@kici-dev/orchestrator 0.17.0 → 0.19.0

package/dist/db/migrations/013_execution_log_bytes.d.ts

@@ -1,20 +1,12 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `log_bytes BIGINT NOT NULL DEFAULT 0` columns to `execution_runs` and
- * `execution_jobs` so the orchestrator can persist the per-job and per-run
- * raw log byte totals reported by agents on terminal `step.status`.
+ * Per-run and per-job raw log byte totals, reported by agents on terminal `step.status`.
  *
- * Used by the operator-side `kici_org_log_bytes` capacity-planning gauge on
- * the Platform (Platform mirrors these columns via WS replication and runs
- * the aggregation query — same DB-derived pattern as
- * `kici_org_executions_count` and `kici_org_agent_minutes`).
+ * The Platform mirrors these columns via WS replication for its `kici_org_log_bytes` gauge
+ * (the DB-derived pattern of `kici_org_executions_count` and `kici_org_agent_minutes`).
  *
- * Default 0 keeps existing rows valid without a backfill: pre-existing runs
- * predate this column and report as zero log-bytes, which is the correct
- * operator-visibility value (we never had the agent telemetry to compute a
- * real total for them).
- *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`).
+ * Default 0 needs no backfill: older runs never had the agent telemetry, so zero is correct.
+ * Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/014_kici_events_lease_retry.d.ts

@@ -1,35 +1,22 @@
 import { type Kysely } from 'kysely';
 /**
- * Add lease + retry + DLQ columns to `kici_events` so the EventRouter can
- * deliver events at-least-once with bounded retries and a visible
- * dead-letter queue.
+ * Lease + retry + DLQ columns on `kici_events`, so the EventRouter delivers
+ * events at-least-once with bounded retries and a visible dead-letter queue.
+ * Marking a row processed before dispatch lost the event when
+ * `onEventMatched` threw, and a crash between the cron fire claim and the
+ * event write advanced `cron_last_fired.last_fired_at` with no event row.
  *
- * Before this migration, EventRouter used `claimForProcessing` (UPDATE
- * processed=true WHERE processed=false RETURNING *) and dispatched after
- * the row was already marked processed. If `onEventMatched` threw, the
- * event was silently lost. Same loss surface for cron fires, since
- * `tryClaimFire` and `eventStore.write` were two separate transactions:
- * a crash between them advanced `cron_last_fired.last_fired_at` without
- * persisting the event row.
- *
- * After this migration:
- *  - `claimed_at`, `claimed_by`: lease-based claim. Replaces the
- *    "flip processed=true upfront" pattern. A lease is taken on dispatch,
- *    released on success (processed=true) or failure (cleared + retry scheduled).
- *  - `attempts`: incremented on each lease attempt. Enables bounded retry.
- *  - `last_error`: most recent dispatch failure message (truncated by
- *    application code to 4 KB).
- *  - `next_retry_at`: earliest moment the leader-only retry scanner should
- *    re-publish `pg_notify` for this event.
- *  - `dlq_at`, `dlq_reason`: terminal DLQ marker. Once `dlq_at IS NOT NULL`
- *    the row is no longer eligible for lease/retry. Surfaced in the
+ *  - `claimed_at`, `claimed_by`: a lease taken on dispatch, released on
+ *    success (processed=true) or failure (cleared + retry scheduled).
+ *  - `attempts`: incremented per lease attempt; bounds retries.
+ *  - `last_error`: latest dispatch failure (truncated by the app to 4 KB).
+ *  - `next_retry_at`: earliest moment the leader-only retry scanner
+ *    re-publishes `pg_notify` for this event.
+ *  - `dlq_at`, `dlq_reason`: terminal DLQ marker; a row with
+ *    `dlq_at IS NOT NULL` is never leased or retried again. Shown on the
  *    dashboard admin DLQ page.
  *
- * Partial indexes keep these new lookups cheap without blowing up the index
- * size on the hot path (most rows are processed=true and irrelevant to the
- * scanner).
- *
- * Idempotent (`ADD COLUMN IF NOT EXISTS` + `CREATE INDEX IF NOT EXISTS`).
+ * Partial indexes skip the hot-path processed=true rows. Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/015_org_settings_customer_scoped.d.ts

