@kici-dev/orchestrator 0.16.0 → 0.18.0

package/dist/db/migrations/046_join_token_consumed_by_instance.d.ts

@@ -1,16 +1,11 @@
 import { type Kysely } from 'kysely';
 /**
- * Record the joining peer's instanceId at first consumption of a join token:
+ * `join_tokens.consumed_by_instance`: the joining peer's `instanceId` at first consumption
+ * (distinct from `consumed_by`, the coordinator that processed the claim).
  *
- * - `join_tokens.consumed_by_instance text` — the `instanceId` of the peer that
- *   consumed the token. This is the *joining peer*, distinct from `consumed_by`
- *   (the coordinator that processed the claim). It lets a token be reused by the
- *   same peer instance until `expires_at`, so a peer that lost its credential
- *   (transient outage / deleted credential file) self-heals by re-presenting the
- *   join token already in its env — no operator action, no cluster redeploy.
- *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
- * the column is a no-op. Existing data is preserved (additive nullable column).
+ * The same peer instance may reuse the token until `expires_at`, so a peer that lost its
+ * credential self-heals by re-presenting the join token in its env, with no operator action.
+ * Idempotent and additive.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/048_host_reboot_pending.d.ts

@@ -1,18 +1,12 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `host_roster.reboot_pending_until timestamptz NULL` — the persisted
- * reboot-pending flag for workflow-level host restart.
+ * `host_roster.reboot_pending_until`: the persisted reboot-pending flag (NULL = none), set when
+ * a `restartHost()` step calls `host.requestReboot`, so it survives an orchestrator restart.
  *
- * Set when an agent's `restartHost()` step calls `host.requestReboot` (so it
- * survives an orchestrator restart during the host's reboot window). While the
- * value is in the future it (1) makes the agent's imminent disconnect an
- * expected reboot rather than a recovery-fail, (2) gates the pinned-drain off
- * so the post-restart job is not dispatched into the about-to-reboot box, and
- * (3) clears on the next reconnect (down-then-up), releasing the held job. NULL
- * = no reboot pending.
- *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
- * preserved.
+ * While in the future it (1) makes the agent's disconnect an expected reboot, not a
+ * recovery-fail, (2) gates the pinned-drain off so the post-restart job does not dispatch to the
+ * rebooting box, and (3) clears on the next reconnect, releasing the held job.
+ * Idempotent and additive.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/049_held_runs_payload.d.ts

@@ -1,13 +1,8 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `held_runs.payload jsonb NULL` — the drift payload captured when a
- * `when: 'drift'` step-approval gate fires. Holds `{ summaryMarkdown, drift }`:
- * the author's `summarize(drift)` rendering plus the structured drift blob, so
- * the dashboard approval queue and the CLI render the computed diff the
- * operator approves. NULL for every non-drift hold.
- *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
- * preserved.
+ * Add `held_runs.payload`: the `{ summaryMarkdown, drift }` captured when a `when: 'drift'`
+ * step-approval gate fires, so the dashboard approval queue and the CLI render the diff the
+ * operator approves. NULL for every non-drift hold. Idempotent and additive.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/050_sources_slug.d.ts

@@ -3,11 +3,10 @@ import { type Kysely } from 'kysely';
  * Add `sources.slug TEXT NULL` — the GitHub App slug (the URL-safe identifier
  * GitHub assigns, e.g. `my-kici-app`).
  *
- * For GitHub-App sources GitHub is the source of truth for both the display
- * `name` and the `slug`: both are captured at creation and kept fresh by the
- * daily refresher + `kici-admin source refresh`. NULL when the identity fetch
- * hasn't populated it yet (manual `--app-id` flow whose initial fetch failed,
- * or a row created before the rollout).
+ * GitHub owns both the display `name` and the `slug`: captured at creation,
+ * kept fresh by the daily refresher and `kici-admin source refresh`. NULL until
+ * an identity fetch populates it (a failed manual `--app-id` fetch, or a row
+ * older than this column).
  *
  * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
  * preserved.

