@kici-dev/shared 0.5.0 → 0.6.1

package/dist/db-admin.js

@@ -2,7 +2,6 @@ import "./rolldown-runtime-ClRpJifh.js";
 import { createPool } from "./db.js";
 import { createHash } from "node:crypto";
 import pg from "pg";
-import { HoldType, unknownContributorHoldReason } from "@kici-dev/engine";
 //#region src/db-admin.ts
 /**
 * Admin/DB-operations helpers shared between `kici-admin` (orchestrator DB)
@@ -63,23 +62,6 @@ async function withAdminPool(adminUrl, fn) {
 	}
 }
 /**
-* DROP `dbName` (if it exists). Terminates existing backend connections
-* so the DROP doesn't block. Idempotent — drops are IF EXISTS.
-*
-* Used by e2e cleanup after a full-lifecycle service-deploy test tears
-* down its isolated database. Shares the same admin-URL + identifier-
-* validation + backend-termination scaffolding as dropAndCreateDatabase
-* so the two helpers cannot drift.
-*/
-async function dropDatabaseDirect(databaseUrl) {
-	const { adminUrl, dbName } = parseDatabaseUrl(databaseUrl);
-	assertValidIdentifier(dbName, "database name");
-	await withAdminPool(adminUrl, async (pool) => {
-		await pool.query("SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = $1 AND pid <> pg_backend_pid()", [dbName]);
-		await pool.query(`DROP DATABASE IF EXISTS "${dbName}"`);
-	});
-}
-/**
 * Drop `dbName` (if it exists), then recreate it owned by `owner`. Terminates
 * existing backend connections so the DROP doesn't block.
 */
@@ -243,27 +225,6 @@ async function clearDispatchQueueDirect(databaseUrl) {
 	}
 }
 /**
-* TRUNCATE the three scaler-state tables on the orchestrator DB (direct SQL).
-*
-* These tables (`scaler_reservations`, `scaler_spawning_agents`,
-* `scaler_agent_jobs`) hold in-flight scaler bookkeeping that a boot / Raft
-* leader switch rehydrates via `ScalerManager.recoverState`. A row for an agent
-* that spawned but never registered (or whose reservation leaked) is counted as
-* used capacity forever, so a warm-reused orchestrator DB can accumulate stale
-* reservations that push `used` past the resource cap and stop every future
-* scale-up. E2E setups that reuse a warm orch DB call this before the
-* orchestrator starts so it rehydrates a clean slate — the DB analog of
-* allocating a fresh machine-ledger directory per run.
-*/
-async function clearScalerStateDirect(databaseUrl) {
-	const pool = createPool(databaseUrl);
-	try {
-		await pool.query("TRUNCATE scaler_reservations, scaler_spawning_agents, scaler_agent_jobs");
-	} finally {
-		await pool.end();
-	}
-}
-/**
 * DELETE orphan execution_runs + execution_jobs for routing keys other than
 * `routingKey` (and rows with NULL routing_key). Returns row counts.
 */
@@ -891,24 +852,6 @@ async function showExecutionRunDirect(databaseUrl, opts) {
 	}
 }
 /**
-* READ-ONLY: list execution_jobs for a given execution_runs.id. Ordered by
-* created_at ASC so downstream diffs show timeline order.
-*/
-async function listExecutionJobsDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		return { jobs: (await pool.query(`SELECT j.id, j.run_id, j.job_id, j.job_name, j.status, j.agent_id,
-              j.started_at, j.completed_at, j.duration_ms, j.created_at, j.error_message,
-              j.contexts
-         FROM execution_jobs j
-         INNER JOIN execution_runs r ON r.run_id = j.run_id
-        WHERE r.run_id::text = $1 OR r.id::text = $1
-        ORDER BY j.created_at ASC`, [opts.runId])).rows };
-	} finally {
-		await pool.end();
-	}
-}
-/**
 * READ-ONLY: list workflow_registrations with optional filters. Also returns
 * the latest registry_versions.version so callers can assert registry bumps
 * without a second round trip.
@@ -1118,48 +1061,6 @@ async function emitKiciEventDirect(databaseUrl, opts) {
 	}
 }
 /**
-* Upsert a row into `generic_webhook_sources`. Uses
-* `ON CONFLICT (routing_key) DO UPDATE` so warm-start mode (where the source
-* may already exist from a prior run) is idempotent.
-*
-* IMPORTANT: callers must invoke this BEFORE the orchestrator starts, because
-* GenericSourceManager caches sources at boot and does not reload them later.
-* This helper supersedes seedGenericWebhookSource() in
-* e2e/helpers/local-webhook.ts.
-*/
-async function seedGenericWebhookSourceDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		await pool.query(`INSERT INTO generic_webhook_sources (
-        id, customer_id, name, routing_key,
-        verification_method, verification_config,
-        event_type_header, dedup_window_seconds,
-        max_payload_bytes, rate_limit_rpm, enabled,
-        provider_type, git_config
-      ) VALUES ($1, $2, $3, $4, $5, '{}', 'x-event-type', 300, 10485760, 600, true, $6, $7::jsonb)
-      ON CONFLICT (routing_key) DO UPDATE SET
-        customer_id = EXCLUDED.customer_id,
-        name = EXCLUDED.name,
-        verification_method = EXCLUDED.verification_method,
-        verification_config = EXCLUDED.verification_config,
-        provider_type = EXCLUDED.provider_type,
-        git_config = EXCLUDED.git_config,
-        enabled = true,
-        deleted_at = NULL,
-        updated_at = NOW()`, [
-			opts.sourceId,
-			opts.orgId,
-			opts.name,
-			opts.routingKey,
-			opts.verificationMethod ?? "none",
-			opts.providerType ?? "generic",
-			opts.gitConfig ? JSON.stringify(opts.gitConfig) : null
-		]);
-	} finally {
-		await pool.end();
-	}
-}
-/**
 * Return `{ current: true }` if the applied migration count matches the
 * provider's migration count AND the content hash in `_migration_content_hash`
 * matches the provider's current hash. Otherwise return `{ current: false,
@@ -1211,449 +1112,6 @@ async function purgeSecretBackendsDirect(databaseUrl) {
 	}
 }
 /**
-* Check if an API key exists in the Platform DB (api_keys table — orchestrator-
-* managed, NOT user_api_keys). Returns true when a row matches the hashed key.
-*/
-async function apiKeyExistsDirect(databaseUrl, apiKey) {
-	const keyHash = createHash("sha256").update(apiKey).digest("hex");
-	const pool = createPool(databaseUrl);
-	try {
-		return (await pool.query("SELECT 1 FROM api_keys WHERE key_hash = $1", [keyHash])).rows.length > 0;
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Insert an api_keys row (Platform-side orchestrator credential). Used by
-* e2e setup to seed an orchestrator authentication token. Returns the id.
-*/
-async function seedApiKeyInlineDirect(databaseUrl, opts) {
-	const keyHash = createHash("sha256").update(opts.fullKey).digest("hex");
-	const keyPrefix = opts.fullKey.slice(0, 16);
-	const pool = createPool(databaseUrl);
-	try {
-		return { keyId: (await pool.query(`INSERT INTO api_keys (key_hash, key_prefix, name, org_id)
-       VALUES ($1, $2, $3, $4)
-       RETURNING id`, [
-			keyHash,
-			keyPrefix,
-			opts.keyName,
-			opts.orgId
-		])).rows[0].id };
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Lookup a `platform_connections` row by connection_id. Returns true when
-* present. Used by the orphan-sweeper e2e test.
-*/
-async function platformConnectionExistsDirect(databaseUrl, connectionId) {
-	const pool = createPool(databaseUrl);
-	try {
-		const res = await pool.query(`SELECT 1 FROM platform_connections WHERE connection_id = $1 LIMIT 1`, [connectionId]);
-		return res.rowCount !== null && res.rowCount > 0;
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Count `webhook_sources` rows for a given orchestrator_connection_id.
-* Used by the orphan-sweeper e2e test to assert the FK CASCADE introduced
-* by Platform migration 017 actually fires when the parent
-* `platform_connections` row is deleted.
-*/
-/**
-* Look up a Platform-side `webhook_sources` row by routing key. Returns the
-* row (org_id + provider + connection) or null. Used by E2E to assert that a
-* source added at runtime on the orchestrator propagated to the Platform's
-* `webhook_sources` table (the dashboard-visible source list) without a
-* restart.
-*/
-async function getWebhookSourceByRoutingKeyDirect(databaseUrl, routingKey) {
-	const pool = createPool(databaseUrl);
-	try {
-		const row = (await pool.query(`SELECT routing_key, org_id, provider
-         FROM webhook_sources
-         WHERE routing_key = $1
-         LIMIT 1`, [routingKey])).rows[0];
-		return row ? {
-			routing_key: String(row.routing_key),
-			org_id: String(row.org_id),
-			provider: String(row.provider)
-		} : null;
-	} finally {
-		await pool.end();
-	}
-}
-async function countWebhookSourcesByConnectionIdDirect(databaseUrl, connectionId) {
-	const pool = createPool(databaseUrl);
-	try {
-		const res = await pool.query(`SELECT COUNT(*)::int AS cnt
-         FROM webhook_sources
-         WHERE orchestrator_connection_id = $1`, [connectionId]);
-		return Number(res.rows[0]?.cnt ?? 0);
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Find a `user_api_keys.id` preferring rows scoped to `preferredOrgId`, else
-* any row in the table. Used by orphan-sweeper test to get a realistic
-* `key_id` for platform_connections seeding.
