@oisincoveney/pipeline 3.19.5 → 3.20.0

package/dist/argo-submit.d.ts

@@ -34,6 +34,7 @@ declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   }, z.core.$strict>>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   payloadJson: z.ZodString;
   serviceAccountName: z.ZodOptional<z.ZodString>;
   scheduleYaml: z.ZodString;
@@ -68,6 +69,7 @@ declare const submitDynamicRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   }, z.core.$strict>>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   payloadJson: z.ZodString;
   serviceAccountName: z.ZodOptional<z.ZodString>;
   workflowId: z.ZodString;

package/dist/argo-submit.js

@@ -48,6 +48,7 @@ const submitRunnerArgoWorkflowBaseOptionShape = {
 	mcpGatewayAuth: mcpGatewayAuthOptionSchema.optional(),
 	name: z.string().min(1).optional(),
 	namespace: z.string().min(1),
+	npmRegistryAuthSecretName: z.string().min(1).optional(),
 	payloadJson: z.string().min(1),
 	serviceAccountName: z.string().min(1).optional()
 };
@@ -113,6 +114,7 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		labels,
 		name: options.name,
 		namespace: options.namespace,
+		npmRegistryAuthSecretName: options.npmRegistryAuthSecretName,
 		payloadConfigMapName,
 		plan: compiled.plan,
 		scheduleConfigMapName: scheduleArtifactConfigMapName,
@@ -215,6 +217,7 @@ function submitDynamicRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		labels,
 		name: options.name,
 		namespace: options.namespace,
+		npmRegistryAuthSecretName: options.npmRegistryAuthSecretName,
 		payloadConfigMapName,
 		serviceAccountName: options.serviceAccountName,
 		workflowId: options.workflowId

package/dist/cli/doctor.d.ts

@@ -18,4 +18,4 @@ interface DoctorFlags {
 }
 declare function runDoctor(cwd: string, options?: DoctorFlags): Promise<DoctorResult>;
 //#endregion
-export { runDoctor };
+export { DoctorCheck, DoctorFlags, DoctorResult, runDoctor };

package/dist/cli/doctor.js

@@ -9,8 +9,8 @@ import { execa } from "execa";
 import { join } from "node:path";
 import matter from "gray-matter";
 //#region src/cli/doctor.ts
-const HEADLESS_AGENT_PERMISSION_VALUES = new Set(["ask"]);
-const RUN_READINESS_CATEGORIES = new Set([
+const HEADLESS_AGENT_PERMISSION_VALUES = /* @__PURE__ */ new Set(["ask"]);
+const RUN_READINESS_CATEGORIES = /* @__PURE__ */ new Set([
 	"acceptance",
 	"green",
 	"intake",

package/dist/cli/format.js

@@ -137,4 +137,4 @@ function truncateMiddle(text, maxLength) {
 	return `${text.slice(0, keep)}\n... truncated ...\n${text.slice(-keep)}`;
 }
 //#endregion
-export { createTerminalRuntimeReporter, formatDoctorResult, formatRuntimeFailure, formatRuntimeResult };
+export { createTerminalRuntimeReporter, formatDoctorResult, formatRuntimeFailure, formatRuntimeProgressMessage, formatRuntimeResult };

package/dist/cli/program.d.ts

@@ -11,4 +11,4 @@ interface CliProgramOptions {
 declare function createCliProgram(options?: CliProgramOptions): Command;
 declare function runCli(argv: string[]): Promise<void>;
 //#endregion
-export { createCliProgram, runCli };
+export { CliProgramOptions, createCliProgram, runCli };

package/dist/cli/run-command.d.ts

@@ -10,4 +10,4 @@ interface RunCommandCall {
 }
 type RunCommand = (call: RunCommandCall) => Promise<void> | void;
 //#endregion
-export { RunCommand };
+export { RunCommand, RunCommandCall };

