@oisincoveney/pipeline 3.15.6 → 3.16.0

package/dist/argo-submit.d.ts

@@ -5,6 +5,15 @@ import { z } from "zod";
 
 //#region src/argo-submit.d.ts
 declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
+  brokerAuth: z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+    url: z.ZodDefault<z.ZodString>;
+  }, z.core.$strict>;
+  dbAuth: z.ZodOptional<z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+  }, z.core.$strict>>;
   eventAuthSecretKey: z.ZodOptional<z.ZodString>;
   eventAuthSecretName: z.ZodOptional<z.ZodString>;
   generateName: z.ZodOptional<z.ZodString>;
@@ -20,11 +29,6 @@ declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
-  brokerAuth: z.ZodObject<{
-    secretKey: z.ZodDefault<z.ZodString>;
-    secretName: z.ZodString;
-    url: z.ZodDefault<z.ZodString>;
-  }, z.core.$strict>;
   payloadJson: z.ZodString;
   scheduleYaml: z.ZodString;
   serviceAccountName: z.ZodOptional<z.ZodString>;

package/dist/argo-submit.js

@@ -1,4 +1,5 @@
 import { ArgoGraphCompilerError, compileArgoExecutionGraph } from "./argo-graph.js";
+import { dbAuthOptionSchema } from "./remote/argo/model.js";
 import { brokerAuthOptionSchema } from "./credentials/broker.js";
 import { compileScheduleArtifact, parseScheduleArtifact } from "./planning/generate.js";
 import { parseRunnerCommandPayload, runnerCommandPayloadSchema } from "./runner-command-contract.js";
@@ -24,6 +25,8 @@ const configMapSchema = z.object({
 	}).strict()
 }).strict();
 const submitRunnerArgoWorkflowOptionsSchema = z.object({
+	brokerAuth: brokerAuthOptionSchema,
+	dbAuth: dbAuthOptionSchema.optional(),
 	eventAuthSecretKey: z.string().min(1).optional(),
 	eventAuthSecretName: z.string().min(1).optional(),
 	generateName: z.string().min(1).optional(),
@@ -39,7 +42,6 @@ const submitRunnerArgoWorkflowOptionsSchema = z.object({
 	kubeconfigPath: z.string().min(1).optional(),
 	name: z.string().min(1).optional(),
 	namespace: z.string().min(1),
-	brokerAuth: brokerAuthOptionSchema,
 	payloadJson: z.string().min(1),
 	scheduleYaml: z.string().min(1),
 	serviceAccountName: z.string().min(1).optional()
@@ -78,6 +80,8 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 			"pipeline.oisin.dev/ticket-project": payload.run.project,
 			"pipeline.oisin.dev/ticket-title": payload.task.title
 		} : {},
+		brokerAuth: options.brokerAuth,
+		dbAuth: options.dbAuth,
 		eventAuthSecretKey: options.eventAuthSecretKey,
 		eventAuthSecretName: options.eventAuthSecretName,
 		generateName: options.generateName,
@@ -89,7 +93,6 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		labels,
 		name: options.name,
 		namespace: options.namespace,
-		brokerAuth: options.brokerAuth,
 		payloadConfigMapName,
 		plan: compiled.plan,
 		scheduleConfigMapName: scheduleArtifactConfigMapName,

package/dist/cli/program.js

@@ -4,13 +4,13 @@ import { registerBenchCommand } from "../commands/bench-command.js";
 import { registerConfiguredEntrypointCommands } from "../commands/pipeline-command.js";
 import { registerRunnerCommandCommand } from "../commands/runner-command-command.js";
 import { registerTicketCommand } from "../commands/ticket-command.js";
+import { addMokaSubmitOptions, runMokaSubmitFromCli } from "./submit-options.js";
 import { registerRunControlCommands } from "../run-control/commands.js";
 import { registerBootstrapCommands } from "./bootstrap-commands.js";
 import { registerLoopCommand } from "./loop-commands.js";
 import { registerMcpGatewayCommands } from "./mcp-gateway-commands.js";
 import { registerPlanCommands } from "./plan-commands.js";
 import { execute } from "./run-service.js";
-import { addMokaSubmitOptions, runMokaSubmitFromCli } from "./submit-options.js";
 import { printMokaSubmitResult, registerRunCommands } from "./run-commands.js";
 import { Effect } from "effect";
 import { readFileSync } from "node:fs";