-*/
-async function findAnyUserApiKeyIdDirect(databaseUrl, preferredOrgId) {
-	const pool = createPool(databaseUrl);
-	try {
-		const scoped = await pool.query(`SELECT id FROM user_api_keys WHERE org_id = $1 LIMIT 1`, [preferredOrgId]);
-		if (scoped.rows.length > 0) return String(scoped.rows[0].id);
-		const any = await pool.query(`SELECT id FROM user_api_keys LIMIT 1`);
-		return any.rows.length > 0 ? String(any.rows[0].id) : null;
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Seed or refresh a synthetic GitHub webhook source on the Platform DB.
-* Used by HMAC E2E tests that post to `/webhook/:orgId/github`.
-* Idempotent — refreshes the secret/org_id via ON CONFLICT DO UPDATE,
-* and clears stale rows with a different routing_key under the same
-* (org_id, provider, connection_id) triple.
-*/
-async function seedSyntheticGithubSourceDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		await pool.query(`INSERT INTO platform_connections (
-         org_id, instance_id, connection_id, key_id, routing_keys
-       )
-       VALUES ($1, 'e2e-synthetic-instance', 'e2e-synthetic',
-               '00000000-0000-4000-8000-000000000000', $2::text)
-       ON CONFLICT (connection_id) DO UPDATE
-         SET org_id = $1,
-             routing_keys = $2::text,
-             last_heartbeat_at = NOW()`, [opts.orgId, JSON.stringify([opts.routingKey])]);
-		await pool.query(`DELETE FROM webhook_sources
-       WHERE org_id = $1 AND provider = 'github'
-         AND orchestrator_connection_id = 'e2e-synthetic'
-         AND routing_key != $2`, [opts.orgId, opts.routingKey]);
-		await pool.query(`INSERT INTO webhook_sources (routing_key, provider, orchestrator_connection_id, org_id, name, subtype, slug)
-       VALUES ($1, 'github', 'e2e-synthetic', $2, $3, $4, $5)
-       ON CONFLICT (routing_key, orchestrator_connection_id)
-         DO UPDATE SET org_id = $2, name = $3, subtype = $4, slug = $5`, [
-			opts.routingKey,
-			opts.orgId,
-			opts.name ?? null,
-			opts.subtype ?? null,
-			opts.slug ?? null
-		]);
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Seed a webhook secret into the orchestrator's `scoped_secrets` table,
-* encrypted with the caller-supplied key. Ensures a `sources` row exists
-* for the routing_key. Used by e2e setup on the orchestrator DB side.
-*
-* encryptFn takes plaintext + AAD and returns ciphertext bytes. The
-* caller owns the crypto primitive so this helper stays decoupled from
-* the orchestrator's PgSecretStore crypto module.
-*
-* `customerId` is the org the source belongs to, and passing it is what makes
-* this seed faithful to a deployed environment. `sources.customer_id` carries a
-* column DEFAULT of `'__default__'`, so a row inserted without it lands on the
-* no-tenant anchor — and `resolveOrgId` then reports `'__default__'` for every
-* event on that routing key, which denies org-scoped features (global-workflow
-* registration, the multi-provider lock fallback) for reasons that surface
-* nowhere near the source row. Supplied on both paths so a row an earlier seed
-* left on the default anchor is repaired rather than inherited; that is exactly
-* what the staging deploy's own `updateSourcesCustomerId()` step does after the
-* fact. Omit it only when the caller genuinely has no org (a single-tenant
-* fixture), never because it is inconvenient to thread.
-*/
-async function seedWebhookSecretDirect(databaseUrl, opts) {
-	const { randomBytes } = await import("node:crypto");
-	const pool = createPool(databaseUrl);
-	try {
-		let sourceId;
-		const sourceResult = await pool.query("SELECT id FROM sources WHERE routing_key = $1", [opts.routingKey]);
-		if (sourceResult.rows.length > 0) {
-			sourceId = sourceResult.rows[0].id;
-			if (opts.customerId) await pool.query("UPDATE sources SET customer_id = $1, updated_at = now() WHERE routing_key = $2", [opts.customerId, opts.routingKey]);
-		} else {
-			sourceId = randomBytes(16).toString("hex");
-			const [provider, appId] = opts.routingKey.split(":");
-			await pool.query(`INSERT INTO sources (id, provider, name, routing_key, config${opts.customerId ? ", customer_id" : ""})
-         VALUES ($1, $2, $3, $4, $5${opts.customerId ? ", $6" : ""})
-         ${opts.customerId ? "ON CONFLICT (routing_key) DO UPDATE SET customer_id = EXCLUDED.customer_id, updated_at = now()" : "ON CONFLICT (routing_key) DO NOTHING"}`, [
-				sourceId,
-				provider || "github",
-				`e2e-${appId}`,
-				opts.routingKey,
-				JSON.stringify({ appId: appId || "" }),
-				...opts.customerId ? [opts.customerId] : []
-			]);
-			sourceId = (await pool.query("SELECT id FROM sources WHERE routing_key = $1", [opts.routingKey])).rows[0].id;
-		}
-		const scope = `__source__/${sourceId}`;
-		const orgId = "__system__";
-		const aad = `${orgId}:${scope}:webhookSecret`;
-		const encrypted = opts.encryptFn(opts.webhookSecret, aad);
-		await pool.query(`INSERT INTO scoped_secrets (org_id, scope, key, encrypted_value, backend_type, key_version)
-       VALUES ($1, $2, 'webhookSecret', $3, 'pg', 1)
-       ON CONFLICT (org_id, scope, key) DO UPDATE SET encrypted_value = $3, updated_at = now()`, [
-			orgId,
-			scope,
-			encrypted
-		]);
-		return { sourceId };
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Seed a source private key into the orchestrator's `scoped_secrets` table.
-* encryptFn signature matches seedWebhookSecretDirect. Returns null if the
-* sources row is missing (matches legacy warning-and-skip behaviour).
-*/
-async function seedSourcePrivateKeyDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		const sourceResult = await pool.query("SELECT id FROM sources WHERE routing_key = $1", [opts.routingKey]);
-		if (sourceResult.rows.length === 0) return null;
-		const sourceId = sourceResult.rows[0].id;
-		const scope = `__source__/${sourceId}`;
-		const orgId = "__system__";
-		const aad = `${orgId}:${scope}:privateKey`;
-		const encrypted = opts.encryptFn(opts.privateKey, aad);
-		await pool.query(`INSERT INTO scoped_secrets (org_id, scope, key, encrypted_value, backend_type, key_version)
-       VALUES ($1, $2, 'privateKey', $3, 'pg', 1)
-       ON CONFLICT (org_id, scope, key) DO UPDATE SET encrypted_value = $3, updated_at = now()`, [
-			orgId,
-			scope,
-			encrypted
-		]);
-		return { sourceId };
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Bump `registry_versions.version` for the default registry and return the
-* new value. Used by cron-scheduler e2e to retrigger index after a manual
-* workflow change.
-*/
-async function bumpRegistryVersionDirect(databaseUrl) {
-	const pool = createPool(databaseUrl);
-	try {
-		return (await pool.query(`UPDATE registry_versions
-       SET version = version + 1, updated_at = NOW()
-       WHERE id = 'default'
-       RETURNING version`)).rows[0].version;
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Poll `kici_events` for an event matching `eventName` created after `since`.
-* Returns the newest match, or throws on timeout. Used by e2e event-routing tests.
-*/
-async function pollKiciEventsDirect(databaseUrl, opts) {
-	const timeoutMs = opts.timeoutMs ?? 6e4;
-	const pollInterval = opts.pollIntervalMs ?? 2e3;
-	const deadline = Date.now() + timeoutMs;
-	const pool = createPool(databaseUrl);
-	try {
-		while (Date.now() < deadline) {
-			const filter = opts.payloadFilter;
-			const result = filter ? await pool.query(`SELECT * FROM kici_events
-             WHERE event_name = $1 AND created_at > $2 AND payload->>$3 = $4
-             ORDER BY created_at DESC
-             LIMIT 1`, [
-				opts.eventName,
-				opts.since.toISOString(),
-				filter.key,
-				filter.value
-			]) : await pool.query(`SELECT * FROM kici_events
-             WHERE event_name = $1 AND created_at > $2
-             ORDER BY created_at DESC
-             LIMIT 1`, [opts.eventName, opts.since.toISOString()]);
-			if (result.rows.length > 0) return result.rows[0];
-			await new Promise((r) => setTimeout(r, pollInterval));
-		}
-		throw new Error(`Timed out after ${timeoutMs}ms waiting for kici_event '${opts.eventName}' since ${opts.since.toISOString()}`);
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Ping a PostgreSQL database; retries until `SELECT 1` succeeds or the
-* timeout expires. Used by e2e startup to wait for Postgres readiness.
-*/
-async function waitForPostgresDirect(databaseUrl, opts) {
-	const timeout = opts?.timeoutMs ?? 3e4;
-	const interval = opts?.intervalMs ?? 2e3;
-	const deadline = Date.now() + timeout;
-	while (Date.now() < deadline) {
-		const pool = createPool(databaseUrl);
-		try {
-			await pool.query("SELECT 1");
-			await pool.end();
-			return;
-		} catch {
-			await pool.end();
-		}
-		await new Promise((r) => setTimeout(r, interval));
-	}
-	throw new Error(`PostgreSQL at ${databaseUrl} did not become available within ${timeout}ms`);
-}
-/**
-* Wait for a specific execution_runs row to reach a terminal status.