package/dist/cli/run-resolver.d.ts

@@ -33,4 +33,4 @@ interface RunResolution {
   target: MokaRunTarget;
 }
 //#endregion
-export { RunResolution, RunResolverFlags };
+export { LocalRuntimeExecution, MOKA_RUN_EFFORTS, MOKA_RUN_TARGETS, MokaRunEffort, MokaRunMode, MokaRunTarget, RemoteSubmitExecution, RunResolution, RunResolverFlags };

package/dist/cli/run-service.d.ts

@@ -26,4 +26,4 @@ interface RunControlOptions {
 declare function execute(description: string, options?: ExecuteOptions): Promise<void>;
 declare function quick(description: string, options?: Omit<ExecuteOptions, "entrypoint">): Promise<void>;
 //#endregion
-export { execute, quick };
+export { ExecuteOptions, RunControlOptions, RunStoreMode, execute, quick };

package/dist/cli/submit-options.js

@@ -12,8 +12,12 @@ function resolveOptionalSecretRef(flags, fromGlobalConfig) {
 	};
 	return fromGlobalConfig;
 }
+function resolveOptionalSecretName(flags, fromGlobalConfig) {
+	if (flags.skip) return;
+	return flags.secretName ?? fromGlobalConfig;
+}
 function addMokaSubmitOptions(command) {
-	return addRunnerArgoOptions(command.option("--quick", "submit the compact graph").option("--command", "treat input after -- as explicit argv").option("--schedule <path>", "approved schedule YAML to submit").option("--event-url <url>", "runner event sink URL").option("--open-pr", "append an open-pull-request delivery node (preview-labelled PR)").option("--task <text>", "task description for command-mode metadata").option("--db-auth-secret-name <name>", "override momokaya.submit.dbAuth secret name").option("--db-auth-secret-key <key>", "override momokaya.submit.dbAuth secret key").option("--skip-db-auth", "omit MOKA_DB_URL injection regardless of global config").option("--mcp-gateway-auth-secret-name <name>", "override momokaya.submit.mcpGatewayAuth secret name").option("--mcp-gateway-auth-secret-key <key>", "override momokaya.submit.mcpGatewayAuth secret key").option("--skip-mcp-gateway-auth", "omit PIPELINE_MCP_GATEWAY_AUTHORIZATION injection regardless of global config"), { kubeconfig: true });
+	return addRunnerArgoOptions(command.option("--quick", "submit the compact graph").option("--command", "treat input after -- as explicit argv").option("--schedule <path>", "approved schedule YAML to submit").option("--event-url <url>", "runner event sink URL").option("--open-pr", "append an open-pull-request delivery node (preview-labelled PR)").option("--task <text>", "task description for command-mode metadata").option("--db-auth-secret-name <name>", "override momokaya.submit.dbAuth secret name").option("--db-auth-secret-key <key>", "override momokaya.submit.dbAuth secret key").option("--skip-db-auth", "omit MOKA_DB_URL injection regardless of global config").option("--mcp-gateway-auth-secret-name <name>", "override momokaya.submit.mcpGatewayAuth secret name").option("--mcp-gateway-auth-secret-key <key>", "override momokaya.submit.mcpGatewayAuth secret key").option("--skip-mcp-gateway-auth", "omit PIPELINE_MCP_GATEWAY_AUTHORIZATION injection regardless of global config").option("--npm-registry-auth-secret-name <name>", "override momokaya.submit.npmRegistryAuthSecretName").option("--skip-npm-registry-auth", "omit the /root/.npmrc mount regardless of global config"), { kubeconfig: true });
 }
 function runMokaSubmitFromCli(input, flags) {
 	const cwd = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
@@ -68,6 +72,10 @@ function mokaCommonSubmitOptions(input) {
 		kubeconfigPath: input.flags.kubeconfig ?? momokaya?.kubernetes.kubeconfig,
 		name: input.flags.name,
 		namespace: input.flags.namespace ?? momokaya?.kubernetes.namespace,
+		npmRegistryAuthSecretName: resolveOptionalSecretName({
+			secretName: input.flags.npmRegistryAuthSecretName,
+			skip: input.flags.skipNpmRegistryAuth
+		}, momokaya?.submit.npmRegistryAuthSecretName),
 		serviceAccountName: input.flags.serviceAccount ?? momokaya?.submit.serviceAccountName,
 		worktreePath: input.cwd
 	};
@@ -112,4 +120,4 @@ function parseImagePullPolicy(value) {
 	return "Always";
 }
 //#endregion
-export { addMokaSubmitOptions, buildMokaSubmitInputFromCli, runMokaSubmitFromCli };
+export { addMokaSubmitOptions, buildMokaSubmitInputFromCli, parseImagePullPolicy, runMokaSubmitFromCli };