package/dist/cli/run-commands.js

@@ -1,7 +1,7 @@
 import { MOKA_RUN_EFFORTS, MOKA_RUN_TARGETS, resolveMokaRun } from "./run-resolver.js";
+import { runMokaSubmitFromCli } from "./submit-options.js";
 import { dispatchMokaRunCommand } from "./run-command.js";
 import { execute, runDetachedResolvedTask, runLocalResolvedTask } from "./run-service.js";
-import { runMokaSubmitFromCli } from "./submit-options.js";
 import { Option } from "commander";
 //#region src/cli/run-commands.ts
 function registerRunCommands(program, options = {}) {

package/dist/cli/run-service.js

@@ -1,15 +1,15 @@
 import { flattenNodes } from "../planning/graph.js";
 import { loadPipelineConfig } from "../config/load.js";
 import "../config.js";
+import { withRunControlStoreScoped } from "../run-control/run-control-store.js";
 import { compileWorkflowPlan } from "../planning/compile.js";
 import { generateRuntimeRunId, resolveWorkflowSelection } from "../runtime/context/context.js";
 import "../runtime/context/index.js";
-import { compileScheduleArtifact, generateScheduleArtifact, parseScheduleArtifact } from "../planning/generate.js";
-import { withRunControlStoreScoped } from "../run-control/run-control-store.js";
+import { compileScheduleArtifact, generateScheduleArtifactInMemory, parseScheduleArtifact } from "../planning/generate.js";
 import { runPipelineFromConfig } from "../pipeline-runtime.js";
+import { createRunStoreRuntimeReporter } from "../run-control/runtime-reporter.js";
 import { createTerminalRuntimeReporter, formatRuntimeFailure, formatRuntimeResult } from "./format.js";
 import { startDetachedRunController } from "../run-control/detach.js";
-import { createRunStoreRuntimeReporter } from "../run-control/runtime-reporter.js";
 import { createRunControlSupervisor } from "../run-control/supervisor.js";
 import { Effect } from "effect";
 import { readFileSync } from "node:fs";
@@ -82,14 +82,7 @@ function persistDetachedRunController(input) {
 		yield* store.createRun(detachedRunRecord(input));
 		const launch = yield* Effect.tryPromise({
 			catch: (error) => error,
-			try: () => startDetachedRunController({
-				entrypoint: input.prepared.entrypoint,
-				runId: input.runId,
-				schedule: input.prepared.schedule,
-				task: input.task,
-				workflow: input.prepared.workflow,
-				workspaceRoot: input.worktreePath
-			})
+			try: () => startDetachedRunController(detachedRunControllerInput(input))
 		});
 		yield* store.updateRunController({
 			controller: {
@@ -103,6 +96,16 @@ function persistDetachedRunController(input) {
 		});
 	})));
 }
+function detachedRunControllerInput(input) {
+	return {
+		entrypoint: input.prepared.entrypoint,
+		runId: input.runId,
+		...input.prepared.schedule ? { schedule: input.prepared.schedule } : {},
+		task: input.task,
+		workflow: input.prepared.workflow,
+		workspaceRoot: input.worktreePath
+	};
+}
 function detachedRunRecord(input) {
 	return {
 		...resolvedRunControlOptions(input.runControl),
@@ -149,16 +152,16 @@ async function runConfiguredPipeline(rawInputs) {
 			});
 			return;
 		}
-		const result = await generateScheduleArtifact({
+		const result = await generateScheduleArtifactInMemory({
 			config,
 			entrypointId: scheduledEntrypoint,
 			runId: inputs.runId,
 			task: inputs.task,
 			worktreePath: inputs.worktreePath
 		});
-		console.log(`Schedule generated: ${result.path}`);
-		const scheduleYaml = readFileSync(resolve(inputs.worktreePath, result.path), "utf8");
-		const compiled = compileScheduleArtifact(config, parseScheduleArtifact(scheduleYaml, result.path), inputs.worktreePath);
+		console.log("Schedule generated in memory");
+		const scheduleYaml = result.yaml;
+		const compiled = compileScheduleArtifact(config, parseScheduleArtifact(scheduleYaml, "schedule.yaml"), inputs.worktreePath);
 		await runAndPrintPipeline({
 			...inputs,
 			config: compiled.config,
@@ -327,20 +330,18 @@ async function prepareDetachedRun(input) {
 		entrypoint: input.execution.entrypoint,
 		workflow: input.execution.workflow
 	};
-	const result = await generateScheduleArtifact({
+	const result = await generateScheduleArtifactInMemory({
 		config: input.config,
 		entrypointId: scheduledEntrypoint,
 		runId: input.runId,
 		task: input.task,
 		worktreePath: input.worktreePath
 	});
-	console.log(`Schedule generated: ${result.path}`);
-	const schedule = resolve(input.worktreePath, result.path);
-	const scheduleYaml = readFileSync(schedule, "utf8");
-	const compiled = compileScheduleArtifact(input.config, parseScheduleArtifact(scheduleYaml, result.path), input.worktreePath);
+	console.log("Schedule generated in memory");
+	const scheduleYaml = result.yaml;
+	const compiled = compileScheduleArtifact(input.config, parseScheduleArtifact(scheduleYaml, "schedule.yaml"), input.worktreePath);
 	return {
 		config: compiled.config,
-		schedule,
 		scheduleArtifact: scheduleYaml,
 		workflow: compiled.workflowId
 	};

