@kici-dev/orchestrator 0.17.0 → 0.18.0

package/dist/db/client.d.ts

@@ -2,12 +2,8 @@ import pg from 'pg';
 import { Kysely } from 'kysely';
 import { createPool as _createPool } from '@kici-dev/shared';
 import type { Database } from './types.js';
-/**
- * Create PostgreSQL connection pool.
- */
+/** Creates a PostgreSQL connection pool. */
 export declare const createPool: typeof _createPool;
-/**
- * Create Kysely database instance typed to the orchestrator schema.
- */
+/** Creates a Kysely instance typed to the orchestrator schema. */
 export declare function createDb(pool: pg.Pool): Kysely<Database>;
 //# sourceMappingURL=client.d.ts.map

package/dist/db/deferred-index-build.d.ts

@@ -13,10 +13,9 @@ export declare const DEFERRED_INDEX_LOCK_KEY = 543210002;
 /**
  * Drop a leftover invalid index before rebuilding it.
  *
- * An interrupted `CREATE INDEX CONCURRENTLY` leaves the index in place marked
- * invalid: it is not used by the planner, and `IF NOT EXISTS` sees it and
- * skips. Without this, the very first failed build would make the retry a
- * permanent no-op — the opposite of the "retries on the next boot" contract.
+ * An interrupted `CREATE INDEX CONCURRENTLY` leaves an invalid index that the
+ * planner ignores and `IF NOT EXISTS` skips, so without this the first failed
+ * build would turn the "retries on the next boot" contract into a no-op.
  */
 export declare function dropIfInvalid(client: Pick<pg.Client, 'query'>, name: string, logger: Logger): Promise<void>;
 export interface BuildDeferredIndexesResult {
@@ -26,13 +25,12 @@ export interface BuildDeferredIndexesResult {
 /**
  * Build every deferred index on one dedicated connection.
  *
- * The connection is taken straight from `pg` rather than from the serving
- * pool: `CREATE INDEX CONCURRENTLY` must run outside a transaction and must
- * not inherit a statement timeout, and a concurrent build on a large table
- * would otherwise hold a serving connection for its whole duration.
+ * The connection comes straight from `pg`, not the serving pool:
+ * `CREATE INDEX CONCURRENTLY` runs outside a transaction with no statement
+ * timeout, and a long build would otherwise hold a serving connection.
  *
- * The advisory lock is `pg_try_advisory_lock`, not the blocking form: when a
- * peer is already building, this instance has nothing to wait for.
+ * `pg_try_advisory_lock`, not the blocking form: when a peer is already
+ * building, this instance has nothing to wait for.
  */
 export declare function buildDeferredIndexes(databaseUrl: string, opts?: {
     logger?: Logger;