package/dist/db/migrations/051_binding_host_pattern.d.ts

@@ -1,17 +1,14 @@
 import { type Kysely } from 'kysely';
 /**
- * Add a per-host dimension to environment secret bindings:
+ * Per-host environment secret bindings:
  *
- * - `environment_bindings.host_pattern text NOT NULL DEFAULT '**'` — the host
- *   selector a binding applies to (exact / glob / regex, matched against a
- *   fan-out child's agentId / hostname / labels). `'**'` matches every host, so
- *   existing rows are backfilled to `'**'` and keep their fleet-wide behaviour.
- * - The binding unique key widens from `(environment_id, scope_pattern)` to
- *   `(environment_id, scope_pattern, host_pattern)` so the same scope can carry
- *   distinct per-host selectors.
+ * - `host_pattern` — exact / glob / regex host selector, matched against a fan-out child's
+ *   agentId / hostname / labels. Existing rows backfill to `'**'` (every host), keeping their
+ *   fleet-wide behaviour.
+ * - The unique key widens to `(environment_id, scope_pattern, host_pattern)`, so one scope can
+ *   carry distinct per-host selectors.
  *
- * Idempotent: re-running on a DB that already has the column / index is a no-op.
- * Additive — existing data is preserved.
+ * Idempotent and additive.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/052_host_reach_metadata.d.ts

@@ -1,18 +1,15 @@
 import { type Kysely } from 'kysely';
 /**
- * Add pre-agent reach metadata to the host roster so a declared host (no agent
- * yet) can be reached over SSH for bootstrap bring-up:
+ * Add SSH reach metadata so a declared host with no agent yet can be bootstrapped:
  *
- * - `host_roster.address text NULL` — IP / hostname to SSH to.
- * - `host_roster.ssh_user text NULL` — SSH login user (defaults to `root` at use site).
- * - `host_roster.ssh_port int NULL` — SSH port (defaults to 22 at use site).
- * - `host_roster.ssh_key_secret text NULL` — scoped-secret ref (`scope/key`)
- *   holding the bring-up private key. The orchestrator resolves it server-side;
- *   the key never lives in the roster.
+ * - `host_roster.address` — IP / hostname.
+ * - `host_roster.ssh_user` — login user (`root` at the use site when NULL).
+ * - `host_roster.ssh_port` — port (22 at the use site when NULL).
+ * - `host_roster.ssh_key_secret` — scoped-secret ref (`scope/key`) to the bring-up private key,
+ *   resolved server-side; the key never lives in the roster.
  *
- * All nullable: a host with no reach metadata simply cannot be bootstrapped and
- * behaves exactly as before. Idempotent (`ADD COLUMN IF NOT EXISTS`); additive,
- * so existing data is preserved.
+ * All nullable: a host without them cannot be bootstrapped and is otherwise unaffected.
+ * Idempotent and additive.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/053_agent_token_single_use.d.ts

@@ -1,16 +1,12 @@
 import { type Kysely } from 'kysely';
 /**
- * Add a single-use marker to agent tokens for the bootstrap (init-runner)
- * bring-up flow:
+ * `agent_tokens.consumed_at timestamptz NULL`: the single-use marker for the
+ * bootstrap (init-runner) flow, set when a single-use token is consumed at
+ * `agent.register`; a second register with it is rejected. NULL = never
+ * consumed, the default for existing static / ephemeral tokens, which stay
+ * reusable until expiry.
  *
- * - `agent_tokens.consumed_at timestamptz NULL` — set the first time a
- *   single-use bootstrap token is consumed (at `agent.register`). A second
- *   register with the same token is rejected. NULL = never consumed (the
- *   default for every existing static / ephemeral token, which stay reusable
- *   until expiry).
- *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
- * preserved.
+ * Idempotent and additive.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/054_local_working_tree.d.ts

@@ -1,11 +1,9 @@
 import { type Kysely } from 'kysely';
 /**
- * Mark runs that executed an uploaded local working tree (`kici run remote`):
- *
- * - `execution_runs.local_working_tree boolean NOT NULL DEFAULT false` — true
- *   for runs that ran a developer's local working tree from the CLI (inline
- *   lock file). The dashboard renders a "Local machine" badge for these runs
- *   and avoids building an external repository link from the repo identifier.
+ * Add `execution_runs.local_working_tree boolean NOT NULL DEFAULT false`: true
+ * for runs of a developer's uploaded local working tree (`kici run remote`,
+ * inline lock file). The dashboard shows a "Local machine" badge and builds no
+ * external repository link from the repo identifier.
  *
  * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive with a default, so existing
  * data is preserved.