@@ -2,28 +2,23 @@ import { type Kysely } from 'kysely';
 /**
  * Org-scope `org_settings` and qualify each glob entry by source.
  *
- * `org_settings` was keyed by `routing_key`, meaning each webhook
- * source had its own independent global-workflow configuration. With multi-
- * source orgs, the dashboard's per-org settings page only ever showed the
- * first source it found and silently hid the rest.
- *
- * This migration:
+ * A `routing_key`-keyed table gave each webhook source its own
+ * global-workflow config, and the per-org dashboard page showed only the
+ * first source of a multi-source org.
  *
  *   1. Adds a `customer_id text` column.
  *   2. Backfills `customer_id` from `sources` / `generic_webhook_sources` by
- *      `routing_key`. Rows whose `routing_key` cannot be resolved (orphans
- *      from deleted sources) are dropped — they were already unreachable.
+ *      `routing_key`. Unresolvable rows (orphans from deleted sources) are
+ *      dropped — they were already unreachable.
  *   3. Converts the three repo-list `text[]` columns to `jsonb` arrays of
- *      `{routingKey?: string, pattern: string}` entries. Each existing entry
- *      is qualified with its original `routing_key` so semantics are preserved
- *      verbatim — a glob that previously only saw events on `github:42` still
- *      only sees events on `github:42`.
- *   4. Merges rows by `customer_id`. `global_workflows_enabled` collapses with
- *      logical OR; the three list columns concatenate.
- *   5. Drops the old `routing_key` column and PK; new PK is `customer_id`.
+ *      `{routingKey?: string, pattern: string}`. Each entry is qualified with
+ *      its original `routing_key`, so a glob that saw only `github:42` events
+ *      still sees only `github:42` events.
+ *   4. Merges rows by `customer_id`: `global_workflows_enabled` is OR-ed, the
+ *      list columns concatenate.
+ *   5. Drops the `routing_key` column and PK; the new PK is `customer_id`.
  *
- * Idempotent: a re-run on an already-migrated DB sees `customer_id` exists
- * and the list columns are already jsonb, so it is a no-op.
+ * Idempotent: an existing `customer_id` column makes a re-run a no-op.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/016_org_settings_allow_http_npm.d.ts

@@ -2,13 +2,11 @@ import { type Kysely } from 'kysely';
 /**
  * Add `org_settings.allow_http_npm_registries boolean NOT NULL DEFAULT false`.
  *
- * Operators flip this on a per-org basis to permit `http://` (non-HTTPS)
- * registry URLs in workflow `registries:` declarations. By default only
- * `https://` registries are accepted, with an automatic exemption for
- * loopback / `*.local` / private link-local hosts so a local registry
- * (for example `http://registry.local:4873`) keeps working.
+ * Per-org opt-in for `http://` registry URLs in workflow `registries:`. Otherwise only
+ * `https://` is accepted, except loopback / `*.local` / private link-local hosts, so a local
+ * registry (for example `http://registry.local:4873`) keeps working.
  *
- * Idempotent: a re-run on a DB that already has the column is a no-op.
+ * Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/019_generic_sources_change_notify.d.ts

@@ -1,24 +1,20 @@
 import { type Kysely } from 'kysely';
 /**
- * Add a Postgres trigger on `generic_webhook_sources` that emits
- * `pg_notify('generic_sources_change', routing_key)` on every INSERT,
- * UPDATE, and DELETE. Soft-deletes (UPDATE that sets `deleted_at`) ride
- * the same UPDATE path — the listener treats a row with `deleted_at IS
- * NOT NULL` (or a row that no longer exists for that routing_key) as a
- * de-registration signal.
+ * Add a trigger on `generic_webhook_sources` that emits
+ * `pg_notify('generic_sources_change', routing_key)` on every INSERT, UPDATE
+ * and DELETE. A soft-delete (UPDATE setting `deleted_at`) rides the UPDATE
+ * path; the listener reads `deleted_at IS NOT NULL` or a missing row as
+ * de-registration.
  *
- * The consumer is `GenericSourcesChangeListener`
- * (`packages/orchestrator/src/webhook/generic-sources-listener.ts`),
- * which runs in every orchestrator peer, LISTENs on the channel, and
- * mutates the local `ProviderRegistry` in place
- * (`registerProviderBundleForSource` for INSERT/UPDATE; `unregister` for
- * DELETE / soft-delete). Without this round-trip, peers other than the
- * one that handled `kici-admin source add generic` would 404 incoming
- * webhooks until restart.
+ * `GenericSourcesChangeListener`
+ * (`packages/orchestrator/src/webhook/generic-sources-listener.ts`) LISTENs in
+ * every peer and updates its local `ProviderRegistry`
+ * (`registerProviderBundleForSource` / `unregister`). Without it, peers other
+ * than the one that ran `kici-admin source add generic` 404 the webhooks until
+ * restart.
  *
- * Mirrors the existing GitHub-app `sources` trigger
- * (`notify_sources_change()` + `sources_change_trigger`, defined in
- * `001_initial.ts`).
+ * Mirrors the GitHub-app `sources` trigger (`notify_sources_change()` +
+ * `sources_change_trigger` in `001_initial.ts`).
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/020_org_settings_dashboard_write_policy.d.ts