package/dist/db/deferred-indexes.d.ts

@@ -1,24 +1,19 @@
 /**
  * Indexes built after boot, outside the migration set.
  *
- * A migration cannot build an index without locking the table it indexes.
- * Kysely runs the whole pending batch inside one transaction and offers no
- * per-migration opt-out, and PostgreSQL rejects `CREATE INDEX CONCURRENTLY`
- * inside a transaction block outright — so a migration's only option is a
- * plain `CREATE INDEX`, which holds an exclusive lock for the whole build. On
- * a table holding millions of rows that is a multi-minute outage bolted onto
- * an upgrade.
+ * Kysely runs the pending batch in one transaction with no per-migration opt-out, and PostgreSQL
+ * rejects `CREATE INDEX CONCURRENTLY` inside a transaction block, so a migration can only use a
+ * plain `CREATE INDEX`: an exclusive lock for the whole build, a multi-minute upgrade outage on a
+ * table of millions of rows.
  *
- * So an index on a table that scales with run volume goes here instead. Each
- * entry is built `CONCURRENTLY` on its own connection with no statement
- * timeout, under an advisory lock distinct from the migration lock, after the
- * server is already serving. `IF NOT EXISTS` makes every build idempotent, and
- * a failed build retries on the next boot.
+ * So an index on a table that scales with run volume goes here. Each entry is built
+ * `CONCURRENTLY` on its own connection with no statement timeout, under an advisory lock distinct
+ * from the migration lock, after the server is serving. `IF NOT EXISTS` makes every build
+ * idempotent, and a failed build retries on the next boot.
  *
- * A repository check enforces that new indexes on those tables land here
- * rather than in a migration. The build itself is `deferred-index-build.ts`;
- * this module holds only the list, so a CLI can read it without loading the
- * orchestrator's metrics.
+ * A repository check enforces that new indexes on those tables land here. The build is
+ * `deferred-index-build.ts`; this module holds only the list, so a CLI can read it without
+ * loading the orchestrator's metrics.
  */
 export interface DeferredIndex {
     /** Index name, matching the one the SQL creates. */
@@ -27,12 +22,10 @@ export interface DeferredIndex {
     sql: string;
 }
 /**
- * Every index the retention sweep and the age-based readers depend on.
- *
- * Each one supports a `... < cutoff` scan that would otherwise walk the whole
- * table on every cleanup tick. The tables already carry indexes for their
- * serving-path queries; these cover the aging path, whose predicate is not
- * prefixed by an organization or routing key.
+ * Every index the retention sweep and the age-based readers depend on: each supports a
+ * `... < cutoff` scan that would otherwise walk the whole table every cleanup tick. Serving-path
+ * indexes exist already; these cover the aging path, whose predicate has no org or routing-key
+ * prefix.
  */
 export declare const DEFERRED_INDEXES: ReadonlyArray<DeferredIndex>;
 //# sourceMappingURL=deferred-indexes.d.ts.map

package/dist/db/migration-provider.d.ts

@@ -1,8 +1,6 @@
 /**
- * Static migration provider for bundled builds.
- *
- * Rolldown doesn't support dynamic `import()` of migration files at runtime,
- * so we statically import all migrations and provide them to Kysely's Migrator.
+ * Static migration provider for bundled builds: Rolldown cannot dynamic-`import()` migration
+ * files at runtime, so every migration is imported statically for Kysely's Migrator.
  */
 import type { MigrationProvider } from 'kysely/migration';
 export declare function createMigrationProvider(): MigrationProvider;