package/dist/db/migrations/055_agent_token_mandatory_labels.d.ts

@@ -1,17 +1,12 @@
 import { type Kysely } from 'kysely';
 /**
- * Add a token-bound mandatory-label taint to agent tokens:
+ * `agent_tokens.mandatory_labels text NULL`: a JSON-encoded `string[]` of
+ * Kubernetes-taint-style gate labels. A static agent registering with the
+ * token gets them as its registry-entry `mandatoryLabels` and accepts a job
+ * only when every one appears in the job's required labels. NULL = no taint,
+ * so every existing token stays unconfined until re-minted.
  *
- * - `agent_tokens.mandatory_labels text NULL` — a JSON-encoded `string[]` of
- *   Kubernetes-taint-style gate labels the token authorizes. When a static
- *   agent registers with this token, the set becomes the agent's registry-entry
- *   `mandatoryLabels`: the agent only accepts a job when every label here
- *   appears in the job's required labels. NULL = no taint (the default; the
- *   agent accepts any job its advertised labels match), so every existing token
- *   stays unconfined until re-minted.
- *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
- * preserved.
+ * Idempotent and additive.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/056_execution_jobs_environments.d.ts

@@ -1,16 +1,9 @@
 import { type Kysely } from 'kysely';
 /**
- * Add a per-job bound deployment-environment list to `execution_jobs`:
- *
- * - `execution_jobs.environments text NULL` — a JSON-encoded `string[]` of the
- *   ordered environment names a job binds (`environments: [...]`), in merge
- *   order. Written at dispatch with the statically-resolved names (impure
- *   dynamic elements as a `(dynamic)` placeholder), then overwritten with the
- *   fully-resolved list when a deferred-init agent eval resolves dynamic
- *   elements. NULL = the job binds no environment.
- *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
- * preserved.
+ * Add `execution_jobs.environments`: a JSON-encoded `string[]` of the environment names a job
+ * binds, in merge order. Written at dispatch with the static names (impure dynamic elements as a
+ * `(dynamic)` placeholder), then overwritten with the full list when a deferred-init agent eval
+ * resolves them. NULL = no environment. Idempotent and additive.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/064_execution_jobs_skipped_environments.d.ts

@@ -1,16 +1,13 @@
 import { type Kysely } from 'kysely';
 /**
- * Add the test-run skipped-environment columns to `execution_jobs`:
+ * Test-run skipped environments on `execution_jobs`:
  *
- * - `execution_jobs.skipped_environments text NULL` — a JSON-encoded `string[]`
- *   of the bound environment names dropped on a test/local run because they
- *   disallow local execution (`allowLocalExecution=false`) or are unconfigured.
- *   NULL = nothing skipped.
- * - `execution_jobs.env_warning text NULL` — the user-visible warning naming the
- *   skipped environments, surfaced on the dashboard run view. NULL = no warning.
+ * - `skipped_environments` — JSON `string[]` of bound environments a test/local run dropped
+ *   (`allowLocalExecution=false` or unconfigured). NULL = nothing skipped.
+ * - `env_warning` — the user-visible warning naming them, on the dashboard run view. NULL = no
+ *   warning.
  *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`); additive, so existing data is
- * preserved.
+ * Idempotent and additive.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/065_pending_attestations.d.ts