package/dist/cli/submit-options.js

@@ -93,4 +93,4 @@ function parseImagePullPolicy(value) {
 	return "Always";
 }
 //#endregion
-export { addMokaSubmitOptions, runMokaSubmitFromCli };
+export { addMokaSubmitOptions, buildMokaSubmitInputFromCli, runMokaSubmitFromCli };

package/dist/config/schemas.d.ts

@@ -226,8 +226,8 @@ declare const configSchema: z.ZodObject<{
     policy: z.ZodOptional<z.ZodObject<{
       commands: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
-        "trusted-only": "trusted-only";
         deny: "deny";
+        "trusted-only": "trusted-only";
       }>>;
       modules: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
@@ -255,8 +255,8 @@ declare const configSchema: z.ZodObject<{
       global: "global";
     }>>;
     mode: z.ZodEnum<{
-      hosted: "hosted";
       local: "local";
+      hosted: "hosted";
     }>;
     provider: z.ZodLiteral<"toolhive">;
     authorization_env: z.ZodDefault<z.ZodString>;
@@ -300,10 +300,10 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
     output: z.ZodOptional<z.ZodObject<{
       format: z.ZodEnum<{
+        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
-        json_schema: "json_schema";
       }>;
       repair: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -379,10 +379,10 @@ declare const configSchema: z.ZodObject<{
         disabled: "disabled";
       }>>>;
       output_formats: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
-        json_schema: "json_schema";
       }>>>;
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;

package/dist/install-hooks.js

@@ -5,8 +5,8 @@ import { existsSync, readFileSync, statSync } from "node:fs";
 import { execa } from "execa";
 import { tmpdir } from "node:os";
 import { dirname, join, relative } from "node:path";
-import { createHash } from "node:crypto";
 import { mkdir, mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
 //#region src/install-hooks.ts
 const DEFAULT_HOOK_INSTALL_SOURCE = AGENT_ASSET_SOURCE;
 const HOOK_HOSTS = [