package/dist/db/migration-test-harness.d.ts

@@ -1,63 +1,45 @@
 /**
  * Test harness for the per-migration real-Postgres suites.
  *
- * A test named `NNN_thing.test.ts` documents the schema that migration `NNN`
- * produces, so it must apply the migration set only as far as `NNN`. Applying
- * the whole set instead runs the assertions against the schema at the head of
- * the migration list, where a later migration may already have dropped or
- * reshaped the column under test — the test then fails, or passes for the wrong
- * reason. Those suites only execute when `KICI_TEST_ADMIN_DATABASE_URL` is set,
- * so that rot stays invisible in a normal `pnpm test` run.
- *
- * The harness derives the target from the calling test file's own URL, so a
- * test can neither name the wrong migration nor drift when a file is renamed.
- * It has no fallback to the whole set: an unknown or no-op target throws.
- *
- * A DATA migration needs the state one step earlier as well, so it can insert
- * the rows it is supposed to rewrite: `migrateToPreviousMigration()` provides
- * it, deriving that target from the migration list rather than from a name the
- * test spells out.
- *
- * Repo/store tests outside `migrations/` (host roster, artifact store, the repo
- * suites) legitimately want head-of-list schema and use `migrateToLatest()`
- * directly instead.
+ * A test named `NNN_thing.test.ts` documents the schema migration `NNN` produces, so it applies
+ * the set only as far as `NNN`: at the head of the list a later migration may have dropped or
+ * reshaped the column under test, and the test fails or passes for the wrong reason. These
+ * suites run only when `KICI_TEST_ADMIN_DATABASE_URL` is set, so that rot is invisible in a
+ * normal `pnpm test`.
+ *
+ * The target comes from the calling test file's own URL, so a test cannot name the wrong
+ * migration or drift on rename. There is no fallback to the whole set: an unknown or no-op
+ * target throws. `migrateToPreviousMigration()` gives a DATA migration the state one step
+ * earlier, derived from the migration list.
+ *
+ * Repo/store tests outside `migrations/` want head-of-list schema and use `migrateToLatest()`.
  */
 import type { Kysely } from 'kysely';
 import { type MigrationResultSet } from 'kysely/migration';
 /**
- * Derive `030_held_runs_env_set_null` from a
- * `.../migrations/030_held_runs_env_set_null.test.ts` module URL.
- *
- * Throws when the caller is not a per-migration test, so a copy-paste into an
- * unrelated suite fails loudly instead of silently migrating somewhere odd.
+ * Derive `030_held_runs_env_set_null` from a `.../migrations/030_held_runs_env_set_null.test.ts`
+ * URL. Throws for a non-per-migration caller, so a copy-paste into another suite fails loudly.
  */
 export declare function migrationNameFromTestUrl(testUrl: string): string;
 /**
- * Apply migrations `001..NNN` inclusive, where `NNN` is the migration the
- * calling test file is named after. Pass `import.meta.url` as `testUrl`.
+ * Apply migrations `001..NNN` inclusive, `NNN` being the calling test file's migration. Pass
+ * `import.meta.url` as `testUrl`.
  *
- * Returns Kysely's result set so callers keep their own error handling
- * (`if (error) throw error` / `expect(error).toBeUndefined()`). A target that
- * does not exist surfaces as `error`; a target that applied nothing, or stopped
- * somewhere other than itself, throws — neither can silently degrade into
- * "the whole migration set ran".
+ * Returns Kysely's result set so callers keep their own error handling. A missing target
+ * surfaces as `error`; a target that applied nothing, or stopped elsewhere, throws — neither
+ * silently degrades into "the whole migration set ran".
  */
 export declare function migrateToOwnMigration<DB>(db: Kysely<DB>, testUrl: string): Promise<MigrationResultSet>;
 /**
- * Apply migrations `001..NNN-1` — everything up to, but NOT including, the
- * migration the calling test file is named after. Pass `import.meta.url`.
+ * Apply migrations `001..NNN-1`: up to, but NOT including, the calling test file's migration.
+ * Pass `import.meta.url`.
  *
- * This is the pre-migration state a DATA migration has to be tested from. A
- * data migration rewrites rows that already exist, so its test has to straddle
- * it: migrate here, insert the rows an upgraded database actually holds, then
- * call {@link migrateToOwnMigration} and assert what moved. Going straight to
- * `migrateToOwnMigration` leaves no window to insert anything, so the
- * assertions would run against rows the migration never saw — a check that
- * passes identically with the migration body deleted.
+ * A DATA migration's test straddles it: migrate here, insert the rows an upgraded database
+ * holds, then call {@link migrateToOwnMigration} and assert what moved. Without this window the
+ * assertions run against rows the migration never saw, and pass with its body deleted.
  *
- * The target is derived from the migration list, so the caller never names the
- * previous migration and cannot drift when one is inserted before it. A test
- * for the very first migration throws, since there is no earlier state.
+ * The target comes from the migration list, so it cannot drift when a migration is inserted
+ * before it. The first migration throws: there is no earlier state.
  */
 export declare function migrateToPreviousMigration<DB>(db: Kysely<DB>, testUrl: string): Promise<MigrationResultSet>;
 //# sourceMappingURL=migration-test-harness.d.ts.map

package/dist/db/migrations/001_initial.d.ts

@@ -1,8 +1,5 @@
 import { type Kysely } from 'kysely';
 export declare function up(db: Kysely<any>): Promise<void>;
-/**
- * Rollback drops everything created above. Uses CASCADE on table drops to cut
- * through the FK graph without relying on exact topological order.
- */
+/** Drops everything `up` created; CASCADE cuts the FK graph without a topological order. */
 export declare function down(db: Kysely<any>): Promise<void>;
 //# sourceMappingURL=001_initial.d.ts.map