-* Used by test-pipeline e2e to gate on run completion. Terminal statuses
-* are success / failed / cancelled / timed_out_stale.
-*/
-async function waitForRunCompletionDirect(databaseUrl, runId, opts) {
-	const timeoutMs = opts?.timeoutMs ?? 12e4;
-	const intervalMs = opts?.intervalMs ?? 2e3;
-	const terminalStatuses = [
-		"success",
-		"failed",
-		"cancelled",
-		"timed_out_stale"
-	];
-	const deadline = Date.now() + timeoutMs;
-	const pool = createPool(databaseUrl);
-	try {
-		while (Date.now() < deadline) {
-			const result = await pool.query(`SELECT status FROM execution_runs WHERE run_id = $1 LIMIT 1`, [runId]);
-			if (result.rows.length > 0) {
-				const status = result.rows[0].status;
-				if (terminalStatuses.includes(status)) return { status };
-			}
-			await new Promise((r) => setTimeout(r, intervalMs));
-		}
-		throw new Error(`Run ${runId} did not complete within ${timeoutMs}ms`);
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* DELETE from execution_jobs + execution_runs where started_at > since.
-* Used by e2e cleanup for tests that want explicit post-test row cleanup.
-*/
-async function cleanupExecutionRowsDirect(databaseUrl, since) {
-	const pool = createPool(databaseUrl);
-	try {
-		const jobsResult = await pool.query(`DELETE FROM execution_jobs WHERE run_id IN (
-        SELECT run_id FROM execution_runs WHERE started_at > $1
-      )`, [since]);
-		return {
-			runs: (await pool.query(`DELETE FROM execution_runs WHERE started_at > $1`, [since])).rowCount ?? 0,
-			jobs: jobsResult.rowCount ?? 0
-		};
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Check whether the schema is "current" by comparing applied migration count
-* and content hash against a caller-supplied set of migration files.
-* Returns false if the migration table is missing, counts mismatch, or the
-* stored hash differs from the caller-supplied hash. Used by e2e warm-start.
-*/
-async function isSchemaCurrentFromFilesDirect(databaseUrl, opts) {
-	const tableName = opts.tableName ?? "kysely_migration";
-	const pool = createPool(databaseUrl);
-	try {
-		try {
-			if (((await pool.query(`SELECT COUNT(*)::int AS count FROM "${tableName}"`)).rows[0]?.count ?? 0) !== opts.expectedCount) return false;
-			const hashResult = await pool.query(`SELECT hash FROM ${MIGRATION_HASH_TABLE} WHERE table_name = $1`, [tableName]);
-			if (hashResult.rows.length === 0 || hashResult.rows[0].hash !== opts.expectedContentHash) return false;
-			return true;
-		} catch {
-			return false;
-		}
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Store a migration content hash in the `_migration_content_hash` marker
-* table. Creates the table if missing. Used by e2e freshDatabase() after
-* migrations run so warm-start detection can compare on next run.
-*/
-async function storeMigrationContentHashInTableDirect(databaseUrl, opts) {
-	const tableName = opts.tableName ?? "kysely_migration";
-	const pool = createPool(databaseUrl);
-	try {
-		await pool.query(`
-      CREATE TABLE IF NOT EXISTS ${MIGRATION_HASH_TABLE} (
-        table_name text PRIMARY KEY,
-        hash text NOT NULL
-      )
-    `);
-		await pool.query(`INSERT INTO ${MIGRATION_HASH_TABLE} (table_name, hash) VALUES ($1, $2)
-       ON CONFLICT (table_name) DO UPDATE SET hash = $2`, [tableName, opts.contentHash]);
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Insert a join_tokens row (orchestrator DB) for cluster peer auth.
-* Used by cluster e2e helpers to provision a shared secret the second
-* orchestrator will use when joining the cluster.
-*/
-async function createJoinTokenDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		await pool.query(`INSERT INTO join_tokens (id, token_hash, routing_info, role, created_by, expires_at)
-       VALUES ($1, $2, $3, $4, $5, $6)`, [
-			opts.id,
-			opts.tokenHash,
-			JSON.stringify(opts.routingInfo),
-			opts.role,
-			opts.createdBy,
-			opts.expiresAt
-		]);
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Delete join_tokens rows by `created_by` (orchestrator DB). Used by cluster
-* E2E tests to clean up test-provisioned tokens between runs.
-*/
-async function deleteJoinTokensByCreatedByDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		await pool.query(`DELETE FROM join_tokens WHERE created_by = $1`, [opts.createdBy]);
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Update the routing_key on `sources` rows for a given provider. Used by
-* cluster e2e to swap the staging routing key for an isolated test key
-* (and to restore it on teardown).
-*
-* `whereRoutingKey`: optional filter on the current routing_key. When
-* present only rows matching it are updated; when absent the provider
-* filter alone is used (with an implicit `!= newRoutingKey` guard so the
-* update is idempotent).
-*/
-async function updateSourceRoutingKeyDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		return { updated: (opts.whereRoutingKey ? await pool.query(`UPDATE sources SET routing_key = $1 WHERE provider = $2 AND routing_key = $3`, [
-			opts.newRoutingKey,
-			opts.provider,
-			opts.whereRoutingKey
-		]) : await pool.query(`UPDATE sources SET routing_key = $1 WHERE provider = $2 AND routing_key != $1`, [opts.newRoutingKey, opts.provider])).rowCount ?? 0 };
-	} finally {
-		await pool.end();
-	}
-}
-/**
 * Delete peer_credentials rows whose instance_id does NOT match a pattern.
 * Used by cluster e2e to wipe stale staging peer credentials while leaving
 * e2e-* peers intact.
@@ -1666,1283 +1124,7 @@ async function prunePeerCredentialsDirect(databaseUrl, opts) {
 		await pool.end();
 	}
 }
-/**
-* Poll Platform until at least `minRegistrations` distinct orchestrator
-* connections are BOTH registered for the routing key (row in webhook_sources)
-* AND live (row in platform_connections with status='connected'). The live-
-* connection join is critical — Platform's webhook_sources rows persist after
-* a connection disconnects (the orphan sweeper eventually reaps them), so a
-* naive COUNT(DISTINCT) on webhook_sources alone would inflate the number
-* and mask a missing coordinator registration.
-*/
-async function waitForPlatformRegistrationsDirect(platformDbUrl, routingKey, opts) {
-	const minRegistrations = opts?.minRegistrations ?? 1;
-	const timeoutMs = opts?.timeoutMs ?? 3e4;
-	const intervalMs = opts?.intervalMs ?? 2e3;
-	const deadline = Date.now() + timeoutMs;
-	const pool = createPool(platformDbUrl);
-	try {
-		while (Date.now() < deadline) {
-			if (((await pool.query(`SELECT COUNT(DISTINCT ws.orchestrator_connection_id)::int AS cnt
-           FROM webhook_sources ws
-           JOIN platform_connections pc
-             ON pc.connection_id = ws.orchestrator_connection_id
-            AND pc.status = 'connected'
-          WHERE ws.routing_key = $1
-            AND ws.orchestrator_connection_id != 'e2e-synthetic'`, [routingKey])).rows[0]?.cnt ?? 0) >= minRegistrations) return;
-			await new Promise((r) => setTimeout(r, intervalMs));
-		}
-		throw new Error(`Timed out waiting for ${minRegistrations} orchestrator registration(s) for routing key ${routingKey} (waited ${timeoutMs}ms)`);
-	} finally {
-		await pool.end();
-	}
-}
-async function seedUniversalGitSourceDirect(databaseUrl, opts) {
-	const eventTypeHeader = opts.eventTypeHeader ?? "x-gitea-event";
-	const pool = createPool(databaseUrl);
-	try {
-		await pool.query(`INSERT INTO generic_webhook_sources (
-        id, customer_id, name, routing_key,
-        verification_method, verification_config,
-        event_type_header, dedup_window_seconds,
-        max_payload_bytes, rate_limit_rpm, enabled,
-        provider_type, git_config
-      ) VALUES ($1, $2, $3, $4, 'none', '{}', $6, 300, 10485760, 600, true,
-                'generic', $5::jsonb)
-      ON CONFLICT (routing_key) DO UPDATE SET
-        customer_id = EXCLUDED.customer_id,
-        name = EXCLUDED.name,
-        event_type_header = EXCLUDED.event_type_header,
-        git_config = EXCLUDED.git_config,
-        enabled = true,
-        deleted_at = NULL,
-        updated_at = NOW()`, [
-			opts.sourceId,
-			opts.orgId,
-			opts.sourceName,
-			opts.routingKey,
-			JSON.stringify(opts.gitConfig),
-			eventTypeHeader
-		]);
-	} finally {
-		await pool.end();
-	}
-}
-/** repo_identifier used for the different-repo isolation hold. */
-const CI_SECURITY_OTHER_REPO = "other/repo";
-async function seedCiSecurityFixturesDirect(databaseUrl, opts) {