package/dist/install-rules.js

@@ -1,7 +1,8 @@
+import { resolveHarnessTarget } from "./install-commands/shared.js";
 import { AGENT_ASSET_SOURCE, AGENT_RULES_DIR } from "./agent-assets.js";
 import { execa } from "execa";
-import { homedir, tmpdir } from "node:os";
-import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
 import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
 //#region src/install-rules.ts
 const DEFAULT_RULES_INSTALL_SOURCE = AGENT_ASSET_SOURCE;
@@ -12,6 +13,24 @@ const RULESYNC_TARGETS = [
 	"geminicli",
 	"opencode"
 ];
+const RULE_OUTPUTS = [
+	{
+		generatedPath: ".claude/CLAUDE.md",
+		targetPath: ".claude/CLAUDE.md"
+	},
+	{
+		generatedPath: ".codex/AGENTS.md",
+		targetPath: ".codex/AGENTS.md"
+	},
+	{
+		generatedPath: ".gemini/GEMINI.md",
+		targetPath: ".gemini/GEMINI.md"
+	},
+	{
+		generatedPath: ".config/opencode/AGENTS.md",
+		targetPath: ".opencode/AGENTS.md"
+	}
+];
 async function cloneRulesRepository(targetDir) {
 	await execa("gh", [
 		"repo",
@@ -71,50 +90,110 @@ ${(await Promise.all(entries.map(async (name) => {
 	await mkdir(rulesyncRulesDir, { recursive: true });
 	await writeFile(join(rulesyncRulesDir, "_root.md"), rootContent);
 }
+async function withRulesyncHome(useHome) {
+	const home = await mkdtemp(join(tmpdir(), "moka-rules-home-"));
+	try {
+		return await useHome(home);
+	} finally {
+		await rm(home, {
+			force: true,
+			recursive: true
+		});
+	}
+}
+function rulesyncArgs(options) {
+	const args = [
+		"generate",
+		"-t",
+		RULESYNC_TARGETS.join(","),
+		"-f",
+		"rules",
+		"--delete",
+		"--global"
+	];
+	if (options.dryRun) args.push("--dry-run");
+	if (options.silent) args.push("--silent");
+	return args;
+}
+async function runRulesyncGenerate(input) {
+	await input.runner(rulesyncArgs(input), {
+		cwd: input.source,
+		env: {
+			...process.env,
+			HOME_DIR: input.home
+		}
+	});
+}
+function ruleItems(action) {
+	return RULE_OUTPUTS.map((output) => ({
+		action,
+		path: resolveHarnessTarget(output.targetPath)
+	}));
+}
+function readGeneratedRuleFiles(home) {
+	return Promise.all(RULE_OUTPUTS.map(async (output) => ({
+		content: await readFile(join(home, output.generatedPath), "utf8"),
+		path: resolveHarnessTarget(output.targetPath)
+	})));
+}
+async function writeGeneratedRuleFiles(files) {
+	for (const file of files) {
+		await mkdir(dirname(file.path), { recursive: true });
+		await writeFile(file.path, file.content);
+	}
+}
+async function installedRuleAction(file) {
+	try {
+		return await readFile(file.path, "utf8") === file.content ? "unchanged" : "update";
+	} catch {
+		return "create";
+	}
+}
+async function assertInstalledRulesCurrent(files) {
+	const changed = (await Promise.all(files.map(async (file) => ({
+		action: await installedRuleAction(file),
+		path: file.path
+	})))).filter((item) => item.action !== "unchanged");
+	if (changed.length === 0) return;
+	throw new Error(["Installed rule files are not up to date.", ...changed.map((item) => `- ${item.path}: ${item.action}`)].join("\n"));
+}
 function installRules(options = {}) {
 	const runner = options.rulesyncRunner ?? defaultRulesyncRunner;
 	return withRulesSource(options.sourceOverride, async (source) => {
 		await buildRootRule(source);
-		const home = process.env.HOME_DIR ?? homedir();
-		const args = [
-			"generate",
-			"-t",
-			RULESYNC_TARGETS.join(","),
-			"-f",
-			"rules",
-			"--delete"
-		];
-		if (options.dryRun) args.push("--dry-run");
-		if (options.check) args.push("--check");
-		await runner(args, {
-			cwd: source,
-			env: {
-				...process.env,
-				HOME_DIR: home
+		return withRulesyncHome(async (home) => {
+			if (options.dryRun) {
+				await runRulesyncGenerate({
+					dryRun: true,
+					home,
+					runner,
+					source
+				});
+				return {
+					items: ruleItems("skip"),
+					source: DEFAULT_RULES_INSTALL_SOURCE
+				};
+			}
+			await runRulesyncGenerate({
+				home,
+				runner,
+				silent: options.check,
+				source
+			});
+			const files = await readGeneratedRuleFiles(home);
+			if (options.check) {
+				await assertInstalledRulesCurrent(files);
+				return {
+					items: ruleItems("skip"),
+					source: DEFAULT_RULES_INSTALL_SOURCE
+				};
 			}
+			await writeGeneratedRuleFiles(files);
+			return {
+				items: ruleItems("generate"),
+				source: DEFAULT_RULES_INSTALL_SOURCE
+			};
 		});
-		const action = options.dryRun ?? options.check ? "skip" : "generate";
-		return {
-			items: [
-				{
-					action,
-					path: join(home, ".claude/CLAUDE.md")
-				},
-				{
-					action,
-					path: join(home, ".codex/AGENTS.md")
-				},
-				{
-					action,
-					path: join(home, ".gemini/GEMINI.md")
-				},
-				{
-					action,
-					path: join(home, ".config/opencode/AGENTS.md")
-				}
-			],
-			source: DEFAULT_RULES_INSTALL_SOURCE
-		};
 	});
 }
 //#endregion