@@ -2,15 +2,12 @@ import { type Kysely } from 'kysely';
 /**
  * Add `org_settings.dashboard_write_policy jsonb NOT NULL DEFAULT '{}'`.
  *
- * Stores the per-customer policy that decides which Platform-routed
- * dashboard.* write operations the orchestrator accepts. An empty
- * JSONB object means everything is enabled (permissive default). To
- * disable an operation, set its key to `false`, e.g.
- * `{"secrets.set": false, "variables.set": false}`. Unknown / missing
- * keys are treated as `true` by the resolver in
- * `@kici-dev/engine/protocol/dashboard-write-operations`.
+ * Per-customer policy for which Platform-routed dashboard.* write operations the orchestrator
+ * accepts. A key set to `false` disables that operation (e.g. `{"secrets.set": false}`);
+ * missing keys resolve to `true` in `@kici-dev/engine/protocol/dashboard-write-operations`, so
+ * `{}` enables everything.
  *
- * Idempotent: a re-run on a DB that already has the column is a no-op.
+ * Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/021_check_run_tracking.d.ts

@@ -1,23 +1,11 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `check_run_tracking` table for HA-safe check-run state persistence.
+ * `check_run_tracking`: `CheckRunReporter` state keyed per (provider, owner, repo, sha,
+ * check_name). Per-process maps reset on a replacement coord (Raft leader switch / coord crash)
+ * and left GitHub check runs stuck in `queued` forever. `run_id` is indexed for cleanup.
  *
- * The `CommitStatusReporter` previously held all of its check-run bookkeeping
- * in per-process `Map`s. Under HA (Raft leader switch / coord crash) those
- * maps reset to empty on the replacement coord, leaving GitHub check runs
- * stuck in `queued` forever.
- *
- * Single composite-keyed table per (provider, owner, repo, sha, check_name):
- *
- *   - `check_run_id`            replaces in-memory `checkRunIds`.
- *   - `build_creation_state`    replaces `pendingBuildCreations` Promise map.
- *   - `step_progress_json`      replaces `stepProgress` array map.
- *   - `in_progress_sent_at`     replaces `inProgressSent` boolean map.
- *   - `run_id`                  indexed; replaces `runIdToKeys` reverse map.
- *
- * Progress-timer debounce state (the `progressTimers` Map) is NOT persisted —
- * timers are recreated on demand when an update arrives and the row's
- * `updated_at` is older than the debounce window.
+ * Progress-timer debounce state is NOT persisted: a timer is recreated when an update arrives
+ * and the row's `updated_at` is older than the debounce window.
  *
  * Idempotent: a re-run on a DB that already has the table is a no-op.
  */