@@ -1,19 +1,16 @@
 import { type Kysely } from 'kysely';
 /**
- * Add the `pending_attestations` deferred-attestation outbox and an idempotency
- * unique index on `attestations`.
+ * The `pending_attestations` deferred-attestation outbox, plus an idempotency unique index on
+ * `attestations`.
  *
- * When a build's provenance mint fails transiently, the agent freezes and
- * DSSE-signs the statement at build time; the orchestrator records the frozen
- * envelope here instead of failing the job. A Raft-leader-only retrier later
- * mints the deferred token, attaches it, uploads the bundle, and records one
- * `attestations` row — deleting the pending row. The unique index on
- * `attestations (run_id, job_id, subject_digest)` makes that fulfilment
- * idempotent across a cluster (ON CONFLICT DO NOTHING).
+ * When a provenance mint fails transiently, the agent freezes and DSSE-signs the statement at
+ * build time, and the orchestrator records the envelope here instead of failing the job. A
+ * Raft-leader-only retrier later mints the token, uploads the bundle, records one
+ * `attestations` row and deletes the pending row; the `(run_id, job_id, subject_digest)` unique
+ * index makes that idempotent across a cluster (ON CONFLICT DO NOTHING).
  *
- * `origin_kind` holds the non-`live` `AttestationOrigin` values
- * (`deferred` / `offline-backfill`); the `created_at` default anchors the true
- * build time so temporal honesty survives a later mint.
+ * `origin_kind` holds the non-`live` `AttestationOrigin` values (`deferred` /
+ * `offline-backfill`); `created_at` anchors the true build time across a later mint.
  *
  * Idempotent: guarded on table existence.
  */

package/dist/db/migrations/066_pending_attestations_rejected.d.ts

@@ -1,12 +1,9 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `rejected_at` to `pending_attestations`: the terminal-rejection marker for
- * a deferred attestation the Platform definitively cannot mint (run/job absent).
- * NULL while the row is still pending a later mint; set once, the row is skipped
- * by the retrier and drops out of the pending-attestations gauge. Re-armed via
- * `kici-admin attestations retry --include-rejected`.
- *
- * Idempotent: guarded on column existence.
+ * Add `pending_attestations.rejected_at`: marks a deferred attestation the Platform definitively
+ * cannot mint (run/job absent). Once set, the retrier skips the row and it leaves the
+ * pending-attestations gauge; `kici-admin attestations retry --include-rejected` re-arms it.
+ * Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/068_request_idempotency.d.ts

@@ -1,14 +1,12 @@
 import { type Kysely } from 'kysely';
 /**
- * Add the `request_idempotency` claim table: a `request_id`-keyed record that
- * makes run-minting dashboard requests (`run.rerun.request`,
- * `run.manual_schedule.request`) idempotent on the Platform `requestId`. HA
- * coordinator siblings share one orchestrator DB, so when the Platform relay
- * fails over and re-sends the same request to a sibling, the atomic `INSERT …
- * ON CONFLICT DO NOTHING` on `request_id` lets exactly one coordinator win —
- * the loser returns the winner's `new_run_id` instead of minting a second run.
- * Rows are pruned after 1h (far past the ~10s request budget) by the periodic
- * cleanup tick.
+ * Add the `request_idempotency` claim table, making run-minting dashboard
+ * requests (`run.rerun.request`, `run.manual_schedule.request`) idempotent on
+ * the Platform `requestId`. HA coordinator siblings share one DB, so when the
+ * relay fails over and re-sends to a sibling, the atomic `INSERT … ON CONFLICT
+ * DO NOTHING` on `request_id` lets one coordinator win; the loser returns the
+ * winner's `new_run_id`. The cleanup tick prunes rows after 1h (far past the
+ * ~10s request budget).
  *
  * Idempotent: guarded on table existence.
  */

package/dist/db/migrations/069_reroute_tunables.d.ts

@@ -1,20 +1,12 @@
 import { type Kysely } from 'kysely';
 /**
- * Add the three reroute-tunable columns to `org_settings` (all nullable):
+ * Add the per-org reroute tunables to `org_settings` (nullable; NULL is the cluster default; set
+ * via `kici-admin org-settings`). Each add is guarded on column existence.
  *
- * - `reroute_spawn_window_ms BIGINT` — how long the coordinator waits after a
- *   peer ACKs a reroute before treating "accepted but no progress" as a spawn
- *   failure and re-dispatching. NULL falls back to the cluster default
- *   (`rerouteSpawnWindowMs`, 90s).
- * - `reroute_ack_timeout_ms BIGINT` — the reroute `sendAndWaitAck` deadline.
- *   NULL falls back to `rerouteAckTimeoutMs` (15s).
- * - `reroute_max_hops INTEGER` — maximum peer hops for a rerouted job. NULL
- *   falls back to `rerouteMaxHops` (3).
- *
- * Operators tune them per-org via `kici-admin org-settings`.
- *
- * Idempotent: each column add is guarded on column existence, so a re-run on a
- * DB that already has a column is a no-op for that column.
+ * - `reroute_spawn_window_ms` — wait after a peer ACKs a reroute before "accepted but no
+ *   progress" counts as a spawn failure and re-dispatches (`rerouteSpawnWindowMs`, 90s).
+ * - `reroute_ack_timeout_ms` — the reroute `sendAndWaitAck` deadline (`rerouteAckTimeoutMs`, 15s).
+ * - `reroute_max_hops` — max peer hops for a rerouted job (`rerouteMaxHops`, 3).
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/071_batch_accumulation.d.ts