package/dist/moka-global-config.d.ts

@@ -1,3 +1,4 @@
+import { Effect } from "effect";
 import { z } from "zod";
 
 //#region src/moka-global-config.d.ts
@@ -29,20 +30,24 @@ declare const mokaGlobalConfigSchema: z.ZodObject<{
 }, z.core.$strict>;
 type MokaGlobalConfig = z.infer<typeof mokaGlobalConfigSchema>;
 declare function mokaGlobalConfigPath(homeDir?: string): string;
+declare class MokaDbUrlRequiredError extends Error {
+  readonly code = "db.url-required";
+  constructor();
+}
+declare function requireMokaDbUrl(dbUrl: string | undefined): Effect.Effect<string, MokaDbUrlRequiredError>;
 /**
  * Resolve the durable-substrate `db.url` toggle for run-control store selection.
  *
- * Returns the configured Postgres url, or `undefined` for the defined default
- * (filesystem store) when the global config is absent or carries no `db.url`.
+ * Returns the configured Postgres url, or `undefined` when the global config is
+ * absent or carries no `db.url`.
  * The whole `momokaya` schema is deliberately NOT validated — only the `db`
  * section is — so an unrelated invalid/missing field never breaks run-control
  * reads. A genuine load fault (corrupt YAML, a malformed `db.url`) is surfaced
- * to stderr and falls back to the filesystem store rather than crashing the
- * command; this is the presence-toggle's resilience, not silent error-swallowing
- * (the fault is always logged).
+ * to stderr and returns `undefined`; the required-DB policy then fails at the
+ * runtime-state boundary with `db.url-required`.
  */
 declare function loadMokaDbUrl(): string | undefined;
 declare function loadMokaGlobalConfig(): MokaGlobalConfig | null;
 declare function parseMokaGlobalConfig(source: string, sourcePath: string): MokaGlobalConfig;
 //#endregion
-export { MOKA_GLOBAL_CONFIG_PATH, MokaGlobalConfig, loadMokaDbUrl, loadMokaGlobalConfig, mokaGlobalConfigPath, mokaGlobalConfigSchema, parseMokaGlobalConfig };
+export { MOKA_GLOBAL_CONFIG_PATH, MokaDbUrlRequiredError, MokaGlobalConfig, loadMokaDbUrl, loadMokaGlobalConfig, mokaGlobalConfigPath, mokaGlobalConfigSchema, parseMokaGlobalConfig, requireMokaDbUrl };