package/dist/db/migrations/022_scaler_manager_state.d.ts

@@ -1,28 +1,18 @@
 import { type Kysely } from 'kysely';
 /**
- * Add three tables persisting `ScalerManager` per-coord state:
+ * Persists `ScalerManager` per-coord state:
  *
- *  - `scaler_spawning_agents`: agents spawned via Docker/Podman/Firecracker
- *    that have not yet registered via WS. Carries the `bound_job_id` so a
- *    replacement coord still issues the eager-dispatch hop on register.
+ *  - `scaler_spawning_agents`: spawned agents not yet registered via WS. `bound_job_id` lets a
+ *    replacement coord still issue the eager-dispatch hop on register.
+ *  - `scaler_agent_jobs`: agentId → (runId, jobId) for scaler-lifecycle event routing; inserted
+ *    on `correlateAgentToJob`, deleted on disconnect / job completion.
+ *  - `scaler_reservations`: outstanding reservations by agentId. Usage counters are derived,
+ *    recomputed on coord boot as `SUM(...) GROUP BY scaler_name`, so the cap check stays correct.
  *
- *  - `scaler_agent_jobs`: agentId → (runId, jobId) correlation for
- *    scaler-lifecycle event routing. Inserted on `correlateAgentToJob`,
- *    deleted on disconnect / job completion.
+ * Without them a coord crash mid-spawn orphans the agent, strands the reservation until backend
+ * GC disconnects the WS minutes later, and leaves a hole in the run timeline.
  *
- *  - `scaler_reservations`: outstanding resource reservations keyed by
- *    agentId. Per-scaler / global usage counters are derived state —
- *    recomputed on coord boot as `SUM(...) GROUP BY scaler_name` so the
- *    cap-check critical section stays correct.
- *
- * Without these tables, a coord crash mid-spawn orphans the agent (eager
- * dispatch lost), strands the reservation (resource leak until backend
- * GC eventually disconnects the WS, minutes later), and loses every
- * scaler-lifecycle event emitted before correlation (execution-tracker
- * sees a hole in the run timeline).
- *
- * Idempotent: a re-run on a DB that already has any of these tables
- * leaves the existing one alone.
+ * Idempotent: an existing table is left alone.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/023_dispatch_queue_recovery_deadline.d.ts

@@ -1,25 +1,14 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `dispatch_queue.recovery_deadline TIMESTAMPTZ` and
- * `dispatch_queue.recovery_agent_id TEXT` columns persisting per-job
- * recovery state for HA-safe agent-disconnect handling.
+ * Persists per-job agent-disconnect recovery state, so a coord crash between starting the
+ * recovery timer and its firing cannot leave a `recovering` job with no deadline or owning
+ * agent, lingering forever.
  *
- * `Dispatcher.recoveringJobs` previously held the timer handle, agent
- * ID, and deadline entirely in process memory. A coord crash between
- * starting the timer and it firing dropped the timer; the replacement
- * coord saw the row as `status='recovering'` but had no record of when
- * the deadline expired or which agent owned the job. Jobs lingered
- * forever.
+ * A leader-gated sweep (`Dispatcher.sweepExpiredRecoveries`) fails rows matching
+ * `WHERE status='recovering' AND recovery_deadline < now()`; on coord boot
+ * `Dispatcher.recoverState()` re-creates the timers from the persisted deadlines.
  *
- * The new columns make the deadline durable. A leader-gated sweep
- * (`Dispatcher.sweepExpiredRecoveries`) scans
- * `WHERE status='recovering' AND recovery_deadline < now()` and marks
- * each row failed; on coord boot, `Dispatcher.recoverState()`
- * hydrates the in-memory Map by re-creating timers from the persisted
- * deadlines.
- *
- * Idempotent: re-running on a DB that already has either column is a
- * no-op.
+ * Idempotent: an existing column is a no-op.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/024_dispatch_queue_provisioning_error.d.ts

@@ -1,17 +1,11 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `dispatch_queue.last_provisioning_error TEXT` recording the most
- * recent scaler spawn-failure detail for a queued job.
+ * `dispatch_queue.last_provisioning_error`: the latest scaler spawn-failure detail for a queued
+ * job, written by a job-bound `scaler.failed` event (e.g. "spawn node ENOENT"). The
+ * queue-timeout reaper surfaces it instead of a bare "no agent available" timeout. Cleared on
+ * dispatch; NULL when no failure is recorded.
  *
- * When the scaler fails to provision an agent for a job (e.g. the agent
- * process exits with "spawn node ENOENT", or a container backend rejects
- * the run), a `scaler.failed` event bound to the job writes the failure
- * detail into this column. The queue-timeout reaper reads it so the job's
- * eventual failure surfaces the real provisioning cause instead of a bare
- * "no agent available" timeout. The column is cleared on dispatch and is
- * NULL whenever no provisioning failure has been recorded.
- *
- * Idempotent: re-running on a DB that already has the column is a no-op.
+ * Idempotent: an existing column is a no-op.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/025_init_failure.d.ts