-	const contextName = opts.contextName ?? "ci-security-env";
-	const sourceName = opts.sourceName ?? "ci-security-dashboard-resolver";
-	const sourceRoutingKey = opts.sourceRoutingKey ?? `generic:${opts.orgId}:ci-security-dashboard`;
-	const pool = createPool(databaseUrl);
-	try {
-		await pool.query(`INSERT INTO sources (id, provider, name, routing_key, config, customer_id)
-       VALUES (gen_random_uuid(), \'generic\', $1, $2, \'{}\', $3)
-       ON CONFLICT (routing_key) DO UPDATE SET customer_id = EXCLUDED.customer_id`, [
-			sourceName,
-			sourceRoutingKey,
-			opts.orgId
-		]);
-		const envId = (await pool.query(`INSERT INTO contexts (org_id, name, type, enabled)
-       VALUES ($1, $2, \'fixed\', true)
-       ON CONFLICT (org_id, name) DO UPDATE SET enabled = true
-       RETURNING id`, [opts.orgId, contextName])).rows[0].id;
-		async function seedPrHold(args) {
-			await pool.query(`INSERT INTO execution_runs (
-          run_id, workflow_name, provider, repo_identifier,
-          ref, sha, delivery_id, status, trust_tier, lock_file_source,
-          contributor_username, routing_key, pr_number
-        ) VALUES ($1, \'e2e-security-wf\', \'internal\', $4, \'refs/heads/feature\',
-          $5, $2, \'pending\', \'unknown\', \'base\', \'unknown-dev\', $3, $6)`, [
-				args.runId,
-				args.deliveryId,
-				opts.runsRoutingKey,
-				args.repoIdentifier,
-				args.sha,
-				args.prNumber
-			]);
-			await pool.query(`INSERT INTO execution_jobs (job_id, run_id, job_name, status)
-         VALUES ($1, $2, \'security-test-job\', \'pending\')`, [args.jobId, args.runId]);
-			return (await pool.query(`INSERT INTO held_runs (org_id, run_id, job_id, context_id, hold_type, queue_type, reason, expires_at)
-         VALUES ($1, $2, $3, $4, $5, \'security\', $6, NOW() + INTERVAL \'72 hours\')
-         RETURNING id`, [
-				opts.orgId,
-				args.runId,
-				args.jobId,
-				args.contextId === void 0 ? envId : args.contextId,
-				args.holdType ?? HoldType.enum.security,
-				args.reason ?? unknownContributorHoldReason(contextName)
-			])).rows[0].id;
-		}
-		const heldRunId = await seedPrHold({
-			runId: opts.unknownRunId,
-			deliveryId: opts.unknownDeliveryId,
-			jobId: opts.unknownJobId,
-			repoIdentifier: ".",
-			prNumber: 1,
-			sha: "abc123"
-		});
-		const secondHeldRunId = await seedPrHold({
-			runId: opts.secondPrRunId,
-			deliveryId: opts.secondPrDeliveryId,
-			jobId: opts.secondPrJobId,
-			repoIdentifier: ".",
-			prNumber: 2,
-			sha: "bbb222"
-		});
-		const otherRepoHeldRunId = await seedPrHold({
-			runId: opts.otherRepoRunId,
-			deliveryId: opts.otherRepoDeliveryId,
-			jobId: opts.otherRepoJobId,
-			repoIdentifier: CI_SECURITY_OTHER_REPO,
-			prNumber: 1,
-			sha: "ccc333"
-		});
-		const wfModHeldRunId = await seedPrHold({
-			runId: opts.wfModRunId,
-			deliveryId: opts.wfModDeliveryId,
-			jobId: opts.wfModJobId,
-			repoIdentifier: ".",
-			prNumber: 3,
-			sha: "ddd444",
-			holdType: HoldType.enum.security,
-			reason: "workflow_modification",
-			contextId: null
-		});
-		const forkPrHeldRunId = await seedPrHold({
-			runId: opts.forkPrRunId,
-			deliveryId: opts.forkPrDeliveryId,
-			jobId: opts.forkPrJobId,
-			repoIdentifier: ".",
-			prNumber: 4,
-			sha: "eee555",
-			holdType: HoldType.enum.security,
-			reason: "fork_pr",
-			contextId: null
-		});
-		await pool.query(`INSERT INTO execution_runs (
-        run_id, workflow_name, provider, repo_identifier,
-        ref, sha, delivery_id, status, trust_tier, lock_file_source,
-        contributor_username, routing_key, pr_number
-      ) VALUES ($1, \'e2e-security-wf\', \'internal\', \'.\', \'refs/heads/feature\',
-        \'def456\', $2, \'running\', \'trusted\', \'head\', \'trusted-dev\', $3, 1)`, [
-			opts.trustedRunId,
-			opts.trustedDeliveryId,
-			opts.runsRoutingKey
-		]);
-		await pool.query(`INSERT INTO execution_jobs (job_id, run_id, job_name, status)
-       VALUES ($1, $2, \'security-test-job\', \'running\')`, [opts.trustedJobId, opts.trustedRunId]);
-		return {
-			contextName,
-			envId,
-			heldRunId,
-			secondHeldRunId,
-			otherRepoHeldRunId,
-			wfModHeldRunId,
-			forkPrHeldRunId
-		};
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Poll `execution_runs` for the newest run started since `since` whose status
-* is in `statuses`, returning that status. Resolves `{ status: null }` if the
-* deadline passes before any run reaches a target status.
-*
-* Callers wanting "did the run finish?" pass the terminal status set and read
-* the landed status — a terminal failure is reported immediately rather than
-* indistinguishable from a timeout. Used by the cluster reroute tests to gate
-* on a workflow reaching a terminal state after a webhook trigger.
-*
-* Pass `deliveryId` to scope the poll to the caller's own delivery. A `since`
-* window alone does NOT identify a run: any workflow reaching a terminal state
-* inside the same window matches, so a neighbouring run — including one whose
-* failure is the point of some other test — is reported as if it were the
-* caller's. The stored `delivery_id` is the source-prefixed form
-* (`generic:<org>:<source>:<caller-id>`), so the caller's id is matched as a
-* suffix.
-*/
-async function waitForExecutionRunReachesStatusSinceDirect(databaseUrl, opts) {
-	const timeoutMs = opts.timeoutMs ?? 24e4;
-	const intervalMs = opts.intervalMs ?? 5e3;
-	const deadline = Date.now() + timeoutMs;
-	const pool = createPool(databaseUrl);
-	try {
-		while (Date.now() < deadline) {
-			const result = await pool.query(`SELECT status FROM execution_runs
-         WHERE started_at > $1 AND status = ANY($2)${opts.deliveryId ? " AND delivery_id LIKE $3" : ""}
-         ORDER BY started_at DESC
-         LIMIT 1`, opts.deliveryId ? [
-				opts.since,
-				[...opts.statuses],
-				`%${opts.deliveryId}`
-			] : [opts.since, [...opts.statuses]]);
-			if (result.rows.length > 0) return { status: result.rows[0].status };
-			await new Promise((r) => setTimeout(r, intervalMs));
-		}
-		return { status: null };
-	} finally {
-		await pool.end();
-	}
-}
-async function latestExecutionRunByStatusDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		const runResult = await pool.query(`SELECT run_id, workflow_name, status FROM execution_runs
-       WHERE status = $1${opts.deliveryId ? " AND delivery_id LIKE $2" : ""}
-       ORDER BY started_at DESC LIMIT 1`, opts.deliveryId ? [opts.status, `%${opts.deliveryId}`] : [opts.status]);
-		if (runResult.rows.length === 0) return null;
-		const run = runResult.rows[0];
-		return {
-			run,
-			jobs: (await pool.query(`SELECT job_id, job_name, status FROM execution_jobs WHERE run_id = $1`, [run.run_id])).rows
-		};
-	} finally {
-		await pool.end();
-	}
-}
-async function waitForLatestExecutionJobStatusDirect(databaseUrl, opts) {
-	const terminal = opts.terminalStatuses ?? [
-		"success",
-		"completed",
-		"failed"
-	];
-	const timeoutMs = opts.timeoutMs ?? 18e4;
-	const intervalMs = opts.intervalMs ?? 3e3;
-	const deadline = Date.now() + timeoutMs;
-	const pool = createPool(databaseUrl);
-	try {
-		let status = null;
-		let errorMessage = null;
-		let runId = null;
-		while (Date.now() < deadline) {
-			const result = await pool.query(`SELECT j.status, j.error_message, r.run_id
-           FROM execution_jobs j
-           JOIN execution_runs r ON r.run_id = j.run_id
-          WHERE r.workflow_name = $1
-            AND r.started_at >= $2
-          ORDER BY r.started_at DESC
-          LIMIT 1`, [opts.workflowName, opts.since]);
-			if (result.rows.length > 0) {
-				status = result.rows[0].status;
-				errorMessage = result.rows[0].error_message;
-				runId = result.rows[0].run_id;
-				if (status && terminal.includes(status)) break;
-			}
-			await new Promise((r) => setTimeout(r, intervalMs));
-		}
-		return {
-			status,
-			errorMessage,
-			runId
-		};
-	} finally {
-		await pool.end();
-	}
-}
-async function describeTableColumnsDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		return (await pool.query(`SELECT column_name, data_type FROM information_schema.columns
-        WHERE table_name = $1
-        ORDER BY ordinal_position`, [opts.tableName])).rows.map((r) => ({
-			name: r.column_name,
-			dataType: r.data_type
-		}));
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* READ-ONLY: return true if a table exists in the public schema.
