionRunSecurityRow {
-    run_id: string;
-    trust_tier: string | null;
-    lock_file_source: string | null;
-    contributor_username: string | null;
-    status: string;
-}
-export declare function getExecutionRunSecurityDirect(databaseUrl: string, opts: {
-    runId: string;
-}): Promise<ExecutionRunSecurityRow>;
-/**
- * READ-ONLY: fetch a held_runs row by id (with the security columns).
- * Returns null if missing.
- */
-export interface HeldRunSecurityRow {
-    id: string;
-    run_id: string;
-    hold_type: string;
-    queue_type: string;
-    status: string;
-    reason: string | null;
-    expires_at: string | null;
-    approved_by: string | null;
-    resolved_at: string | null;
-}
-export declare function getHeldRunByIdDirect(databaseUrl: string, opts: {
-    id: string;
-}): Promise<HeldRunSecurityRow | null>;
-/** One recorded approver decision for a held run (`held_run_approvals` row). */
-export interface HeldRunApprovalRow {
-    id: string;
-    held_run_id: string;
-    approver_user_id: string;
-    decision: string;
-    created_at: Date;
-}
-/**
- * READ-ONLY: list the recorded approver decisions for a held run, newest
- * first. Approver attribution lives in `held_run_approvals` (one row per
- * decision), not on the `held_runs` row — used by ci-security e2e to prove
- * an approval was stamped with the approving user's sub.
- */
-export declare function listHeldRunApprovalsDirect(databaseUrl: string, opts: {
-    heldRunId: string;
-}): Promise<HeldRunApprovalRow[]>;
-/**
- * READ-ONLY: count held_runs rows matching run_id + queue_type.
- * Used by ci-security e2e to prove no security hold exists for a
- * trusted contributor PR.
- */
-export declare function countHeldRunsByRunIdDirect(databaseUrl: string, opts: {
-    runId: string;
-    queueType?: string;
-}): Promise<number>;
-/**
- * Wait for Platform-side `execution_runs.status = <status>` where
- * `created_at > since`. Returns the final status + failure_reason or
- * null if the timeout elapsed. Used by webhook-pipeline (failed) and
- * orchestrator-never-reconnects (timed_out_stale).
- */
-export declare function waitForPlatformExecutionRunStatusDirect(databaseUrl: string, opts: {
-    status: string;
-    since: Date;
-    timeoutMs?: number;
-    intervalMs?: number;
-}): Promise<{
-    status: string;
-    failure_reason: string | null;
-} | null>;
-/**
- * Wait for Platform `event_log` to show at least `minDistinctRouted`
- * distinct `routed_to` values since a given timestamp. Used by
- * cluster-round-robin to prove at least 2 orchestrators received
- * deliveries. Returns the observed count (0 if timed out).
- */
-export declare function waitForPlatformEventLogDistinctRoutedDirect(databaseUrl: string, opts: {
-    since: Date;
-    minDistinctRouted: number;
-    timeoutMs?: number;
-    intervalMs?: number;
-}): Promise<{
-    distinctRouted: number;
-}>;
 /**
  * Wait for an orchestrator `event_log` row keyed by `delivery_id`.
  * Returns the full row (the webhook-pipeline e2e asserts many
@@ -1679,114 +709,5 @@ export interface EventLogRow {
     matched_count: number;
     run_id: string | null;
 }
-export declare function waitForEventLogRowByDeliveryIdDirect(databaseUrl: string, opts: {
-    deliveryId: string;
-    timeoutMs?: number;
-    intervalMs?: number;
-}): Promise<EventLogRow | null>;
-/**
- * Resolve a Platform `webhook_sources.routing_key` for an org.
- *
- * - With `routingKeyLikePrefix` only: returns the newest match. Note that
- *   this picks whichever generic source was registered most recently — if
- *   tests have created additional generic sources (e.g. universal-git-forgejo
- *   creating `stg-universal-git-forgejo`), the newest may NOT be the
- *   `stg-generic` default seeded by `pnpm deploy:stg`.
