@bugmole/cli 0.4.0

package/src/mcp/write-test-cases.test.ts

@@ -0,0 +1,287 @@
+import assert from "node:assert/strict";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { callToolInternal } from "./server.js";
+
+async function setup() {
+  const directory = await fs.mkdtemp(path.join(os.tmpdir(), "bugmole-test-cases-"));
+  const specDir = path.join(directory, "spec");
+  await fs.mkdir(specDir, { recursive: true });
+  // A real journey graph is the grounding these assumptions get checked against.
+  await fs.writeFile(
+    path.join(specDir, "journeys.graph.json"),
+    JSON.stringify({
+      version: 2,
+      projectId: "demo",
+      nodes: [
+        { id: "screen:/", title: "Home", kind: "screen", route: "/" },
+        { id: "screen:/login", title: "Login", kind: "screen", route: "/login" },
+      ],
+      edges: [{ id: "screen:/->screen:/login:1", from: "screen:/", to: "screen:/login" }],
+      journeys: [{
+        id: "flow:login",
+        name: "Login",
+        actor: "user",
+        nodeIds: ["screen:/", "screen:/login"],
+        edgeIds: ["screen:/->screen:/login:1"],
+        revision: 2,
+        status: "draft",
+      }],
+    }),
+  );
+  const cfg = {
+    project: { id: "demo" },
+    runtime: { spec_dir: specDir, artifacts_dir: directory },
+    storage: { provider: "local", localDirectory: directory },
+  };
+  return { directory, cfg };
+}
+
+const validCase = {
+  caseId: "TC-001",
+  title: "Login link reaches the login screen",
+  nodeId: "screen:/login",
+  edgeId: "screen:/->screen:/login:1",
+  intent: "Prove the home page can reach login",
+  steps: ["Open /", "Click the login link"],
+  expected: ["The /login screen renders"],
+  confidence: "medium",
+  basis: ["src/app/page.tsx has a link to /login"],
+};
+
+test("writes a grounded case set and reports where it landed", async () => {
+  const { directory, cfg } = await setup();
+  try {
+    const result = await callToolInternal("bugmole_write_test_cases", {
+      caseSet: {
+        schemaVersion: 1,
+        caseSetId: "flow-login",
+        journeyId: "flow:login",
+        journeyRevision: 2,
+        cases: [validCase],
+      },
+    }, cfg);
+    assert.equal(result.status, "success");
+    assert.equal(result.caseCount, 1);
+    const written = JSON.parse(
+      await fs.readFile(path.join(directory, "projects", "demo", "test-cases", "flow-login.json"), "utf8"),
+    );
+    assert.equal(written.cases[0].caseId, "TC-001");
+    assert.equal(written.projectId, "demo");
+  } finally {
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("refuses a case pinned to a step that is not in the journey", async () => {
+  const { directory, cfg } = await setup();
+  try {
+    await assert.rejects(
+      callToolInternal("bugmole_write_test_cases", {
+        caseSet: {
+          schemaVersion: 1,
+          caseSetId: "bad-node",
+          journeyId: "flow:login",
+          journeyRevision: 2,
+          cases: [{ ...validCase, nodeId: "screen:/does-not-exist", edgeId: undefined }],
+        },
+      }, cfg),
+      /is not a step of journey/,
+    );
+  } finally {
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("refuses a stale journey revision rather than attaching cases to the wrong version", async () => {
+  const { directory, cfg } = await setup();
+  try {
+    await assert.rejects(
+      callToolInternal("bugmole_write_test_cases", {
+        caseSet: {
+          schemaVersion: 1,
+          caseSetId: "stale",
+          journeyId: "flow:login",
+          journeyRevision: 1,
+          cases: [validCase],
+        },
+      }, cfg),
+      /journeyRevision must match/,
+    );
+  } finally {
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("a case with no basis cannot claim more than low confidence", async () => {
+  const { directory, cfg } = await setup();
+  try {
+    await assert.rejects(
+      callToolInternal("bugmole_write_test_cases", {
+        caseSet: {
+          schemaVersion: 1,
+          caseSetId: "unfounded",
+          journeyId: "flow:login",
+          journeyRevision: 2,
+          cases: [{ ...validCase, basis: [], confidence: "high" }],
+        },
+      }, cfg),
+      /must be confidence "low"/,
+    );
+  } finally {
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("an honest low-confidence guess is allowed through, so gaps stay visible", async () => {
+  const { directory, cfg } = await setup();
+  try {