-*/
-async function tableExistsDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		return (await pool.query(`SELECT 1 FROM information_schema.tables
-        WHERE table_schema = $1 AND table_name = $2`, [opts.schema ?? "public", opts.tableName])).rows.length > 0;
-	} finally {
-		await pool.end();
-	}
-}
-async function insertKiciEventRawDirect(databaseUrl, opts) {
-	const expiresIn = opts.expiresIn ?? "1 hour";
-	const pool = createPool(databaseUrl);
-	try {
-		return { id: (await pool.query(`INSERT INTO kici_events (event_name, payload, source_routing_key, chain_depth, expires_at)
-       VALUES ($1, $2, $3, $4, NOW() + ($5)::interval)
-       RETURNING id`, [
-			opts.eventName,
-			JSON.stringify(opts.payload),
-			opts.sourceRoutingKey ?? null,
-			opts.chainDepth ?? 0,
-			expiresIn
-		])).rows[0].id };
-	} finally {
-		await pool.end();
-	}
-}
-async function showKiciEventDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		return (await pool.query(`SELECT id, event_name, payload, chain_depth, source_routing_key,
-              source_repo, processed, expires_at, created_at
-         FROM kici_events WHERE id = $1`, [opts.id])).rows[0] ?? null;
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* READ-ONLY: list kici_events with filter hooks used by e2e tests:
-* by `event_name`, minimum `chain_depth`, expiry window. Returns the
-* rows with chain_depth ordered ascending. Callers apply assertions.
-*/
-async function listKiciEventsDirect(databaseUrl, opts = {}) {
-	const pool = createPool(databaseUrl);
-	try {
-		const clauses = [];
-		const params = [];
-		let idx = 1;
-		if (opts.eventName !== void 0) {
-			clauses.push(`event_name = $${idx}`);
-			params.push(opts.eventName);
-			idx += 1;
-		}
-		if (opts.minChainDepth !== void 0) {
-			clauses.push(`chain_depth > $${idx}`);
-			params.push(opts.minChainDepth);
-			idx += 1;
-		}
-		if (opts.onlyExpired) clauses.push(`expires_at < NOW()`);
-		const where = clauses.length > 0 ? `WHERE ${clauses.join(" AND ")}` : "";
-		const limit = Math.max(1, Math.min(1e4, opts.limit ?? 1e3));
-		return (await pool.query(`SELECT id, event_name, payload, chain_depth, source_routing_key,
-              source_repo, processed, expires_at, created_at
-         FROM kici_events
-         ${where}
-         ORDER BY chain_depth ASC, created_at ASC
-         LIMIT ${limit}`, params)).rows;
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* DELETE kici_events by id or event_name. Returns the number of rows
-* deleted. Used by event-routing teardown.
-*/
-async function deleteKiciEventsDirect(databaseUrl, opts) {
-	if (!opts.id && !opts.eventName) throw new Error("deleteKiciEventsDirect: one of {id, eventName} is required");
-	const pool = createPool(databaseUrl);
-	try {
-		return { deleted: (opts.id ? await pool.query(`DELETE FROM kici_events WHERE id = $1`, [opts.id]) : await pool.query(`DELETE FROM kici_events WHERE event_name = $1`, [opts.eventName])).rowCount ?? 0 };
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* INSERT a kici_events row with an explicit created_at. Lets a test place
-* many events on the exact same timestamp so the catch-up keyset cursor's
-* same-created_at tie handling is genuinely exercised (the default-NOW insert
-* path cannot force ties deterministically). Returns the inserted id.
-*/
-async function insertKiciEventAtDirect(databaseUrl, opts) {
-	const expiresIn = opts.expiresIn ?? "7 days";
-	const pool = createPool(databaseUrl);
-	try {
-		return { id: (await pool.query(`INSERT INTO kici_events
-         (event_name, payload, source_routing_key, chain_depth, processed, created_at, expires_at)
-       VALUES ($1, $2::jsonb, $3, $4, false, $5::timestamptz, NOW() + ($6)::interval)
-       RETURNING id`, [
-			opts.eventName,
-			JSON.stringify(opts.payload ?? {}),
-			opts.sourceRoutingKey ?? null,
-			opts.chainDepth ?? 0,
-			opts.createdAt.toISOString(),
-			expiresIn
-		])).rows[0].id };
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Page through unprocessed, non-DLQ kici_events for a given event_name using
-* the same composite `(created_at, id)` keyset cursor + `ORDER BY created_at
-* ASC, id ASC` that EventStore.getUnprocessedSince runs. Keep this SQL in sync
-* with `packages/orchestrator/src/events/event-store.ts`.
-*
-* Returns every id seen across all pages in traversal order (with duplicates
-* preserved so the caller can assert none occur) plus the page count. This is
-* the real-Postgres guard that the keyset cursor pages the entire backlog —
-* including same-created_at ties across a page boundary — with no skip and no
-* duplicate.
-*/
-async function paginateUnprocessedEventsKeysetDirect(databaseUrl, opts) {
-	const batchSize = Math.max(1, Math.min(1e4, opts.batchSize ?? 100));
-	const pool = createPool(databaseUrl);
-	try {
-		const ids = [];
-		let cursor = null;
-		let pages = 0;
-		for (;;) {
-			const params = [opts.eventName];
-			let cursorClause = "";
-			if (cursor) {
-				cursorClause = `AND (created_at, id) > ($2::timestamptz, $3::uuid)`;
-				params.push(cursor.createdAt, cursor.id);
-			}
-			const { rows } = await pool.query(`SELECT id, created_at FROM kici_events
-          WHERE event_name = $1 AND processed = false AND dlq_at IS NULL ${cursorClause}
-          ORDER BY created_at ASC, id ASC
-          LIMIT ${batchSize}`, params);
-			if (rows.length === 0) break;
-			pages += 1;
-			for (const r of rows) ids.push(r.id);
-			const last = rows[rows.length - 1];
-			cursor = {
-				createdAt: new Date(last.created_at).toISOString(),
-				id: last.id
-			};
-			if (rows.length < batchSize) break;
-		}
-		return {
-			ids,
-			pages
-		};
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Simulate a NOTIFY on `kici_event_channel` and verify a LISTEN client
-* receives it. Used by event-routing e2e to prove the infrastructure
-* the EventRouter uses for real-time delivery is functional. Owns the
-* pool for the full test to keep the listen/notify correlated.
-*/
-async function verifyKiciEventNotifyDirect(databaseUrl, opts) {
-	const waitMs = opts.waitMs ?? 1e3;
-	const pool = createPool(databaseUrl);
-	const client = await pool.connect();
-	try {
-		const notifications = [];
-		client.on("notification", (msg) => {
-			if (msg.channel === "kici_event_channel") notifications.push(msg.payload ?? "");
-		});
-		await client.query("LISTEN kici_event_channel");
-		await pool.query(`SELECT pg_notify('kici_event_channel', $1)`, [opts.payload]);
-		await new Promise((r) => setTimeout(r, waitMs));
-		await client.query("UNLISTEN kici_event_channel");
-		return { received: notifications };
-	} finally {
-		client.release();
-		await pool.end();
-	}
-}
-/**
-* INSERT a cross_repo_trust row. Returns the new id and allowed_events
-* array. Used by generic-webhook + event-routing e2e until a proper
-* `kici-admin trust` CLI ships.
-*/
-async function seedCrossRepoTrustDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		const result = await pool.query(`INSERT INTO cross_repo_trust
-         (source_repo, source_routing_key, target_repo, target_routing_key, allowed_events)
-       VALUES ($1, $2, $3, $4, $5)
-       RETURNING id, allowed_events`, [
-			opts.sourceRepo,
-			opts.sourceRoutingKey,
-			opts.targetRepo,
-			opts.targetRoutingKey,
-			opts.allowedEvents ? JSON.stringify(opts.allowedEvents) : null
-		]);
-		return {
-			id: result.rows[0].id,
-			allowedEvents: result.rows[0].allowed_events
-		};
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* READ-ONLY: list cross_repo_trust rows by source_routing_key. Used by
-* generic-webhook e2e to find a trust row it just inserted.
-*/
-async function listCrossRepoTrustBySourceRoutingKeyDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		return (await pool.query(`SELECT id, source_repo, source_routing_key, target_repo, target_routing_key, allowed_events
-         FROM cross_repo_trust WHERE source_routing_key = $1`, [opts.sourceRoutingKey])).rows;
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* DELETE cross_repo_trust rows. Deletes by id, or asserts uniqueness
-* check error on duplicate INSERT (handled by caller). Returns row count.
-*/
-async function deleteCrossRepoTrustDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		return { deleted: (await pool.query(`DELETE FROM cross_repo_trust WHERE id = $1`, [opts.id])).rowCount ?? 0 };
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Direct INSERT with duplicate-key detection. Used by event-routing
-* e2e to verify the unique constraint enforces. Throws on duplicate;
-* caller asserts the error message matches /unique/i.
-*/
-async function insertCrossRepoTrustStrictDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		await pool.query(`INSERT INTO cross_repo_trust (source_repo, source_routing_key, target_repo, target_routing_key)
-       VALUES ($1, $2, $3, $4)`, [
-			opts.sourceRepo,
-			opts.sourceRoutingKey,
-			opts.targetRepo,
-			opts.targetRoutingKey
-		]);
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Cleanup helper for workflow_registrations. Accepts id, routingKey,
-* or repoIdentifier filter (exactly one). Returns delete count.