@@ -1,15 +1,11 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `init_failure jsonb` columns to `execution_runs` and `execution_jobs`.
+ * `init_failure` on `execution_runs` / `execution_jobs`: non-NULL means the run/job never
+ * executed a step because of an init-phase failure. Shape: `InitFailure` from
+ * `@kici-dev/engine`. The dashboard reads it directly, so it renders the banner without a
+ * round-trip to a possibly offline orchestrator.
  *
- * Presence of this column on a row means the run/job never executed a step
- * because of an init-phase failure; absence (NULL) means a normal run.
- * Shape on the wire is `InitFailure` from `@kici-dev/engine`. The dashboard
- * reads this column directly so it can render the right banner without
- * round-tripping to the orchestrator (which may be offline).
- *
- * Idempotent: re-running on a DB that already has either column is a no-op
- * for that column.
+ * Idempotent per column.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/027_workflow_timeout.d.ts

@@ -1,19 +1,11 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `workflow_timeout_ms integer` to `execution_runs`.
+ * Add `execution_runs.workflow_timeout_ms`: the lock workflow's wall-clock timeout (ms), read at
+ * run creation; NULL means no cap. The WorkflowDeadlineDetector cancels runs past
+ * `started_at + workflow_timeout_ms` with the distinct workflow-timeout reason.
  *
- * Persists the workflow-level wall-clock timeout (in milliseconds) read from
- * the lock workflow at run creation. NULL means no workflow-level cap is
- * configured. The WorkflowDeadlineDetector reads this column to find runs
- * whose `started_at + workflow_timeout_ms` has passed and cancels them with
- * the distinct workflow-timeout reason.
- *
- * Typed INTEGER to match the existing `*_ms` columns (`duration_ms`,
- * `concurrency_timeout_ms`), which keeps the pg read representation a plain
- * number rather than the BIGINT-as-string shape. INTEGER caps the timeout at
- * ~24.8 days, far beyond any sane workflow wall-clock budget.
- *
- * Idempotent: re-running on a DB that already has the column is a no-op.
+ * INTEGER like the other `*_ms` columns, so pg reads a plain number rather than a BIGINT string;
+ * it caps the timeout at ~24.8 days. Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/029_dispatch_queue_attempts.d.ts

@@ -1,15 +1,9 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `dispatch_queue.dispatch_attempts INT NOT NULL DEFAULT 0`.
- *
- * Counts how many times a job has been returned to `pending` for
- * re-dispatch after a failed delivery attempt (agent sent job.reject, or
- * a scaler-managed agent disconnected before the job started). The
- * dispatcher fails the job permanently once the counter reaches
- * MAX_DISPATCH_ATTEMPTS, bounding requeue loops; `expires_at` remains the
- * time-based backstop.
- *
- * Idempotent: re-running on a DB that already has the column is a no-op.
+ * Add `dispatch_queue.dispatch_attempts`: how often a job returned to `pending` after a failed
+ * delivery (job.reject, or a scaler-managed agent disconnecting before start). The dispatcher
+ * fails the job at MAX_DISPATCH_ATTEMPTS, bounding requeue loops; `expires_at` stays the
+ * time-based backstop. Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/030_held_runs_env_set_null.d.ts

@@ -1,12 +1,11 @@
 import { type Kysely } from 'kysely';
 /**
- * held_runs.environment_id becomes nullable with ON DELETE SET NULL so
- * terminal held-run history survives environment deletion (a null
- * environment_id means the environment was since deleted). Pending held
- * runs still block deletion — enforced in EnvironmentStore.delete.
+ * held_runs.environment_id becomes nullable with ON DELETE SET NULL, so
+ * terminal held-run history survives environment deletion (null = deleted
+ * since). Pending held runs still block deletion, in EnvironmentStore.delete.
  *
- * Idempotent: dropping the NOT NULL and the constraint are both no-ops on a
- * re-run, and the constraint is re-created with the SET NULL action.
+ * Idempotent: both drops are no-ops on a re-run, and the constraint is
+ * re-created with the SET NULL action.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/031_dispatch_queue_ack_deadline.d.ts