+    const result = await callToolInternal("bugmole_write_test_cases", {
+      caseSet: {
+        schemaVersion: 1,
+        caseSetId: "guess",
+        journeyId: "flow:login",
+        journeyRevision: 2,
+        cases: [{ ...validCase, basis: [], confidence: "low" }],
+      },
+    }, cfg);
+    assert.equal(result.status, "success");
+  } finally {
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("rejects duplicate case ids within one set", async () => {
+  const { directory, cfg } = await setup();
+  try {
+    await assert.rejects(
+      callToolInternal("bugmole_write_test_cases", {
+        caseSet: {
+          schemaVersion: 1,
+          caseSetId: "dupes",
+          journeyId: "flow:login",
+          journeyRevision: 2,
+          cases: [validCase, { ...validCase, title: "Another" }],
+        },
+      }, cfg),
+      /duplicate caseId/,
+    );
+  } finally {
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+async function withCaseSet(cfg: any) {
+  await callToolInternal("bugmole_write_test_cases", {
+    caseSet: {
+      schemaVersion: 1,
+      caseSetId: "flow-login",
+      journeyId: "flow:login",
+      journeyRevision: 2,
+      cases: [validCase],
+    },
+  }, cfg);
+}
+
+test("records a run's verdict against a case set that exists", async () => {
+  const { directory, cfg } = await setup();
+  try {
+    await withCaseSet(cfg);
+    const result = await callToolInternal("bugmole_write_test_case_results", {
+      resultSet: {
+        schemaVersion: 1,
+        caseSetId: "flow-login",
+        results: [{ caseId: "TC-001", status: "passed", detail: "200 with the login form present" }],
+      },
+    }, cfg);
+    assert.equal(result.status, "success");
+    assert.deepEqual(result.counts, { passed: 1 });
+    const written = JSON.parse(
+      await fs.readFile(path.join(directory, "projects", "demo", "test-case-results", "flow-login.json"), "utf8"),
+    );
+    assert.equal(written.results[0].status, "passed");
+    // Stamped from the case set, so a verdict always says which revision it judged.
+    assert.equal(written.journeyRevision, 2);
+    assert.equal(written.journeyId, "flow:login");
+  } finally {
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("refuses a verdict for a case nobody ever wrote", async () => {
+  const { directory, cfg } = await setup();
+  try {
+    await withCaseSet(cfg);
+    await assert.rejects(
+      callToolInternal("bugmole_write_test_case_results", {
+        resultSet: {
+          schemaVersion: 1,
+          caseSetId: "flow-login",
+          results: [{ caseId: "TC-INVENTED", status: "passed", detail: "looked fine" }],
+        },
+      }, cfg),
+      /is not a case of flow-login/,
+    );
+  } finally {
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("refuses results for a case set that does not exist yet", async () => {
+  const { directory, cfg } = await setup();
+  try {
+    await assert.rejects(
+      callToolInternal("bugmole_write_test_case_results", {
+        resultSet: {
+          schemaVersion: 1,
+          caseSetId: "flow-login",
+          results: [{ caseId: "TC-001", status: "passed", detail: "fine" }],
+        },
+      }, cfg),
+      /No test cases found/,
+    );
+  } finally {
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("refuses a pass with no detail, which is the shape of a fabricated result", async () => {
+  const { directory, cfg } = await setup();
+  try {
+    await withCaseSet(cfg);
+    await assert.rejects(
+      callToolInternal("bugmole_write_test_case_results", {
+        resultSet: {
+          schemaVersion: 1,
+          caseSetId: "flow-login",
+          results: [{ caseId: "TC-001", status: "passed" }],
+        },
+      }, cfg),
+      /detail is required/,
+    );
+  } finally {
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("refuses verdicts recorded against a stale journey revision", async () => {
+  const { directory, cfg } = await setup();
+  try {
+    await withCaseSet(cfg);
+    await assert.rejects(
+      callToolInternal("bugmole_write_test_case_results", {
+        resultSet: {
+          schemaVersion: 1,
+          caseSetId: "flow-login",
+          journeyRevision: 1,
+          results: [{ caseId: "TC-001", status: "passed", detail: "observed" }],
+        },
+      }, cfg),
+      /does not match the case set revision/,
+    );
+  } finally {
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});