@@ -1,23 +1,15 @@
 import { type Kysely } from 'kysely';
 /**
- * Add the batch-accumulation tables that back the `workflows_failed_batch`
- * trigger.
+ * Batch-accumulation tables behind the `workflows_failed_batch` trigger.
  *
- * When a `workflow_complete(failed)` event matches a `workflowsFailedBatch`
- * registration, the orchestrator buffers the failed run into a durable window
- * instead of dispatching now. The first failure opens the window (`opened_at`);
- * the Raft-leader-only scanner sweeps windows past `expires_at`, emits one
- * `__workflows_failed_batch` event carrying the buffered runs, and deletes the
- * window (cascading its items).
+ * A `workflow_complete(failed)` event matching a `workflowsFailedBatch` registration buffers
+ * the run into a durable window; the first failure opens it. The Raft-leader-only scanner
+ * sweeps windows past `expires_at`, emits one `__workflows_failed_batch` event with the
+ * buffered runs, and deletes the window (cascading its items).
  *
- * `batch_accumulation_windows` holds one open window per subscribing workflow —
- * `UNIQUE(registration_id)` enforces open-once so concurrent failures append to
- * the same window rather than opening N of them. `routing_key` /
- * `repo_identifier` are captured at open time so the leader sweep can emit the
- * batch event without re-reading the registration index.
- *
- * `batch_accumulation_items` holds the buffered failed runs, deleted with their
- * window via `ON DELETE CASCADE`.
+ * `UNIQUE(registration_id)` enforces one open window per subscribing workflow, so concurrent
+ * failures append rather than open N windows. `routing_key` / `repo_identifier` are captured
+ * at open time so the sweep need not re-read the registration index.
  *
  * Idempotent: guarded on table existence.
  */

package/dist/db/migrations/072_dispatch_queue_run_id_index.d.ts

@@ -1,14 +1,8 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `idx_dispatch_queue_run_id` on `dispatch_queue (run_id)`.
- *
- * `failByRunId`, `cancelByRunId`, and `getDispatchedJobIdsByRunId` all filter
- * `WHERE run_id = ?`. Without this index every run-failure cascade and cancel
- * does a full-table scan over the whole dispatch history, each scan holding a
- * pooled connection longer than necessary. The terminal-row retention sweep
- * (`pruneTerminalDispatchRows`) also benefits from cheaper row lookup.
- *
- * Idempotent: `IF NOT EXISTS` makes a re-run a no-op.
+ * `failByRunId`, `cancelByRunId` and `getDispatchedJobIdsByRunId` filter on `run_id`; without
+ * this index each run-failure cascade and cancel full-scans the dispatch history while holding
+ * a pooled connection. `pruneTerminalDispatchRows` also uses it. Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/074_normalize_zero_concurrency_limit.d.ts

@@ -1,12 +1,9 @@
 import { type Kysely } from 'kysely';
 /**
- * Normalize degenerate context concurrency limits. A `concurrency_limit` of 0
- * (or any non-positive value) is meaningless — it wedged the workflow-install
- * gate into an unreleasable concurrency hold. The write boundary now rejects it
- * and the gate treats it as unlimited; this migration cleans up any pre-existing
- * rows so the column only ever holds NULL (unlimited) or a positive integer.
- * Idempotent; down() is a no-op (a normalized 0 cannot — and should not — be
- * restored).
+ * Normalize non-positive `concurrency_limit` values, which wedge the workflow-install gate in
+ * an unreleasable hold, to NULL, so the column holds only NULL (unlimited) or a positive
+ * integer. The write boundary rejects them and the gate treats them as unlimited.
+ * Idempotent; down() is a no-op.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(_db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/076_artifacts.d.ts