package/dist/moka-global-config.js

@@ -37,20 +37,39 @@ const mokaGlobalConfigSchema = z.object({ momokaya: z.object({
 function mokaGlobalConfigPath(homeDir = homedir()) {
 	return join(homeDir, MOKA_GLOBAL_CONFIG_PATH);
 }
+var MokaDbUrlRequiredError = class extends Error {
+	code = "db.url-required";
+	constructor() {
+		super(`db.url-required: momokaya.db.url is required for Moka run-control runtime state. Configure momokaya.db.url in ${MOKA_GLOBAL_CONFIG_PATH}.`);
+		this.name = "MokaDbUrlRequiredError";
+	}
+};
+function requireMokaDbUrl(dbUrl) {
+	if (dbUrl === void 0) return Effect.fail(new MokaDbUrlRequiredError());
+	return Effect.succeed(dbUrl);
+}
 const mokaDbUrlReadSchema = z.object({ momokaya: z.object({ db: mokaDbGlobalConfigSchema.optional() }).optional() });
 /**
 * Resolve the durable-substrate `db.url` toggle for run-control store selection.
 *
-* Returns the configured Postgres url, or `undefined` for the defined default
-* (filesystem store) when the global config is absent or carries no `db.url`.
+* Returns the configured Postgres url, or `undefined` when the global config is
+* absent or carries no `db.url`.
 * The whole `momokaya` schema is deliberately NOT validated — only the `db`
 * section is — so an unrelated invalid/missing field never breaks run-control
 * reads. A genuine load fault (corrupt YAML, a malformed `db.url`) is surfaced
-* to stderr and falls back to the filesystem store rather than crashing the
-* command; this is the presence-toggle's resilience, not silent error-swallowing
-* (the fault is always logged).
+* to stderr and returns `undefined`; the required-DB policy then fails at the
+* runtime-state boundary with `db.url-required`.
 */
 function loadMokaDbUrl() {
+	const envUrl = process.env.MOKA_DB_URL;
+	if (envUrl !== void 0) {
+		const parsed = mokaDbGlobalConfigSchema.safeParse({ url: envUrl });
+		if (!parsed.success) {
+			process.stderr.write(`run-control: MOKA_DB_URL is invalid: ${parsed.error.message}\n`);
+			return;
+		}
+		return parsed.data.url;
+	}
 	const configPath = mokaGlobalConfigPath();
 	const program = Effect.gen(function* () {
 		const configIo = yield* ConfigIoService;
@@ -93,4 +112,4 @@ function parseMokaGlobalConfigEffect(source, sourcePath) {
 	});
 }
 //#endregion
-export { MOKA_GLOBAL_CONFIG_PATH, loadMokaDbUrl, loadMokaGlobalConfig, mokaGlobalConfigPath, mokaGlobalConfigSchema, parseMokaGlobalConfig };
+export { MOKA_GLOBAL_CONFIG_PATH, MokaDbUrlRequiredError, loadMokaDbUrl, loadMokaGlobalConfig, mokaGlobalConfigPath, mokaGlobalConfigSchema, parseMokaGlobalConfig, requireMokaDbUrl };