package/src/registry/api-key-client.ts

@@ -0,0 +1,39 @@
+export type CreateApiKeyOptions = {
+  registryUrl: string;
+  aegisId?: string;
+  apiKey?: string;
+  aegisSecret?: string;
+  name: string;
+  scopes?: string[];
+  projectIds?: string[];
+  expiresAt?: string;
+};
+
+export async function createRemoteApiKey(options: CreateApiKeyOptions): Promise<{
+  id: string;
+  token: string;
+  expiresAt: string | null;
+}> {
+  const response = await fetch(`${options.registryUrl.replace(/\/$/, "")}/api/api-keys`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      ...(options.apiKey
+        ? { authorization: `Bearer ${options.apiKey}` }
+        : {
+            "x-aegis-id": options.aegisId ?? "",
+            ...(options.aegisSecret ? { "x-aegis-secret": options.aegisSecret } : {}),
+          }),
+    },
+    body: JSON.stringify({
+      name: options.name,
+      scopes: options.scopes,
+      projectIds: options.projectIds,
+      expiresAt: options.expiresAt,
+    }),
+  });
+  if (!response.ok) {
+    throw new Error(`Bugmole registry rejected API key creation (${response.status})`);
+  }
+  return response.json() as Promise<{ id: string; token: string; expiresAt: string | null }>;
+}