@@ -3,16 +3,15 @@ import { type Kysely } from 'kysely';
  * Add the `artifacts` table for user-facing build artifacts and the per-org
  * artifact quota + TTL knobs on `org_settings`.
  *
- * When a workflow step calls `ctx.artifacts.upload(name, paths)`, the agent
- * uploads the packed tarball to object storage under
- * `artifacts/{run_id}/{name}-{discriminator}.tar.gz` (the discriminator is a
- * hash of the exact name) and the orchestrator records one row here
- * so a later job (`ctx.artifacts.download`) and the dashboard can resolve it.
- * `UNIQUE (run_id, name)` is the immutability constraint — the first upload of a
- * name within a run wins; a duplicate name fails at the DB layer as a backstop
+ * On `ctx.artifacts.upload(name, paths)` the agent uploads the tarball to
+ * `artifacts/{run_id}/{name}-{discriminator}.tar.gz` (discriminator = hash of
+ * the exact name) and the orchestrator records one row here, so a later job
+ * (`ctx.artifacts.download`) and the dashboard can resolve it.
+ * `UNIQUE (run_id, name)` is the immutability constraint: the first upload of
+ * a name within a run wins, and a duplicate fails at the DB layer as a backstop
  * to the handler's pre-mint duplicate check.
  *
- * Idempotent: a re-run on a DB that already has the table / columns is a no-op.
+ * Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/078_org_settings_backup_staleness.d.ts

@@ -1,11 +1,8 @@
 import { type Kysely } from 'kysely';
 /**
- * Add the nullable `org_settings.backup_staleness_warn_hours INTEGER` column:
- * the per-org override for the DB-backup freshness diagnostic's WARN threshold.
- * NULL falls back to the cluster default (`config.backupStalenessWarnHours`,
- * 24h). Operators tune it per-org via `kici-admin org-settings backup-freshness`.
- *
- * Idempotent: guarded on column existence.
+ * Add `org_settings.backup_staleness_warn_hours`: the per-org WARN threshold for the DB-backup
+ * freshness diagnostic, set via `kici-admin org-settings backup-freshness`. NULL is the cluster
+ * default (`config.backupStalenessWarnHours`, 24h). Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/079_org_settings_scaler_spawn_timeout.d.ts

@@ -1,13 +1,9 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `org_settings.scaler_spawn_timeout_ms BIGINT` (nullable).
- *
- * Per-org deadline for a single scaler `backend.spawn` (image pull + container
- * create + start). NULL falls back to the cluster-wide default
- * (`KICI_SCALER_SPAWN_TIMEOUT_MS`, default 300s). Operators tune it per tenant
- * via `kici-admin org-settings scaler-spawn-timeout`.
- *
- * Idempotent: a re-run on a DB that already has the column is a no-op.
+ * `org_settings.scaler_spawn_timeout_ms BIGINT` (nullable): per-org deadline
+ * for one scaler `backend.spawn` (image pull + container create + start). NULL
+ * falls back to `KICI_SCALER_SPAWN_TIMEOUT_MS` (default 300s). Tuned per tenant
+ * via `kici-admin org-settings scaler-spawn-timeout`. Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/080_cluster_settings.d.ts

@@ -1,16 +1,12 @@
 import { type Kysely } from 'kysely';
 /**
- * Create `cluster_settings`: a single-row (id='default') table of fleet-wide
- * operator tunables. Each knob column is nullable; NULL = "use the cluster
- * default from config.ts". Distinct from org_settings (per customer_id) — these
- * knobs have no per-tenant meaning (process-global singletons, ingest before
- * org resolution, per-agent-instance, leader-only sweepers), so they live on a
- * dedicated cluster-global table rather than a magic customer_id row.
+ * Create `cluster_settings`: a single-row (id='default') table of fleet-wide operator tunables;
+ * a NULL knob uses the config.ts default. These knobs have no per-tenant meaning
+ * (process-global singletons, pre-org-resolution ingest, per-agent-instance, leader-only
+ * sweepers), so they get their own table rather than a magic org_settings customer_id row.
  *
- * Read via ClusterSettingsReader (whole-row, short-TTL cache); written via the
- * `/api/v1/admin/cluster-settings` route and `kici-admin cluster-settings` CLI.
- *
- * Idempotent: a re-run on a DB that already has the table is a no-op.
+ * Read via ClusterSettingsReader (whole-row, short-TTL cache); written via
+ * `/api/v1/admin/cluster-settings` and `kici-admin cluster-settings`. Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/081_org_settings_queue_timeout.d.ts