-*/
-async function deleteWorkflowRegistrationsDirect(databaseUrl, opts) {
-	if ([
-		opts.id,
-		opts.routingKey,
-		opts.repoIdentifier
-	].filter((v) => v !== void 0).length !== 1) throw new Error("deleteWorkflowRegistrationsDirect: exactly one of {id, routingKey, repoIdentifier} required");
-	const pool = createPool(databaseUrl);
-	try {
-		let result;
-		if (opts.id) result = await pool.query(`DELETE FROM workflow_registrations WHERE id = $1`, [opts.id]);
-		else if (opts.routingKey) result = await pool.query(`DELETE FROM workflow_registrations WHERE routing_key = $1`, [opts.routingKey]);
-		else result = await pool.query(`DELETE FROM workflow_registrations WHERE repo_identifier = $1`, [opts.repoIdentifier]);
-		const deleted = result.rowCount ?? 0;
-		if (deleted > 0) await pool.query(`UPDATE registry_versions SET version = version + 1, updated_at = NOW() WHERE id = 'default'`);
-		return { deleted };
-	} finally {
-		await pool.end();
-	}
-}
-async function getWorkflowRegistrationByIdDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		return (await pool.query(`SELECT id, repo_identifier, workflow_name, routing_key, customer_id,
-              trigger_types, disabled, is_global, commit_sha, source_file,
-              created_at, updated_at, lock_entry
-         FROM workflow_registrations
-        WHERE id = $1`, [opts.id])).rows[0] ?? null;
-	} finally {
-		await pool.end();
-	}
-}
-async function listRegistrationsByRoutingKeyDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		const globalFilter = opts.onlyGlobal ? `AND is_global = TRUE` : "";
-		const result = await pool.query(`SELECT workflow_name, is_global, updated_at
-         FROM workflow_registrations
-        WHERE routing_key = $1 ${globalFilter}`, [opts.routingKey]);
-		let latest = null;
-		for (const r of result.rows) {
-			const d = r.updated_at ? new Date(r.updated_at) : null;
-			if (d && (!latest || d.getTime() > latest.getTime())) latest = d;
-		}
-		return {
-			count: result.rows.length,
-			latestUpdatedAt: latest,
-			rows: result.rows.map((r) => ({
-				workflow_name: r.workflow_name,
-				is_global: r.is_global
-			}))
-		};
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Poll `workflow_registrations` for at least `minCount` rows for a
-* routing key. Returns the rows or throws on timeout (keeps parity with
-* the forgejo helper pattern it replaces).
-*/
-async function waitForRegistrationsByRoutingKeyDirect(databaseUrl, opts) {
-	const minCount = opts.minCount ?? 1;
-	const timeoutMs = opts.timeoutMs ?? 3e4;
-	const intervalMs = opts.intervalMs ?? 1e3;
-	const deadline = Date.now() + timeoutMs;
-	let rows = [];
-	while (Date.now() < deadline) {
-		rows = (await listRegistrationsByRoutingKeyDirect(databaseUrl, {
-			routingKey: opts.routingKey,
-			onlyGlobal: opts.onlyGlobal
-		})).rows;
-		if (rows.length >= minCount) return rows;
-		await new Promise((r) => setTimeout(r, intervalMs));
-	}
-	return rows;
-}
-/**
-* Wait for `workflow_registrations.updated_at` for a routing key to
-* exceed `baselineUpdatedAt`. Used by forgejo rotated-PAT e2e.
-*/
-async function waitForRegistrationsUpdatedAtAdvanceDirect(databaseUrl, opts) {
-	const timeoutMs = opts.timeoutMs ?? 3e4;
-	const intervalMs = opts.intervalMs ?? 1e3;
-	const deadline = Date.now() + timeoutMs;
-	let latest = null;
-	while (Date.now() < deadline) {
-		latest = (await listRegistrationsByRoutingKeyDirect(databaseUrl, { routingKey: opts.routingKey })).latestUpdatedAt;
-		if (latest && (!opts.baselineUpdatedAt || latest.getTime() > opts.baselineUpdatedAt.getTime())) return {
-			advanced: true,
-			latestUpdatedAt: latest
-		};
-		await new Promise((r) => setTimeout(r, intervalMs));
-	}
-	return {
-		advanced: false,
-		latestUpdatedAt: latest
-	};
-}
-/**
-* UPDATE a workflow_registrations row's commit_sha. Used by cron-scheduler
-* e2e where the manual-schedule handler rejects null commit SHAs.
-*/
-async function updateWorkflowRegistrationCommitShaDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		await pool.query(`UPDATE workflow_registrations SET commit_sha = $1 WHERE id = $2`, [opts.commitSha, opts.id]);
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Lock-entry seeding for the admin-API e2e, which uses a custom
-* shape (cron schedule). Returns the inserted id.
-*/
-async function insertWorkflowRegistrationRawDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		const idClause = opts.id ? "$7" : "gen_random_uuid()";
-		const extras = [];
-		if (opts.id) extras.push(opts.id);
-		const columns = [];
-		const placeholders = [];
-		if (opts.isGlobal !== void 0) {
-			columns.push("is_global");
-			placeholders.push(`$${7 + extras.length}`);
-			extras.push(opts.isGlobal);
-		}
-		if (opts.disabled !== void 0) {
-			columns.push("disabled");
-			placeholders.push(`$${7 + extras.length}`);
-			extras.push(opts.disabled);
-		}
-		if (opts.commitSha !== void 0) {
-			columns.push("commit_sha");
-			placeholders.push(`$${7 + extras.length}`);
-			extras.push(opts.commitSha);
-		}
-		const extraColumns = columns.length > 0 ? `, ${columns.join(", ")}` : "";
-		const extraPlaceholders = placeholders.length > 0 ? `, ${placeholders.join(", ")}` : "";
-		const sql = `INSERT INTO workflow_registrations
-      (routing_key, repo_identifier, workflow_name, lock_entry, trigger_types, customer_id${opts.id ? ", id" : ""}${extraColumns})
-      VALUES ($1, $2, $3, $4, $5, $6${opts.id ? `, ${idClause}` : ""}${extraPlaceholders})
-      ON CONFLICT (routing_key, repo_identifier, workflow_name) DO UPDATE SET
-        lock_entry = EXCLUDED.lock_entry,
-        trigger_types = EXCLUDED.trigger_types,
-        customer_id = EXCLUDED.customer_id
-      RETURNING id`;
-		return { id: (await pool.query(sql, [
-			opts.routingKey,
-			opts.repoIdentifier,
-			opts.workflowName,
-			JSON.stringify(opts.lockEntry),
-			opts.triggerTypes,
-			opts.customerId,
-			...extras
-		])).rows[0].id };
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* INSERT with a STRICT shape (no ON CONFLICT). Used by registration-schema
-* e2e to prove the unique constraint rejects duplicates. Throws the raw
-* DB error (caller matches /unique/i).
-*/
-async function insertWorkflowRegistrationStrictDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		return { id: (await pool.query(`INSERT INTO workflow_registrations
-         (routing_key, repo_identifier, workflow_name, lock_entry, trigger_types, customer_id)
-       VALUES ($1, $2, $3, $4::jsonb, $5, $6)
-       RETURNING id`, [
-			opts.routingKey,
-			opts.repoIdentifier,
-			opts.workflowName,
-			opts.lockEntryJson ?? "{}",
-			opts.triggerTypes,
-			opts.customerId
-		])).rows[0]?.id ?? null };
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* READ-ONLY: latest registry_versions.version, or null if the default
-* row is missing. Used by registration-admin-api e2e to bracket a
-* refresh call.
-*/
-async function getRegistryVersionDirect(databaseUrl, opts = {}) {
-	const pool = createPool(databaseUrl);
-	try {
-		return (await pool.query(`SELECT version FROM registry_versions WHERE id = $1`, [opts.id ?? "default"])).rows[0]?.version ?? null;
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* UPDATE `registry_versions.version = version + 1` WHERE id (default).
-* Simpler than `bumpRegistryVersionDirect` — used by global-workflow
-* e2e which wants the side-effect (force index refresh) without the
-* return value.
-*/
-async function bumpRegistryVersionSimpleDirect(databaseUrl, opts = {}) {
-	const pool = createPool(databaseUrl);
-	try {
-		await pool.query(`UPDATE registry_versions SET version = version + 1 WHERE id = $1`, [opts.id ?? "default"]);
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Seed cron_last_fired for a registration with an `-INTERVAL` offset so
-* the scheduler fires on the next evaluation. Upsert via ON CONFLICT.
-*/
-async function upsertCronLastFiredDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		await pool.query(`INSERT INTO cron_last_fired (registration_id, schedule_key, last_fired_at)
-         VALUES ($1, $3, NOW() - ($2)::interval)
-         ON CONFLICT (registration_id, schedule_key) DO UPDATE SET
-           last_fired_at = NOW() - ($2)::interval,
-           updated_at = NOW()`, [
-			opts.registrationId,
-			opts.agoInterval,
-			opts.scheduleKey
-		]);
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* READ-ONLY: count cron_last_fired rows for a registration. Used by
-* registration-schema e2e to assert the FK cascade deletes the row.
-*/
-async function countCronLastFiredDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		return (await pool.query(`SELECT COUNT(*)::int AS cnt FROM cron_last_fired WHERE registration_id = $1`, [opts.registrationId])).rows[0]?.cnt ?? 0;
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* INSERT a cron_last_fired row with an explicit timestamp. Used by
-* registration-schema e2e to set up the FK cascade test.
-*/
-async function insertCronLastFiredNowDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		await pool.query(`INSERT INTO cron_last_fired (registration_id, schedule_key, last_fired_at) VALUES ($1, $2, NOW())`, [opts.registrationId, opts.scheduleKey]);
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* DELETE cron_last_fired rows for a registration. Teardown helper.
-*/
-async function deleteCronLastFiredDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		await pool.query(`DELETE FROM cron_last_fired WHERE registration_id = $1`, [opts.registrationId]);
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* DELETE execution_runs by workflow_name. Teardown helper for
-* manual-schedule e2e.
-*/
-async function deleteExecutionRunsByWorkflowNameDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		return { deleted: (await pool.query(`DELETE FROM execution_runs WHERE workflow_name = $1`, [opts.workflowName])).rowCount ?? 0 };
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* READ-ONLY: SELECT generic_webhook_sources by routing_key.