package/src/registry/control-plane-client.ts

@@ -0,0 +1,212 @@
+import WebSocket from "ws";
+
+export type RegistryRun = {
+  id: string;
+  projectId: string;
+  planId: string;
+  journeyId?: string;
+  status: string;
+  driver?: string;
+  platform?: string;
+  recoveryAttempts?: number;
+  failureCode?: string;
+  artifactSummaryJson?: string;
+  environmentId?: string | null;
+  /** The environment's base URL, snapshotted when the run was requested. */
+  environmentBaseUrl?: string | null;
+  /** Requested browser/device matrix. */
+  targets?: Array<{ browser: string; device?: string }> | null;
+  targetResults?: Array<Record<string, unknown>> | null;
+  /** Re-run with the fix suggested by this earlier run/target. */
+  fixFrom?: { runId: string; targetId: string; mode?: "suggested" | "ai" } | null;
+  durationMs?: number | null;
+  /** "cloud" runs belong to Bugmole's hosted runners; a customer's worker skips them. */
+  executionMode?: "self" | "cloud";
+};
+
+export type RegistryTask = {
+  id: string;
+  projectId: string;
+  title: string;
+  description: string;
+  taskType: "code" | "ui" | "investigation" | "discovery";
+  priority: number;
+  status: string;
+  workerId?: string;
+  progressMessage?: string;
+  parityMatchScore?: number;
+  parityAuditId?: string;
+  journeyId?: string;
+  journeyRevision?: number;
+  stepId?: string;
+  idempotencyKey?: string;
+  attempts?: number;
+  nextAttemptAt?: string | null;
+  leaseExpiresAt?: string | null;
+  /** "cloud" discovery belongs to Bugmole's hosted runners; a customer's worker skips it. */
+  executionMode?: "self" | "cloud";
+};
+
+export { MAX_TASK_ATTEMPTS, backoffUntil, isClaimableTask } from "./task-scheduling.js";
+
+export type ControlPlaneClientOptions = {
+  registryUrl: string;
+  apiKey: string;
+  projectId: string;
+  workspaceId?: string;
+};
+
+/** Carries the HTTP status, so callers can tell a lost claim (409) from a real failure. */
+export class RegistryRequestError extends Error {
+  constructor(readonly status: number) {
+    super(`Registry request failed (${status})`);
+    this.name = "RegistryRequestError";
+  }
+}
+
+export class ControlPlaneClient {
+  private readonly baseUrl: string;
+
+  constructor(private readonly options: ControlPlaneClientOptions) {
+    this.baseUrl = options.registryUrl.replace(/\/$/, "");
+  }
+
+  private async request<T>(path: string, init: RequestInit = {}): Promise<T> {
+    const response = await fetch(`${this.baseUrl}${path}`, {
+      ...init,
+      headers: {
+        authorization: `Bearer ${this.options.apiKey}`,
+        "content-type": "application/json",
+        ...(init.headers ?? {}),
+      },
+    });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok) throw new RegistryRequestError(response.status);
+    return body as T;
+  }
+
+  async publishPlan(input: { planId: string; journeyId: string; objectKey: string }) {
+    return this.request<{ plan: unknown }>(`/api/projects/${encodeURIComponent(this.options.projectId)}/plans`, {
+      method: "POST",
+      body: JSON.stringify(input),
+    });
+  }
+
+  async listRuns(): Promise<{ runs: RegistryRun[] }> {
+    return this.request(`/api/projects/${encodeURIComponent(this.options.projectId)}/runs`);
+  }
+
+  async createRun(input: {
+    planId: string;
+    idempotencyKey: string;
+    journeyRevision?: number;
+    environmentId?: string;
+    driver?: string;
+    platform?: string;
+    targets?: Array<{ browser: string; device?: string }>;
+  }): Promise<{ run: RegistryRun }> {
+    return this.request(`/api/projects/${encodeURIComponent(this.options.projectId)}/runs`, {
+      method: "POST",
+      body: JSON.stringify(input),
+    });
+  }
+
+  async listPlans(): Promise<{ plans: Array<{ planId: string; journeyId?: string; status?: string }> }> {
+    return this.request(`/api/projects/${encodeURIComponent(this.options.projectId)}/plans`);
+  }
+
+  async claimRun(runId: string, workerId: string) {
+    return this.request(`/api/runs/${encodeURIComponent(runId)}/claim`, {
+      method: "POST",
+      body: JSON.stringify({ workerId }),
+    });
+  }
+
+  async updateRun(runId: string, update: Record<string, unknown>) {
+    return this.request(`/api/runs/${encodeURIComponent(runId)}`, {
+      method: "POST",
+      body: JSON.stringify(update),
+    });
+  }
+
+  async listTasks(): Promise<{ tasks: RegistryTask[] }> {
+    return this.request(`/api/projects/${encodeURIComponent(this.options.projectId)}/tasks`);
+  }
+
+  async createTask(input: {
+    title: string;
+    description: string;
+    taskType?: "code" | "ui" | "investigation" | "discovery";
+    priority?: number;
+    idempotencyKey: string;
+    journeyId?: string;
+    journeyRevision?: number;
+  }) {
+    return this.request<{ task: RegistryTask }>(
+      `/api/projects/${encodeURIComponent(this.options.projectId)}/tasks`,
+      { method: "POST", body: JSON.stringify(input) },
+    );
+  }
+
+  async claimTask(taskId: string, workerId: string): Promise<{ claimed: boolean; task: RegistryTask }> {
+    return this.request(`/api/tasks/${encodeURIComponent(taskId)}/claim`, {
+      method: "POST",
+      body: JSON.stringify({ workerId }),
+    });
+  }
+
+  async updateTask(taskId: string, update: Record<string, unknown>) {
+    return this.request<{ updated: boolean; task: RegistryTask }>(`/api/tasks/${encodeURIComponent(taskId)}`, {
+      method: "POST",
+      body: JSON.stringify(update),
+    });
+  }
+
+  async listJourneyRevisions() {
+    return this.request<{ revisions: Array<Record<string, unknown>> }>(
+      `/api/projects/${encodeURIComponent(this.options.projectId)}/journeys`,
+    );
+  }
+
+  async saveJourneyRevision(input: {
+    journeyId: string;
+    objectKey: string;
+    expectedRevision?: number;
+    appId?: string;
+    environmentId?: string;
+    status?: "draft" | "published";
+    sourceOfTruth?: "canonical_flow";
+    stability?: "discovered" | "stabilizing" | "stable";
+    linkedToGraph?: boolean;
+    verificationRunId?: string;
+  }) {
+    return this.request(`/api/projects/${encodeURIComponent(this.options.projectId)}/journeys`, {
+      method: "POST",
+      body: JSON.stringify(input),
+    });
+  }
+
+  connectWorker(workerId: string, onMessage: (message: Record<string, unknown>) => void): WebSocket {
+    const url = `${this.baseUrl.replace(/^http/, "ws")}/api/ws/projects/${encodeURIComponent(this.options.projectId)}`;
+    const socket = new WebSocket(url, {
+      headers: { authorization: `Bearer ${this.options.apiKey}` },
+    });
+    socket.on("open", () => {
+      socket.send(JSON.stringify({
+        type: "worker_hello",
+        workerId,
+        projectId: this.options.projectId,
+        workspaceId: this.options.workspaceId,
+      }));
+    });
+    socket.on("message", (raw) => {
+      try {
+        const message = JSON.parse(raw.toString()) as Record<string, unknown>;
+        onMessage(message);
+      } catch {
+        // Ignore malformed coordinator messages.
+      }
+    });
+    return socket;
+  }
+}