- * - With `orchDbUrl` + `nameInOrchDb`: looks up the source by name in the
- *   orchestrator's `generic_webhook_sources` table, then verifies the
- *   resulting routing key is registered in Platform's `webhook_sources`.
- *   This is the disambiguating path Bucket-B tests should use when other
- *   generic sources may exist alongside the default.
- */
-export declare function resolvePlatformWebhookSourceRoutingKeyDirect(platformDbUrl: string, opts: {
-    orgId: string;
-    routingKeyLikePrefix: string;
-    orchDbUrl?: string;
-    nameInOrchDb?: string;
-}): Promise<string | null>;
-/**
- * Idempotent seeding of an E2E regular user + org membership + owner
- * role on the Platform DB. Used by stg-ha-smoke before seeding a user
- * API key. Requires the org to already have an owner role.
- */
-export declare function ensureOrgOwnerMemberDirect(platformDbUrl: string, opts: {
-    orgId: string;
-    idpSub: string;
-    email: string;
-    displayName: string;
-}): Promise<{
-    ownerRoleId: string;
-}>;
-/**
- * Cleanup peer_credentials by instance_id LIKE pattern. Used by the
- * cluster-peer-credentials e2e before/after each test to wipe its
- * own seeded rows without touching real cluster credentials.
- */
-export declare function deletePeerCredentialsByInstanceIdLikeDirect(databaseUrl: string, opts: {
-    pattern: string;
-}): Promise<{
-    deleted: number;
-}>;
-/**
- * Insert a peer_credentials row with an explicit expires_at. Used by
- * the "expired credential is not returned" e2e — the store's save()
- * always computes a future expiry, so tests that need a pre-expired
- * row must bypass it.
- */
-export declare function insertPeerCredentialExpiredDirect(databaseUrl: string, opts: {
-    instanceId: string;
-    credentialHash: string;
-    role: string;
-    routingKeys: readonly string[];
-    expiresAt: Date;
-}): Promise<void>;
-/**
- * READ-ONLY: `revoked_at` for a peer_credentials row by hash. Used
- * by the "save revokes old credential" e2e to assert revocation.
- * Returns null when the row is missing entirely (distinct from
- * "present but not revoked").
- */
-export declare function getPeerCredentialRevokedAtDirect(databaseUrl: string, opts: {
-    credentialHash: string;
-}): Promise<{
-    present: boolean;
-    revokedAt: Date | null;
-}>;
-/**
- * READ-ONLY: list active peer_credentials ids EXCLUDING a
- * `instance_id LIKE` pattern. Used by revokeAll e2e to snapshot
- * real cluster credentials it will restore later.
- */
-export declare function listActivePeerCredentialsExcludingDirect(databaseUrl: string, opts: {
-    excludeInstanceIdPattern: string;
-}): Promise<{
-    ids: string[];
-}>;
-/**
- * Clear revoked_at on a set of peer_credentials ids. Used by revokeAll
- * e2e to restore real cluster credentials after the destructive test.
- */
-export declare function clearPeerCredentialsRevokedAtByIdsDirect(databaseUrl: string, opts: {
-    ids: readonly string[];
-}): Promise<{
-    updated: number;
-}>;
-/**
- * READ-ONLY: count currently-active (non-revoked, non-expired)
- * peer_credentials rows for a given instance_id. Used by the
- * concurrent-save e2e to assert 1 <= count <= 2.
- */
-export declare function countActivePeerCredentialsByInstanceDirect(databaseUrl: string, opts: {
-    instanceId: string;
-}): Promise<number>;
-/**
- * Terminate every idle backend of the connecting user except our own
- * connection. Mirrors what a Postgres leader demotion does to idle pooled
- * connections — used by resilience tests to verify the pg pool error
- * handlers absorb the termination without a process restart.
- *
- * Returns the number of backends terminated.
- */
-export declare function terminateIdleDbBackendsDirect(databaseUrl: string): Promise<number>;
 export {};
 //# sourceMappingURL=db-admin.d.ts.map