@@ -1,18 +1,12 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `dispatch_queue.ack_deadline TIMESTAMPTZ` and
- * `dispatch_queue.ack_agent_id TEXT` persisting the per-dispatch
- * acknowledgment deadline for HA-safe lost-dispatch detection.
+ * Add `dispatch_queue.ack_deadline` / `ack_agent_id`: the persisted per-dispatch ack deadline
+ * for HA-safe lost-dispatch detection.
  *
- * The dispatcher stamps both when a job.dispatch is sent and clears them
- * when the agent answers (job.ack / job.reject / job.status running). A
- * `dispatched` row past its deadline is requeued — by the owning coord's
- * in-memory timer, or by the leader-gated sweep
- * (`Dispatcher.sweepExpiredAckDeadlines`) when the owning coord crashed.
- * On coord boot, `Dispatcher.recoverState()` re-arms timers from the
- * persisted deadlines.
- *
- * Idempotent: re-running on a DB that already has either column is a no-op.
+ * Stamped on job.dispatch, cleared on the agent's answer (job.ack / job.reject / job.status
+ * running). A `dispatched` row past its deadline is requeued by the owning coord's timer, or by
+ * the leader-gated `Dispatcher.sweepExpiredAckDeadlines` when that coord crashed;
+ * `Dispatcher.recoverState()` re-arms timers on coord boot. Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/033_org_settings_approval.d.ts

@@ -1,18 +1,15 @@
 import { type Kysely } from 'kysely';
 /**
- * Add the two approval-policy columns to `org_settings`:
+ * Add the approval-policy columns to `org_settings`:
  *
  * - `approval_expiry_seconds INTEGER NOT NULL DEFAULT 86400` — how long a held
- *   approval element waits before it expires (and its run/job/step is
- *   rejected). One day by default. An SDK `requireApproval` `timeout` overrides
- *   this per element; otherwise this per-org value applies.
- * - `allow_self_approval BOOLEAN NOT NULL DEFAULT true` — whether the user who
- *   triggered a run may also approve its held elements. Operators turn it off
- *   to enforce four-eyes review.
+ *   approval element waits before it expires and its run/job/step is rejected.
+ *   An SDK `requireApproval` `timeout` overrides it per element.
+ * - `allow_self_approval BOOLEAN NOT NULL DEFAULT true` — whether a run's
+ *   triggering user may approve its held elements; off enforces four-eyes review.
  *
- * Both are cluster-configurable per org via `kici-admin org-settings approval`
- * and the orchestrator admin route. Idempotent: a re-run on a DB that already
- * has the columns is a no-op (each column is guarded independently).
+ * Set per org via `kici-admin org-settings approval` and the orchestrator admin
+ * route. Idempotent: each column is guarded independently.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/034_held_runs_generalize.d.ts

@@ -1,23 +1,15 @@
 import { type Kysely } from 'kysely';
 /**
- * Generalize `held_runs` from an environment-only hold into the unified
- * "held element" model that backs per-element approvals, and add the
- * `held_run_approvals` table that records each approver's decision.
- *
- * New `held_runs` columns (all idempotent, column-exists guarded):
- * - `hold_scope text NOT NULL DEFAULT 'job'` — 'workflow' | 'job' | 'step'
- *   (engine `HoldScope`). Existing rows held a single job, so they default to
- *   'job'.
- * - `step_index integer` — nullable; set only for step-scoped holds.
- * - `trigger_source text NOT NULL DEFAULT 'environment'` — 'environment' |
- *   'explicit' (engine `TriggerSource`). Existing holds came from environment
- *   protection, so they default to 'environment'.
- * - `approval_requirement jsonb` — the normalized `ApprovalRequirement`
- *   (clauses + expiresAt + reason) the hold must satisfy. Nullable for legacy
- *   rows that predate the approval model.
- *
- * New `held_run_approvals` table: one row per approver decision, FK to
- * `held_runs.id` (uuid) with ON DELETE CASCADE.
+ * Generalize `held_runs` from an environment-only hold into the "held element" model behind
+ * per-element approvals, and add `held_run_approvals` (one row per approver decision,
+ * ON DELETE CASCADE). Columns are added idempotently, column-exists guarded:
+ * - `hold_scope` — 'workflow' | 'job' | 'step' (engine `HoldScope`); existing rows held a
+ *   single job, so they default to 'job'.
+ * - `step_index` — set only for step-scoped holds.
+ * - `trigger_source` — 'environment' | 'explicit' (engine `TriggerSource`); existing holds came
+ *   from environment protection, so they default to 'environment'.
+ * - `approval_requirement` — the normalized `ApprovalRequirement` (clauses + expiresAt +
+ *   reason); NULL on rows that predate the approval model.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/035_pending_workflow_contexts.d.ts