package/dist/db/migrations/002_config_versions_key_version.d.ts

@@ -1,15 +1,12 @@
 import { type Kysely } from 'kysely';
 /**
- * Add key_version column to config_versions so that sensitive-field encryption
- * can be rotated via `kici-admin rotate-key`.
+ * `config_versions.key_version`, so `kici-admin rotate-key` can rotate sensitive-field encryption.
  *
- * Existing rows are backfilled to 1 via the DEFAULT clause (every historical
- * row was encrypted under the first master-key generation). After rotation,
- * `SharedConfigStore` writes the next integer (MAX(key_version) + 1) and
- * stores the active generation alongside the ciphertext.
+ * The DEFAULT backfills existing rows to 1 (all encrypted under the first master-key
+ * generation). After rotation, `SharedConfigStore` writes MAX(key_version) + 1 beside the
+ * ciphertext.
  *
- * No index is needed: rotation does a full-table scan; reads are by
- * `version` primary key and never filter on `key_version`.
+ * No index: rotation full-scans; reads go by the `version` primary key.
  */
 export declare function up(db: Kysely<any>): Promise<void>;
 export declare function down(db: Kysely<any>): Promise<void>;

package/dist/db/migrations/003_access_log.d.ts

@@ -2,24 +2,19 @@ import { type Kysely } from 'kysely';
 /**
  * Access log: one row per read or orchestrator-admin mutation attributable
  * to an ActorPrincipal (dashboard user, api_key, service_account, platform
- * operator break-glass, or system). Backs:
+ * operator break-glass, or system). Backs the dashboard "Data access" tab
+ * (dashboard.access-log.list), GET /api/v1/admin/access-log and
+ * `kici-admin access-log`.
  *
- * - dashboard "Data access" tab (dashboard.access-log.list message)
- * - orchestrator admin HTTP route GET /api/v1/admin/access-log
- * - kici-admin `access-log` CLI subcommand
+ * `secret_audit_log` stays the source of truth for secret *mutation* events
+ * (different retention expectations); access_log records secret *reveals*
+ * with full actor attribution.
  *
- * Covers reads + orchestrator-admin mutations uniformly. `secret_audit_log`
- * stays the source of truth for secret *mutation* events (kept separate for
- * historical reasons and different retention expectations); access_log
- * records secret *reveals* with full actor attribution.
+ * `source` distinguishes platform_proxy / admin_http / admin_cli entry
+ * points. `actor_meta` holds variant-specific extras (ownerSub for api_key,
+ * reason for platform_operator).
  *
- * `source` distinguishes platform_proxy vs admin_http vs admin_cli entry
- * points. `actor_meta` captures the variant-specific extras that don't fit
- * in the flat (actor_type, actor_id) columns — ownerSub for api_key,
- * reason for platform_operator.
- *
- * Retention is TTL-based via expires_at; packages/orchestrator/src/queue/
- * cleanup.ts picks up the prune pass.
+ * Retention is TTL-based via expires_at; queue/cleanup.ts prunes.
  */
 export declare function up(db: Kysely<any>): Promise<void>;
 export declare function down(db: Kysely<any>): Promise<void>;

package/dist/db/migrations/004_rename_bundle_to_source.d.ts

@@ -2,16 +2,14 @@
  * Rename `dispatch_queue.bundle_url` / `bundle_hash` → `source_tar_url` /
  * `source_tar_hash`.
  *
- * The cached build artifact changed from a Rolldown-bundled `.compiled.mjs`
- * (keyed under `bundles/{contentHash}.js` in S3) to a raw `.kici/` source
- * tarball (keyed under `source/{contentHash}.tar.gz`). The agent extracts it
- * and imports the workflow via the shared oxc-transform ESM loader hook
- * instead of running Rolldown at runtime.
+ * The cached build artifact is a raw `.kici/` source tarball
+ * (`source/{contentHash}.tar.gz` in S3), not a Rolldown-bundled `.compiled.mjs`
+ * (`bundles/{contentHash}.js`). The agent extracts it and imports the workflow
+ * through the shared oxc-transform ESM loader hook.
  *
- * Pre-release rename: no data preservation needed. Any rows referencing the
- * old bundle URLs will fail their contentHash lookup once the new SCHEMA_V4
- * cache prefix lands, and the orchestrator will schedule a fresh build job —
- * same as any other cache miss.
+ * Pre-release rename with no data preservation: rows with old bundle URLs miss
+ * their contentHash lookup under the SCHEMA_V4 cache prefix and get a fresh
+ * build job, like any cache miss.
  */
 import type { Kysely } from 'kysely';
 export declare function up(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/005_cold_store_chunk_counter.d.ts