package/src/registry/migrations/0001_registry.sql

@@ -0,0 +1,47 @@
+CREATE TABLE IF NOT EXISTS aegis_users (
+  id TEXT PRIMARY KEY,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE TABLE IF NOT EXISTS projects (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  environment TEXT NOT NULL,
+  storage_provider TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS project_memberships (
+  project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  aegis_id TEXT NOT NULL REFERENCES aegis_users(id) ON DELETE CASCADE,
+  role TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'active',
+  PRIMARY KEY (project_id, aegis_id)
+);
+
+CREATE TABLE IF NOT EXISTS aegis_claims (
+  token_hash TEXT PRIMARY KEY,
+  temporary_aegis_id TEXT NOT NULL,
+  tenant_id TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  claimed_at TEXT
+);
+
+CREATE TABLE IF NOT EXISTS api_keys (
+  id TEXT PRIMARY KEY,
+  aegis_id TEXT NOT NULL REFERENCES aegis_users(id) ON DELETE CASCADE,
+  name TEXT NOT NULL,
+  token_hash TEXT NOT NULL UNIQUE,
+  scopes_json TEXT NOT NULL,
+  project_ids_json TEXT NOT NULL DEFAULT '[]',
+  expires_at TEXT,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  revoked_at TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_project_memberships_aegis
+  ON project_memberships(aegis_id, status);
+
+CREATE INDEX IF NOT EXISTS idx_api_keys_aegis
+  ON api_keys(aegis_id, revoked_at);

package/src/registry/migrations/0002_device_authorizations.sql

@@ -0,0 +1,23 @@
+CREATE TABLE IF NOT EXISTS device_authorizations (
+  attempt_id TEXT PRIMARY KEY,
+  code_hash TEXT NOT NULL,
+  poll_secret_hash TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  project_name TEXT NOT NULL,
+  environment TEXT NOT NULL,
+  storage_provider TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending',
+  aegis_id TEXT,
+  api_key_id TEXT,
+  encrypted_token TEXT,
+  token_iv TEXT,
+  source_ip TEXT,
+  failed_attempts INTEGER NOT NULL DEFAULT 0,
+  expires_at TEXT NOT NULL,
+  claimed_at TEXT,
+  completed_at TEXT,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX IF NOT EXISTS idx_device_authorizations_expiry
+  ON device_authorizations(status, expires_at);

package/src/registry/migrations/0003_project_environments.sql

@@ -0,0 +1,25 @@
+CREATE TABLE IF NOT EXISTS project_environments (
+  id TEXT NOT NULL,
+  project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  name TEXT NOT NULL,
+  base_url TEXT NOT NULL,
+  api_url TEXT,
+  status TEXT NOT NULL DEFAULT 'active',
+  is_default INTEGER NOT NULL DEFAULT 0,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  PRIMARY KEY (project_id, id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_project_environments_project
+  ON project_environments(project_id, status);
+
+INSERT OR IGNORE INTO project_environments
+  (id, project_id, name, base_url, status, is_default)
+SELECT
+  lower(replace(environment, ' ', '-')),
+  id,
+  environment,
+  '',
+  'active',
+  1
+FROM projects;

package/src/registry/migrations/0004_device_authorization_email.sql

@@ -0,0 +1 @@
+ALTER TABLE device_authorizations ADD COLUMN aegis_email TEXT;

package/src/registry/migrations/0005_testing_control_plane.sql

@@ -0,0 +1,55 @@
+CREATE TABLE IF NOT EXISTS plan_drafts (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  tenant_id TEXT NOT NULL,
+  plan_id TEXT NOT NULL,
+  journey_id TEXT NOT NULL,
+  object_key TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'draft',
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  UNIQUE(project_id, plan_id)
+);
+
+CREATE TABLE IF NOT EXISTS runs (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  tenant_id TEXT NOT NULL,
+  plan_id TEXT NOT NULL,
+  journey_id TEXT,
+  environment_id TEXT,
+  requested_by TEXT NOT NULL,
+  idempotency_key TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'queued',
+  worker_id TEXT,
+  lease_expires_at TEXT,
+  heartbeat_at TEXT,
+  current_step TEXT,
+  steps_executed INTEGER NOT NULL DEFAULT 0,
+  steps_passed INTEGER NOT NULL DEFAULT 0,
+  steps_failed INTEGER NOT NULL DEFAULT 0,
+  error_code TEXT,
+  error_message TEXT,
+  manifest_key TEXT,
+  requested_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  started_at TEXT,
+  completed_at TEXT,
+  UNIQUE(project_id, idempotency_key)
+);
+
+CREATE TABLE IF NOT EXISTS run_events (
+  run_id TEXT NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
+  sequence INTEGER NOT NULL,
+  type TEXT NOT NULL,
+  payload_json TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  PRIMARY KEY (run_id, sequence)
+);
+
+CREATE INDEX IF NOT EXISTS idx_plan_drafts_project
+  ON plan_drafts(project_id, updated_at DESC);
+CREATE INDEX IF NOT EXISTS idx_runs_project_status
+  ON runs(project_id, status, requested_at DESC);
+CREATE INDEX IF NOT EXISTS idx_run_events_run
+  ON run_events(run_id, sequence);