@@ -1,10 +1,9 @@
 import { type Kysely } from 'kysely';
 /**
- * Pending workflow dispatch context — backs resume of a workflow whose install
- * gate held. One row per held run: the serializable dispatch inputs needed to
- * rebuild the WorkflowDispatchContext when the hold releases (reviewer approve,
- * wait-timer expiry, concurrency slot free). The row is deleted once the resume
- * dispatch has been kicked off.
+ * Pending workflow dispatch context, for resuming a workflow whose install gate
+ * held. One row per held run holds the serializable inputs that rebuild the
+ * WorkflowDispatchContext when the hold releases (reviewer approve, wait-timer
+ * expiry, free concurrency slot); it is deleted once the resume dispatch starts.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/037_generic_sources_provider_type_local.d.ts

@@ -4,12 +4,11 @@ import { type Kysely } from 'kysely';
  * permits `'local'` instead of `'internal'`, and migrate any carried-over
  * `'internal'` rows to `'local'`.
  *
- * The local filesystem (`file://`) provider is `provider_type='local'`; the
- * value used to be `'internal'`. The original CHECK constraint
- * (`generic_webhook_sources_provider_type_check`) allowed only
- * `{'generic','internal'}`, so writing a `'local'` row fails. Universal-git
- * sources keep `provider_type='generic'` (discriminated by `git_config`), so
- * the new allowed set is `{'generic','local'}`.
+ * The local filesystem (`file://`) provider is `provider_type='local'`, which
+ * the original `generic_webhook_sources_provider_type_check`
+ * (`{'generic','internal'}`) rejects. Universal-git sources keep
+ * `provider_type='generic'` (discriminated by `git_config`), so the new allowed
+ * set is `{'generic','local'}`.
  *
  * Idempotent: the constraint is dropped IF EXISTS and recreated; the data
  * backfill is a plain UPDATE that is a no-op once no `'internal'` rows remain.

package/dist/db/migrations/038_remote_sources.d.ts

@@ -1,13 +1,11 @@
 import { type Kysely } from 'kysely';
 /**
- * `remote_sources` anchors a Platform-relayed `kici run remote` to its real
- * org. One row per org served by this orchestrator: routing key
- * `remote:<orgId>` maps to the canonical org id, so `resolveOrgId` resolves
- * the real tenant through the same local-source path a webhook takes — no
- * GitHub App, no webhook secret, no manual setup. The row is auto-provisioned
- * on Platform auth from the canonical org id carried on `auth.success`.
+ * `remote_sources` anchors a Platform-relayed `kici run remote` to its real org: one row per
+ * served org maps `remote:<orgId>` to the canonical org id, so `resolveOrgId` takes the
+ * webhook's local-source path with no GitHub App, webhook secret or manual setup.
+ * Auto-provisioned on Platform auth from the org id on `auth.success`.
  *
- * Idempotent: a re-run on a DB that already has the table is a no-op.
+ * Idempotent: an existing table is a no-op.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/045_host_properties.d.ts

@@ -1,15 +1,11 @@
 import { type Kysely } from 'kysely';
 /**
- * Add the typed host-vars dimension to the host roster:
+ * `host_roster.host_properties jsonb NOT NULL DEFAULT '{}'`: the typed host-vars
+ * bag (`string | number | boolean` values) the agent reports at registration
+ * and/or the operator declares (`kici-admin host declare --prop`). Labels stay
+ * the flat-string grouping dimension; properties are a separate queryable one.
  *
- * - `host_roster.host_properties jsonb NOT NULL DEFAULT '{}'` — the typed
- *   property bag (`string | number | boolean` values) reported by the agent at
- *   registration and/or declared by the operator (`kici-admin host declare
- *   --prop`). Labels stay the flat-string grouping dimension; properties are
- *   the separate queryable host-vars dimension.
- *
- * Idempotent (`ADD COLUMN IF NOT EXISTS`): re-running on a DB that already has
- * the column is a no-op. Existing data is preserved (additive column).
+ * Idempotent and additive.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;