@@ -1,16 +1,10 @@
 import { type Kysely } from 'kysely';
 /**
- * Cold-store chunk counter table.
+ * Per-(db, table, tenant) archived-chunk totals, so the `cold_store_chunks_total` gauge and
+ * `kici-admin cold-store list-chunks` avoid S3 LIST calls (expensive + rate-limited).
  *
- * Tracks per-(db, table, tenant) archived-chunk metadata so the
- * `cold_store_chunks_total` Prometheus gauge and the
- * `kici-admin cold-store list-chunks` CLI can report totals without
- * issuing S3 LIST calls (expensive + rate-limited).
- *
- * The table starts empty; the cold-store archiver
- * updates it transactionally with every successful chunk
- * write via `INSERT ... ON CONFLICT (db, table_name, tenant_id) DO
- * UPDATE SET chunk_count = chunk_count + EXCLUDED.chunk_count, ...`.
+ * Starts empty; the archiver upserts it in the same transaction as every successful chunk
+ * write (`INSERT ... ON CONFLICT (db, table_name, tenant_id) DO UPDATE ...`).
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/006_runs_jobs_steps_archived_at.d.ts

@@ -1,37 +1,17 @@
 import { type Kysely } from 'kysely';
 /**
- * `execution_runs` / `execution_jobs` / `execution_steps` cold-store
- * schema additions.
+ * Cold-store columns for `execution_runs` / `execution_jobs` / `execution_steps`.
  *
- * Part of the cold-storage archival system.
+ * Each table gets `archived_at` and `archive_object_key` (both NULL), set inside the archive tx
+ * before the DELETE; survivors carry NULL, as `run_events` does in the Platform's schema.
  *
- * Each table gets `archived_at TIMESTAMPTZ NULL` and
- * `archive_object_key TEXT NULL` (set inside the archive tx before the
- * DELETE; survivors carry NULL — the same pattern `run_events` carries
- * in the Platform's schema).
+ * The archiver partitions by `routing_key`, which only `execution_runs` carried; jobs and steps
+ * get it denormalized (avoiding a 3-table JOIN per archive cycle) with a one-shot backfill from
+ * their runs. New inserts must populate it (enforced at the application layer). It stays
+ * NULLable so a missed insert site still lands; `listEligiblePartitions` skips NULL tenants.
  *
- * Tenant column denormalization: the orchestrator side partitions by
- * `routing_key`, but only `execution_runs` carries the column today.
- * `execution_jobs` and `execution_steps` reference the run by `run_id`
- * and would otherwise need a 3-table JOIN at every archive cycle. We
- * denormalize `routing_key` onto both tables and backfill from the
- * existing run rows. Backfill is one-shot inside this migration. New
- * inserts must populate the column going forward (enforced at the
- * application layer).
- *
- * The denormalized column is left NULLable for safety: if an insert
- * site is missed in the rollout, the row still lands in PG; the
- * cold-store adapter's `listEligiblePartitions` skips NULLs (no
- * tenant ⇒ no archive). A follow-up migration may tighten to NOT NULL
- * once we're confident every insert site is updated.
- *
- * Composite indexes added for the archiver's
- * `listEligiblePartitions` discovery query
- * (`GROUP BY routing_key, DATE(created_at)`):
- *
- *   - `idx_execution_runs_routing_key_created  (routing_key, created_at)`
- *   - `idx_execution_jobs_routing_key_created  (routing_key, created_at)`
- *   - `idx_execution_steps_routing_key_created (routing_key, created_at)`
+ * The `(routing_key, created_at)` indexes serve the archiver's `listEligiblePartitions` query
+ * (`GROUP BY routing_key, DATE(created_at)`).
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/007_audit_logs_archived_at.d.ts