package/dist/moka-submit.d.ts

@@ -106,6 +106,10 @@ declare const mokaSubmitBaseOptionsSchema: z.ZodObject<{
     secretName: z.ZodString;
     url: z.ZodDefault<z.ZodString>;
   }, z.core.$strict>;
+  dbAuth: z.ZodOptional<z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+  }, z.core.$strict>>;
   delivery: z.ZodDefault<z.ZodObject<{
     mode: z.ZodDefault<z.ZodEnum<{
       "create-new-pr": "create-new-pr";
@@ -211,6 +215,10 @@ declare const mokaGraphSubmitOptionsSchema: z.ZodObject<{
     secretName: z.ZodString;
     url: z.ZodDefault<z.ZodString>;
   }, z.core.$strict>;
+  dbAuth: z.ZodOptional<z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+  }, z.core.$strict>>;
   delivery: z.ZodDefault<z.ZodObject<{
     mode: z.ZodDefault<z.ZodEnum<{
       "create-new-pr": "create-new-pr";
@@ -333,6 +341,10 @@ declare const mokaCommandSubmitOptionsSchema: z.ZodObject<{
     secretName: z.ZodString;
     url: z.ZodDefault<z.ZodString>;
   }, z.core.$strict>;
+  dbAuth: z.ZodOptional<z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+  }, z.core.$strict>>;
   delivery: z.ZodDefault<z.ZodObject<{
     mode: z.ZodDefault<z.ZodEnum<{
       "create-new-pr": "create-new-pr";
@@ -450,6 +462,10 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     secretName: z.ZodString;
     url: z.ZodDefault<z.ZodString>;
   }, z.core.$strict>;
+  dbAuth: z.ZodOptional<z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+  }, z.core.$strict>>;
   delivery: z.ZodDefault<z.ZodObject<{
     mode: z.ZodDefault<z.ZodEnum<{
       "create-new-pr": "create-new-pr";
@@ -571,6 +587,10 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     secretName: z.ZodString;
     url: z.ZodDefault<z.ZodString>;
   }, z.core.$strict>;
+  dbAuth: z.ZodOptional<z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+  }, z.core.$strict>>;
   delivery: z.ZodDefault<z.ZodObject<{
     mode: z.ZodDefault<z.ZodEnum<{
       "create-new-pr": "create-new-pr";

package/dist/moka-submit.js

@@ -1,3 +1,4 @@
+import { dbAuthOptionSchema } from "./remote/argo/model.js";
 import { brokerAuthOptionSchema } from "./credentials/broker.js";
 import { runnerDeliverySchema, runnerHookPolicySchema, runnerRepositoryContextSchema, runnerRunIdentitySchema, runnerTaskSchema } from "./runner-command-contract.js";
 import { workflowSubmitResultSchema } from "./workflow-submit-contract.js";
@@ -46,6 +47,7 @@ const mokaSubmitHookPolicySchema = runnerHookPolicySchema;
 const mokaSubmitResultSchema = workflowSubmitResultSchema;
 const mokaSubmitBaseOptionsSchema = z.object({
 	brokerAuth: brokerAuthOptionSchema,
+	dbAuth: dbAuthOptionSchema.optional(),
 	delivery: runnerDeliverySchema.default({
 		mode: "create-new-pr",
 		pullRequest: false

package/dist/pipeline-init.js

@@ -39,12 +39,8 @@ function hookInstallerFiles(result) {
 }
 async function initPipelineProject(options = {}) {
 	const cwd = options.cwd ?? process.cwd();
-	const { check, dryRun, force } = options;
-	const installerFlags = {
-		check,
-		dryRun,
-		force
-	};
+	const { check, dryRun } = options;
+	const installerFlags = initInstallerFlags(options);
 	if (!(check || dryRun)) await (options.skillInstaller ?? installDefaultSkills)(cwd);
 	const result = await installCommands({
 		cwd,
@@ -59,6 +55,14 @@ async function initPipelineProject(options = {}) {
 		...rulesResult.items.map((item) => item.path)
 	] };
 }
+function initInstallerFlags(options) {
+	const { check, dryRun } = options;
+	return {
+		check,
+		dryRun,
+		force: options.force ?? !(check || dryRun)
+	};
+}
 const INIT_RESULT_COPY = {
 	install: {
 		headline: "Initialized package-owned pipeline support:",