-* Used by forgejo e2e to assert the source exists with correct git_config.
-*/
-async function getGenericWebhookSourceByRoutingKeyDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		return (await pool.query(`SELECT id, git_config, customer_id FROM generic_webhook_sources WHERE routing_key = $1`, [opts.routingKey])).rows[0] ?? null;
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* READ-ONLY: list active (enabled=true) generic_webhook_sources.
-* Used by cluster-leader-failover e2e to prove the seeded source exists
-* before a leader crash.
-*/
-async function listActiveGenericWebhookSourcesDirect(databaseUrl) {
-	const pool = createPool(databaseUrl);
-	try {
-		return (await pool.query(`SELECT id, customer_id, routing_key FROM generic_webhook_sources WHERE enabled = true`)).rows;
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* UPDATE generic_webhook_sources.verification_config for a source by
-* name + customer_id. Used by the generic-webhook-auth e2e which seeds
-* sources and then writes custom auth configs.
-*/
-async function updateGenericWebhookVerificationConfigDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		await pool.query(`UPDATE generic_webhook_sources
-         SET verification_config = $1
-        WHERE name = $2 AND customer_id = $3`, [
-			JSON.stringify(opts.verificationConfig),
-			opts.name,
-			opts.customerId
-		]);
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* DELETE generic_webhook_sources by name list. Teardown for the auth
-* e2e, which seeded 3 sources by name.
-*/
-async function deleteGenericWebhookSourcesByNameDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		return { deleted: (await pool.query(`DELETE FROM generic_webhook_sources WHERE name = ANY($1::text[])`, [opts.names])).rowCount ?? 0 };
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* UPDATE generic_webhook_sources.deleted_at = NULL for a row by id.
-* Used by the generic-webhook e2e to restore a soft-deleted source
-* after the soft-delete test ran — there is no CLI-level undelete.
-*/
-async function restoreSoftDeletedGenericWebhookSourceDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		await pool.query(`UPDATE generic_webhook_sources SET deleted_at = NULL WHERE id = $1`, [opts.id]);
-	} finally {
-		await pool.end();
-	}
-}
-async function upsertOrgSettingsGlobalWorkflowsDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		await pool.query(`INSERT INTO org_settings (
-         customer_id,
-         global_workflow_allowed_repos,
-         global_workflow_denied_repos,
-         global_workflow_elevated_repos
-       ) VALUES ($1, $2::jsonb, $3::jsonb, $4::jsonb)
-       ON CONFLICT (customer_id) DO UPDATE SET
-         global_workflow_allowed_repos = EXCLUDED.global_workflow_allowed_repos,
-         global_workflow_denied_repos = EXCLUDED.global_workflow_denied_repos,
-         global_workflow_elevated_repos = EXCLUDED.global_workflow_elevated_repos,
-         updated_at = NOW()`, [
-			opts.customerId,
-			opts.allowedRepos == null ? null : JSON.stringify(opts.allowedRepos),
-			opts.deniedRepos == null ? null : JSON.stringify(opts.deniedRepos),
-			opts.elevatedRepos == null ? null : JSON.stringify(opts.elevatedRepos)
-		]);
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Set (or clear) the fleet-wide global-workflows master switch directly.
-*
-* Direct-DB by design, matching every other `*Direct` helper here: these exist
-* for E2E seeding, which must set the switch BEFORE an orchestrator is up and
-* therefore cannot go through the admin HTTP API. Operators use
-* `kici-admin cluster-settings set --global-workflows-enabled <bool>`.
-*
-* Passing `null` clears the override, so the orchestrator's configured default
-* applies. Upserts the singleton `id='default'` row, so it works against a
-* fresh database with no cluster_settings row at all.
-*
-* `cluster_settings.version` is left untouched: seeding happens before any
-* worker reads the row, so there is nothing to invalidate yet — the operator
-* PATCH path (admin-cluster-settings.ts) owns the version bump for live changes.
-*/
-async function setClusterGlobalWorkflowsEnabledDirect(databaseUrl, enabled) {
-	const pool = createPool(databaseUrl);
-	try {
-		await pool.query(`INSERT INTO cluster_settings (id, global_workflows_enabled)
-       VALUES ('default', $1)
-       ON CONFLICT (id) DO UPDATE SET
-         global_workflows_enabled = EXCLUDED.global_workflows_enabled`, [enabled]);
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* UPDATE org_settings.global_workflow_denied_repos for a customer/org id.
-* Assumes the row exists (upsertOrgSettingsGlobalWorkflowsDirect was
-* called earlier in the test).
-*/
-async function updateOrgSettingsDeniedReposDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		await pool.query(`UPDATE org_settings
-         SET global_workflow_denied_repos = $2::jsonb,
-             updated_at = NOW()
-        WHERE customer_id = $1`, [opts.customerId, opts.deniedRepos == null ? null : JSON.stringify(opts.deniedRepos)]);
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* DELETE org_settings by customer/org id. Teardown helper.
-*/
-async function deleteOrgSettingsByCustomerIdDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		return { deleted: (await pool.query(`DELETE FROM org_settings WHERE customer_id = $1`, [opts.customerId])).rowCount ?? 0 };
-	} finally {
-		await pool.end();
-	}
-}
-async function getExecutionRunSecurityDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		const result = await pool.query(`SELECT run_id, trust_tier, lock_file_source, contributor_username, status
-         FROM execution_runs WHERE run_id = $1`, [opts.runId]);
-		if (result.rows.length === 0) throw new Error(`execution_runs: row not found (run_id=${opts.runId})`);
-		return result.rows[0];
-	} finally {
-		await pool.end();
-	}
-}
-async function getHeldRunByIdDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		return (await pool.query(`SELECT id, run_id, hold_type, queue_type, status, reason,
-              expires_at, approved_by, resolved_at
-         FROM held_runs WHERE id = $1`, [opts.id])).rows[0] ?? null;
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* READ-ONLY: list the recorded approver decisions for a held run, newest
-* first. Approver attribution lives in `held_run_approvals` (one row per
-* decision), not on the `held_runs` row — used by ci-security e2e to prove
-* an approval was stamped with the approving user's sub.
-*/
-async function listHeldRunApprovalsDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		return (await pool.query(`SELECT id, held_run_id, approver_user_id, decision, created_at
-         FROM held_run_approvals WHERE held_run_id = $1
-         ORDER BY created_at DESC`, [opts.heldRunId])).rows;
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* READ-ONLY: count held_runs rows matching run_id + queue_type.
-* Used by ci-security e2e to prove no security hold exists for a
-* trusted contributor PR.
-*/
-async function countHeldRunsByRunIdDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		return (opts.queueType ? await pool.query(`SELECT COUNT(*)::int AS cnt FROM held_runs WHERE run_id = $1 AND queue_type = $2`, [opts.runId, opts.queueType]) : await pool.query(`SELECT COUNT(*)::int AS cnt FROM held_runs WHERE run_id = $1`, [opts.runId])).rows[0]?.cnt ?? 0;
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Wait for Platform-side `execution_runs.status = <status>` where
-* `created_at > since`. Returns the final status + failure_reason or
-* null if the timeout elapsed. Used by webhook-pipeline (failed) and
-* orchestrator-never-reconnects (timed_out_stale).
-*/
-async function waitForPlatformExecutionRunStatusDirect(databaseUrl, opts) {
-	const timeoutMs = opts.timeoutMs ?? 3e4;
-	const intervalMs = opts.intervalMs ?? 2e3;
-	const deadline = Date.now() + timeoutMs;
-	const pool = createPool(databaseUrl);
-	try {
-		while (Date.now() < deadline) {
-			const result = await pool.query(`SELECT status, failure_reason FROM execution_runs
-          WHERE created_at > $1 AND status = $2
-          ORDER BY created_at DESC LIMIT 1`, [opts.since, opts.status]);
-			if (result.rows.length > 0) return result.rows[0];
-			await new Promise((r) => setTimeout(r, intervalMs));
-		}
-		return null;
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Wait for Platform `event_log` to show at least `minDistinctRouted`
-* distinct `routed_to` values since a given timestamp. Used by
-* cluster-round-robin to prove at least 2 orchestrators received
-* deliveries. Returns the observed count (0 if timed out).
-*/
-async function waitForPlatformEventLogDistinctRoutedDirect(databaseUrl, opts) {
-	const timeoutMs = opts.timeoutMs ?? 6e4;
-	const intervalMs = opts.intervalMs ?? 3e3;
-	const deadline = Date.now() + timeoutMs;
-	const pool = createPool(databaseUrl);
-	try {
-		let distinct = 0;
-		while (Date.now() < deadline) {
-			distinct = (await pool.query(`SELECT COUNT(DISTINCT routed_to)::int AS cnt FROM event_log WHERE received_at > $1`, [opts.since])).rows[0]?.cnt ?? 0;
-			if (distinct >= opts.minDistinctRouted) return { distinctRouted: distinct };
-			await new Promise((r) => setTimeout(r, intervalMs));
-		}
-		return { distinctRouted: distinct };
-	} finally {
-		await pool.end();
-	}
-}
-async function waitForEventLogRowByDeliveryIdDirect(databaseUrl, opts) {
-	const timeoutMs = opts.timeoutMs ?? 1e4;
-	const intervalMs = opts.intervalMs ?? 200;
-	const deadline = Date.now() + timeoutMs;
-	const pool = createPool(databaseUrl);
-	try {
-		while (Date.now() < deadline) {
-			const res = await pool.query(`SELECT org_id, delivery_id, status, source, event, provider, payload_hash,
-                payload_omitted, payload_key, payload_size_bytes, matched_count, run_id
-           FROM event_log WHERE delivery_id = $1`, [opts.deliveryId]);
-			if (res.rowCount && res.rowCount > 0) return res.rows[0];
-			await new Promise((r) => setTimeout(r, intervalMs));
-		}
-		return null;
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Resolve a Platform `webhook_sources.routing_key` for an org.