@@ -1,38 +1,19 @@
 import { type Kysely } from 'kysely';
 /**
- * `secret_audit_log` and `access_log` cold-store schema additions, plus
- * the removal of `access_log`'s `expires_at`-based hard delete.
+ * Cold-store columns for `secret_audit_log` and `access_log`, and removal of `access_log`'s
+ * `expires_at` hard delete.
  *
- * Part of the cold-storage archival system.
+ * Both tables get the `archived_at` / `archive_object_key` pair (as in
+ * `006_runs_jobs_steps_archived_at.ts`), set in the archive tx before the DELETE.
  *
- * Both tables get the same `archived_at TIMESTAMPTZ NULL` /
- * `archive_object_key TEXT NULL` pair that `run_events` carries
- * (in the Platform's schema) and that `execution_runs` / `execution_jobs` /
- * `execution_steps` got in `006_runs_jobs_steps_archived_at.ts`. Set inside
- * the archive transaction before the DELETE; survivors carry NULL.
+ * `idx_secret_audit_log_routing_timestamp` lets the archiver's per-tenant scan use one index;
+ * the single-column `idx_secret_audit_log_timestamp` would force a filter step. `access_log`'s
+ * existing `access_log_org_created_idx (org_id, created_at DESC)` already serves its scan.
  *
- * `secret_audit_log` gets a composite
- * `idx_secret_audit_log_routing_timestamp (routing_key, timestamp)` so
- * the archiver's per-tenant scan can use a single index. The existing
- * `idx_secret_audit_log_timestamp` is single-column and would force a
- * filter step.
- *
- * `access_log` already has `access_log_org_created_idx (org_id,
- * created_at DESC)`, which is sufficient for the per-tenant scan
- * (range scans use either direction).
- *
- * Drops `access_log.expires_at` column and `access_log_expires_idx`.
- * Before this migration, `expires_at` powered a 90-day hard-delete sweep in
- * `packages/orchestrator/src/audit/access-log.ts:cleanup` (called from
- * `packages/orchestrator/src/queue/cleanup.ts:runCleanup` step 5). With
- * cold-store, `access_log` rows older than 30 days are archived rather
- * than deleted, so the TTL becomes effectively "forever". Keeping the
- * column would mean either (a) double-evicting rows or (b) silently
- * mismatching the new contract. Drop it.
- *
- * `down()` recreates `expires_at` with a default of `now() + 90 days`
- * — best effort; rows inserted between `up()` and a hypothetical
- * `down()` would not have meaningful retention bounds.
+ * `expires_at` drove a 90-day hard-delete sweep; cold-store archives `access_log` rows older
+ * than 30 days instead, so keeping the column would double-evict rows or contradict that
+ * contract. `down()` recreates it with a `now() + 90 days` default, best effort: rows inserted
+ * after `up()` get no meaningful retention bound.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/008_event_log_archived_at.d.ts

@@ -1,37 +1,22 @@
 import { type Kysely } from 'kysely';
 /**
- * `event_log` cold-store schema additions plus removal of the
- * `expires_at`-based 30-day hard delete.
+ * `event_log` cold-store schema: adds the `archived_at` /
+ * `archive_object_key` pair `007_audit_logs_archived_at.ts` added elsewhere
+ * (set inside the archive transaction before the DELETE; survivors carry
+ * NULL) and removes the `expires_at`-based 30-day hard delete.
  *
- * Part of the cold-storage archival system.
+ * `idx_event_log_routing_received` exists because the cold-store partitions
+ * `event_log` by `routing_key` (NOT NULL here, so no synthetic-tenant
+ * fallback); `event_log_org_received_idx` is keyed by `org_id` and does not
+ * serve the per-tenant archiver scan.
  *
- * Adds the same `archived_at TIMESTAMPTZ NULL` /
- * `archive_object_key TEXT NULL` pair
- * `007_audit_logs_archived_at.ts` added on this side. Set inside the archive
- * transaction before the DELETE; survivors carry NULL.
+ * Rows older than 30 days are now archived rather than deleted; the per-row
+ * `payload_key` blob is retained indefinitely so the dashboard
+ * delivery-detail page can still load the body of archived deliveries.
  *
- * Adds `idx_event_log_routing_received` on `(routing_key, received_at)`
- * because the orchestrator-side cold-store partitions `event_log` by
- * `routing_key` (NOT NULL on this table; no synthetic-tenant fallback
- * is needed). The existing `event_log_org_received_idx` is keyed by
- * `org_id`, fine for dashboard queries but not the per-tenant
- * archiver scan.
- *
- * Drops `event_log.expires_at` and the matching
- * `event_log_expires_at_idx` index. Before this migration, `expires_at`
- * powered the 30-day hard-delete sweep in
- * `packages/orchestrator/src/webhook/event-log.ts:cleanup`, called
- * from `packages/orchestrator/src/queue/cleanup.ts:runCleanup` step 4
- * (which also deleted the per-row `payload_key` blob from object
- * storage). With cold-store, rows older than 30 days are archived
- * rather than deleted; the per-row `payload_key` blob is retained
- * indefinitely so the dashboard delivery-detail page can still load
- * the body for archived deliveries.
- *
- * Per the project's "no backward compatibility (pre-release)" rule,
- * `down()` recreates `expires_at` with a default of `now() + 30 days`
- * — best effort; rows inserted between `up()` and a hypothetical
- * `down()` would not have meaningful retention bounds.
+ * `down()` recreates `expires_at` defaulting to `now() + 30 days` — best
+ * effort; rows inserted between `up()` and `down()` get no meaningful
+ * retention bound.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/009_access_log_trigram.d.ts