@@ -1,18 +1,14 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `org_settings.queue_timeout_ms BIGINT` (nullable).
- *
- * Per-org dispatch-queue job timeout. A queued job's deadline is
- * `job.timeoutMs ?? <per-org queue_timeout_ms> ?? config.queueTimeoutMs`.
- * NULL falls back to the cluster-wide default (`KICI_QUEUE_TIMEOUT_MS`,
- * default 1h). Operators tune it per tenant via
+ * `org_settings.queue_timeout_ms BIGINT` (nullable): per-org dispatch-queue job
+ * timeout. A queued job's deadline is
+ * `job.timeoutMs ?? <per-org queue_timeout_ms> ?? config.queueTimeoutMs`; NULL
+ * falls back to `KICI_QUEUE_TIMEOUT_MS` (default 1h). Tuned per tenant via
  * `kici-admin org-settings queue-timeout`.
  *
- * This is the one genuinely per-job tunable from the tunables audit — the
- * read site (`JobQueue.enqueue`) has the job's `cacheOrgId` in scope. The
- * fleet-wide tunables live on `cluster_settings` (migration 080) instead.
- *
- * Idempotent: a re-run on a DB that already has the column is a no-op.
+ * Per-org because the read site (`JobQueue.enqueue`) has the job's
+ * `cacheOrgId` in scope; fleet-wide tunables live on `cluster_settings`
+ * (migration 080). Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/082_host_s3_reachable.d.ts

@@ -1,15 +1,10 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `host_roster.s3_reachable BOOLEAN` (nullable).
- *
- * Per-host delivery hint for fresh-box bring-up: when true, the box can reach
- * the orchestrator's object storage, so the bring-up handler picks the
- * `s3-direct` delivery mode (the box pulls the payload via a presigned URL
- * itself, no 50 MB through the ops agent). NULL / false ⇒ the conservative
- * `ssh-push` fallback (the ops agent fetches the payload and streams it to the
- * box over scp). Declared via `kici-admin host declare --s3-reachable`.
- *
- * Idempotent: a re-run on a DB that already has the column is a no-op.
+ * Add `host_roster.s3_reachable`, a fresh-box bring-up delivery hint set via
+ * `kici-admin host declare --s3-reachable`. True: the box reaches the orchestrator's object
+ * storage, so bring-up uses `s3-direct` (the box pulls the payload via a presigned URL, no 50 MB
+ * through the ops agent). NULL / false: the `ssh-push` fallback (the ops agent fetches the
+ * payload and scp's it to the box). Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/083_org_settings_artifact_caps.d.ts

@@ -3,15 +3,13 @@ import { type Kysely } from 'kysely';
  * Add `org_settings.artifact_max_bytes` + `artifact_max_per_run` (both nullable
  * BIGINT).
  *
- * Per-org overrides of the per-artifact size cap and per-run artifact count cap
- * for user-facing artifacts (ctx.artifacts). NULL falls back to the cluster-wide
- * default (`config.artifactMaxBytes` / `config.artifactMaxPerRun`,
- * `KICI_ARTIFACT_MAX_BYTES` / `KICI_ARTIFACT_MAX_PER_RUN`). Operators tune them
- * per tenant via `kici-admin org-settings artifacts set-max-bytes` /
- * `set-max-per-run`.
+ * Per-org overrides of the per-artifact size cap and per-run count cap for
+ * user-facing artifacts (ctx.artifacts). NULL falls back to the cluster default
+ * (`config.artifactMaxBytes` / `config.artifactMaxPerRun`,
+ * `KICI_ARTIFACT_MAX_BYTES` / `KICI_ARTIFACT_MAX_PER_RUN`). Set via
+ * `kici-admin org-settings artifacts set-max-bytes` / `set-max-per-run`.
  *
- * Idempotent: guarded on column existence; a re-run on a DB that already has a
- * column is a no-op.
+ * Idempotent: guarded on column existence.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;