-*
-* - With `routingKeyLikePrefix` only: returns the newest match. Note that
-*   this picks whichever generic source was registered most recently — if
-*   tests have created additional generic sources (e.g. universal-git-forgejo
-*   creating `stg-universal-git-forgejo`), the newest may NOT be the
-*   `stg-generic` default seeded by `pnpm deploy:stg`.
-* - With `orchDbUrl` + `nameInOrchDb`: looks up the source by name in the
-*   orchestrator's `generic_webhook_sources` table, then verifies the
-*   resulting routing key is registered in Platform's `webhook_sources`.
-*   This is the disambiguating path Bucket-B tests should use when other
-*   generic sources may exist alongside the default.
-*/
-async function resolvePlatformWebhookSourceRoutingKeyDirect(platformDbUrl, opts) {
-	if (opts.orchDbUrl && opts.nameInOrchDb) {
-		const orchPool = createPool(opts.orchDbUrl);
-		let candidateRoutingKey = null;
-		try {
-			const id = (await orchPool.query(`SELECT id FROM generic_webhook_sources
-          WHERE customer_id = $1 AND name = $2 AND deleted_at IS NULL
-          LIMIT 1`, [opts.orgId, opts.nameInOrchDb])).rows[0]?.id;
-			if (!id) return null;
-			candidateRoutingKey = `generic:${opts.orgId}:${id}`;
-		} finally {
-			await orchPool.end();
-		}
-		const platformPool = createPool(platformDbUrl);
-		try {
-			return (await platformPool.query(`SELECT routing_key FROM webhook_sources
-          WHERE org_id = $1 AND routing_key = $2 LIMIT 1`, [opts.orgId, candidateRoutingKey])).rows[0]?.routing_key ?? null;
-		} finally {
-			await platformPool.end();
-		}
-	}
-	const pool = createPool(platformDbUrl);
-	try {
-		return (await pool.query(`SELECT routing_key FROM webhook_sources
-        WHERE org_id = $1 AND routing_key LIKE $2
-        ORDER BY registered_at DESC LIMIT 1`, [opts.orgId, `${opts.routingKeyLikePrefix}%`])).rows[0]?.routing_key ?? null;
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Idempotent seeding of an E2E regular user + org membership + owner
-* role on the Platform DB. Used by stg-ha-smoke before seeding a user
-* API key. Requires the org to already have an owner role.
-*/
-async function ensureOrgOwnerMemberDirect(platformDbUrl, opts) {
-	const pool = createPool(platformDbUrl);
-	try {
-		const ownerRole = await pool.query(`SELECT id FROM roles WHERE org_id = $1 AND is_owner = true LIMIT 1`, [opts.orgId]);
-		if (ownerRole.rows.length === 0) throw new Error(`ensureOrgOwnerMemberDirect: no owner role found for org ${opts.orgId}`);
-		const ownerRoleId = ownerRole.rows[0].id;
-		await pool.query(`INSERT INTO users (idp_sub, email, display_name)
-         VALUES ($1, $2, $3)
-         ON CONFLICT (idp_sub) DO NOTHING`, [
-			opts.idpSub,
-			opts.email,
-			opts.displayName
-		]);
-		await pool.query(`INSERT INTO org_members (org_id, user_id) VALUES ($1, $2) ON CONFLICT DO NOTHING`, [opts.orgId, opts.idpSub]);
-		await pool.query(`INSERT INTO role_assignments (org_id, user_id, role_id, assigned_by)
-         VALUES ($1, $2, $3, $2)
-         ON CONFLICT (org_id, user_id, role_id) DO NOTHING`, [
-			opts.orgId,
-			opts.idpSub,
-			ownerRoleId
-		]);
-		return { ownerRoleId };
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Cleanup peer_credentials by instance_id LIKE pattern. Used by the
-* cluster-peer-credentials e2e before/after each test to wipe its
-* own seeded rows without touching real cluster credentials.
-*/
-async function deletePeerCredentialsByInstanceIdLikeDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		return { deleted: (await pool.query(`DELETE FROM peer_credentials WHERE instance_id LIKE $1`, [opts.pattern])).rowCount ?? 0 };
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Insert a peer_credentials row with an explicit expires_at. Used by
-* the "expired credential is not returned" e2e — the store's save()
-* always computes a future expiry, so tests that need a pre-expired
-* row must bypass it.
-*/
-async function insertPeerCredentialExpiredDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		await pool.query(`INSERT INTO peer_credentials (instance_id, credential_hash, role, routing_keys, expires_at)
-       VALUES ($1, $2, $3, $4::text[], $5)`, [
-			opts.instanceId,
-			opts.credentialHash,
-			opts.role,
-			Array.from(opts.routingKeys),
-			opts.expiresAt
-		]);
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* READ-ONLY: `revoked_at` for a peer_credentials row by hash. Used
-* by the "save revokes old credential" e2e to assert revocation.
-* Returns null when the row is missing entirely (distinct from
-* "present but not revoked").
-*/
-async function getPeerCredentialRevokedAtDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		const result = await pool.query(`SELECT revoked_at FROM peer_credentials WHERE credential_hash = $1`, [opts.credentialHash]);
-		if (result.rows.length === 0) return {
-			present: false,
-			revokedAt: null
-		};
-		return {
-			present: true,
-			revokedAt: result.rows[0].revoked_at
-		};
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* READ-ONLY: list active peer_credentials ids EXCLUDING a
-* `instance_id LIKE` pattern. Used by revokeAll e2e to snapshot
-* real cluster credentials it will restore later.
-*/
-async function listActivePeerCredentialsExcludingDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		return { ids: (await pool.query(`SELECT id FROM peer_credentials
-        WHERE revoked_at IS NULL AND instance_id NOT LIKE $1`, [opts.excludeInstanceIdPattern])).rows.map((r) => r.id) };
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Clear revoked_at on a set of peer_credentials ids. Used by revokeAll
-* e2e to restore real cluster credentials after the destructive test.
-*/
-async function clearPeerCredentialsRevokedAtByIdsDirect(databaseUrl, opts) {
-	if (opts.ids.length === 0) return { updated: 0 };
-	const pool = createPool(databaseUrl);
-	try {
-		return { updated: (await pool.query(`UPDATE peer_credentials SET revoked_at = NULL WHERE id = ANY($1::uuid[])`, [opts.ids])).rowCount ?? 0 };
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* READ-ONLY: count currently-active (non-revoked, non-expired)
-* peer_credentials rows for a given instance_id. Used by the
-* concurrent-save e2e to assert 1 <= count <= 2.
-*/
-async function countActivePeerCredentialsByInstanceDirect(databaseUrl, opts) {
-	const pool = createPool(databaseUrl);
-	try {
-		return (await pool.query(`SELECT count(*)::int AS cnt FROM peer_credentials
-        WHERE instance_id = $1 AND revoked_at IS NULL AND expires_at > now()`, [opts.instanceId])).rows[0]?.cnt ?? 0;
-	} finally {
-		await pool.end();
-	}
-}
-/**
-* Terminate every idle backend of the connecting user except our own
-* connection. Mirrors what a Postgres leader demotion does to idle pooled
-* connections — used by resilience tests to verify the pg pool error
-* handlers absorb the termination without a process restart.
-*
-* Returns the number of backends terminated.
-*/
-async function terminateIdleDbBackendsDirect(databaseUrl) {
-	const pool = createPool(databaseUrl);
-	try {
-		return (await pool.query(`SELECT pg_terminate_backend(pid)
-       FROM pg_stat_activity
-       WHERE pid <> pg_backend_pid()
-         AND usename = current_user
-         AND state = 'idle'`)).rowCount ?? 0;
-	} finally {
-		await pool.end();
-	}
-}
 //#endregion
-export { CI_SECURITY_OTHER_REPO, MIGRATION_HASH_TABLE, PROVIDER_HASH_KEY, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, clearScalerStateDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createContextTemplateDirect, createDbRole, createJoinTokenDirect, createReadOnlyDbUser, deleteContextDirect, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCheckRunTrackingDirect, listContextsDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedContextBindingDirect, seedContextDirect, seedCrossRepoTrustDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setClusterGlobalWorkflowsEnabledDirect, setContextPolicyDirect, setContextSecretDirect, showContextDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunReachesStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };
+export { MIGRATION_HASH_TABLE, PROVIDER_HASH_KEY, REGISTERABLE_TRIGGER_TYPES, clearDispatchQueueDirect, computeMigrationsHash, createContextTemplateDirect, createDbRole, createReadOnlyDbUser, deleteContextDirect, dropAndCreateDatabase, emitKiciEventDirect, ensureDatabase, isSchemaCurrent, listCheckRunTrackingDirect, listContextsDirect, listExecutionRunsDirect, listQueueDirect, listRegistrationsDirect, maskDatabaseUrl, parseDatabaseUrl, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, seedContextBindingDirect, seedContextDirect, setContextPolicyDirect, setContextSecretDirect, showContextDirect, showExecutionRunDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash };
 
 //# sourceMappingURL=db-admin.js.map