@@ -1,14 +1,10 @@
 import { type Kysely } from 'kysely';
 /**
- * Trigram (pg_trgm) index on access_log.error_message for the federated
- * Activity page's full-text search (`q` parameter).
+ * pg_trgm index on access_log.error_message for the Activity page's `q` search; matches the
+ * Platform's `008_audit_log_trigram.ts` (on `audit_log.details::text`).
  *
- * Matches the Platform counterpart in `008_audit_log_trigram.ts` which
- * indexes `audit_log.details::text`.
- *
- * Idempotent: `CREATE EXTENSION IF NOT EXISTS` and `CREATE INDEX IF NOT
- * EXISTS` are both safe to re-run. No CONCURRENTLY because Kysely runs
- * migrations inside a transaction; the lock is brief on a sampled table.
+ * Idempotent. No CONCURRENTLY because Kysely runs migrations inside a transaction; the lock is
+ * brief on a sampled table.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/010_cold_store_chunks.d.ts

@@ -1,33 +1,23 @@
 import { type Kysely } from 'kysely';
 /**
- * Cold-store chunk index (cold-store purge).
+ * Cold-store chunk index: one row per archived chunk the GC sweep can later
+ * purge from S3. Written in the `markArchivedAndDelete` transaction, so a chunk
+ * is fully recorded (S3 + index + rollup + audit) or fully absent.
  *
- * One row per archived chunk that the GC sweep can later purge from S3.
- * Inserted inside the same transaction as `markArchivedAndDelete` so a
- * chunk is either fully recorded (S3 + index + rollup + audit) or fully
- * absent (no orphan rows).
+ * - `chunk_id` is the deterministic 16-hex chunk filename stem; the primary key
+ *   `(db, table_name, chunk_id)` lets the framework `DELETE` without scanning.
+ *   `db` is always `'orchestrator'` here, for shape parity with
+ *   `cold_store_chunk_counts` and the Platform-side migration.
+ * - `bucket` is the S3 prefix segment (`'30d'` / `'180d'` / `'1y'` / `'2y'` /
+ *   `'forever'`), for `cold-store list-chunks` / `list-purgeable` filtering.
+ * - `max_cold_days` is the row-level retention horizon, TEXT to hold numbers
+ *   and `'forever'`. The GC sweep checks `max_cold_days != 'forever' AND
+ *   now() > archived_at + (max_cold_days || ' days')::interval`.
+ * - `object_key` is the chunk's full S3 key, so the GC sweep calls
+ *   `DeleteObject` without recomputing it.
  *
- * Schema notes:
- *
- * - `chunk_id` is the deterministic 16-hex chunk filename stem; primary
- *   key is `(db, table_name, chunk_id)` so the framework can `DELETE`
- *   without scanning. The `db` column matches `cold_store_chunk_counts`
- *   (always `'orchestrator'` here, included for shape parity with the
- *   Platform-side migration).
- * - `bucket` is the S3 prefix segment (`'30d'` / `'180d'` / `'1y'` /
- *   `'2y'` / `'forever'`). Carried for `cold-store list-chunks` /
- *   `list-purgeable` filtering.
- * - `max_cold_days` is the row-level retention horizon — TEXT to
- *   accommodate both numeric values and the literal `'forever'`. The
- *   GC sweep checks `max_cold_days != 'forever' AND now() > archived_at
- *   + (max_cold_days || ' days')::interval`.
- * - `object_key` is the full S3 key of the data chunk; the GC sweep
- *   uses this to issue `DeleteObject` directly without recomputing the
- *   key from the prefix.
- *
- * V1-manifest chunks are NOT in this table — they live
- * forever. Adapters that don't opt into per-bucket archival via
- * `coldTtlDays` don't insert here either.
+ * V1-manifest chunks are NOT here — they live forever — nor are chunks from
+ * adapters that do not opt into per-bucket archival via `coldTtlDays`.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/011_drop_source_secrets_notify.d.ts

@@ -1,20 +1,12 @@
 import { type Kysely } from 'kysely';
 /**
- * Drop the `source_secrets_change_trigger` and the
- * `notify_source_secrets_change()` plpgsql function.
+ * Drops `source_secrets_change_trigger` and `notify_source_secrets_change()`. Their only
+ * LISTEN/NOTIFY consumer, `WebhookSecretManager`, pushed webhook secrets to the Platform; the
+ * orchestrator now never sends secret material there (the Platform asks it to verify each
+ * webhook, reading `PgSecretStore`), so the NOTIFY traffic has no listener.
  *
- * Both were used by the (now removed) `WebhookSecretManager` which
- * subscribed via LISTEN/NOTIFY to detect changes to webhook secret rows in
- * `scoped_secrets` and pushed them to the multi-tenant Platform via the
- * `source.secrets` WS message. After the chunked-relay cutover the
- * orchestrator never pushes secret material to Platform -- Platform asks
- * the orchestrator to verify each inbound webhook on demand and the
- * verifier reads secrets directly from `PgSecretStore` -- so the trigger
- * is dead code and only emits NOTIFY traffic that nobody listens to.
- *
- * `down` re-creates the function + trigger as they were originally defined
- * in `001_initial.ts`. They wake up no consumer until the `WebhookSecretManager`
- * is restored, so this migration is safe to roll back.
+ * `down` re-creates both as defined in `001_initial.ts`; they wake no consumer, so the
+ * rollback is safe.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/012_peer_credentials_active_uniq.d.ts

@@ -4,22 +4,17 @@ import { type Kysely } from 'kysely';
  * revoked_at IS NULL` so two ACTIVE rows for the same `instance_id` become a
  * database-level impossibility.
  *
- * Background: `PeerCredentialStore.save()` historically ran an `UPDATE …
- * SET revoked_at = NOW()` followed by an `INSERT` without a transaction or
- * unique constraint. When a joining peer fanned out N peer-clients in
- * parallel (one per coordinator), each coordinator's `save()` could run its
- * `UPDATE` before the others' `INSERT`s committed — both `UPDATE`s revoked
- * nothing and both `INSERT`s succeeded, leaving 2+ ACTIVE rows for the same
- * `instance_id`. The peer's local credential file then ended up holding a
- * hash that a later concurrent `save()` had revoked, causing an endless
- * "Peer HMAC proof invalid" loop.
+ * Why: `PeerCredentialStore.save()` ran an unguarded `UPDATE … SET revoked_at
+ * = NOW()` then `INSERT` (no transaction, no constraint), which races when a
+ * joining peer fans out one peer-client per coordinator: both `UPDATE`s revoke
+ * nothing, both `INSERT`s land, and the peer's credential file can hold a hash
+ * a concurrent `save()` revoked — an endless "Peer HMAC proof invalid" loop.
  *
- * The `up()` first dedupes any pre-existing duplicates (revoke all but the
- * newest active row per `instance_id`) — required because earlier migrations
- * predate the constraint and existing databases may already hold the dupes.
+ * `up()` first dedupes existing duplicates (revokes all but the newest active
+ * row per `instance_id`), which databases from before the constraint may hold.
  *
- * `down()` only drops the index; it does NOT undo the dedupe (there's no
- * safe way to recreate revoked rows, and the dedupe is monotonic).
+ * `down()` only drops the index; it does NOT undo the dedupe (revoked rows
+ * cannot be safely recreated, and the dedupe is monotonic).
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;