package/dist/commands/pipeline-command.js

@@ -1,6 +1,6 @@
 import { Context, Effect, Layer } from "effect";
 //#region src/commands/pipeline-command.ts
-const BUILTIN_PIPE_COMMANDS = new Set([
+const BUILTIN_PIPE_COMMANDS = /* @__PURE__ */ new Set([
 	"run",
 	"validate",
 	"explain-plan",

package/dist/commands/ticket/shared.d.ts

@@ -11,4 +11,4 @@ interface TicketCommandOptions {
   readonly ticketPlanExecutor?: TicketPlanExecutor;
 }
 //#endregion
-export { TicketCommandOptions };
+export { TicketCommandOptions, TicketPlanExecutor };

package/dist/commands/ticket-command.d.ts

@@ -1,2 +1,3 @@
 import { TicketCommandOptions } from "./ticket/shared.js";
-import { Command } from "commander";
+import { Command } from "commander";
+export type { TicketCommandOptions };

package/dist/config/schemas.d.ts

@@ -583,4 +583,4 @@ interface PipelineConfigValidationOptions {
   allowMissingLintFileReferences?: boolean;
 }
 //#endregion
-export { GateKind, HookEvent, McpGatewayBackendLocality, McpGatewayWorkspacePathSource, PipelineConfig, PipelineConfigError, PipelineConfigErrorCode, PipelineConfigIssue, PipelineConfigParts, PipelineConfigValidationOptions, RunnerType, ScheduleBaseline, SchedulingRole, WorkflowNodeKind, workflowSchema };
+export { GateKind, HookEvent, McpGatewayBackendLocality, McpGatewayWorkspacePathSource, PipelineConfig, PipelineConfigError, PipelineConfigErrorCode, PipelineConfigIssue, PipelineConfigParts, PipelineConfigValidationOptions, RunnerType, ScheduleBaseline, SchedulingRole, WorkflowNodeKind, configSchema, workflowSchema };

package/dist/context/repo-map.js

@@ -7,7 +7,7 @@ import { Query } from "web-tree-sitter";
 import Graph from "graphology";
 import pagerank from "graphology-metrics/centrality/pagerank.js";
 //#region src/context/repo-map.ts
-const SOURCE_EXTENSIONS = new Set([
+const SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
 	".cjs",
 	".js",
 	".jsx",
@@ -15,7 +15,7 @@ const SOURCE_EXTENSIONS = new Set([
 	".ts",
 	".tsx"
 ]);
-const SKIP_DIRS = new Set([
+const SKIP_DIRS = /* @__PURE__ */ new Set([
 	"node_modules",
 	".git",
 	"dist",

package/dist/credentials/broker.d.ts

@@ -12,4 +12,4 @@ declare const brokerAuthOptionSchema: z.ZodObject<{
 }, z.core.$strict>;
 type BrokerAuthOption = z.input<typeof brokerAuthOptionSchema>;
 //#endregion
-export { BrokerAuthOption };
+export { BrokerAuthOption, brokerAuthOptionSchema };

package/dist/install-commands/opencode.js

@@ -413,4 +413,4 @@ const opencodeAdapter = {
 	}
 };
 //#endregion
-export { agentDispatchRoutes, entrypointDispatchBlock, grants, header, markdown, opencodeAdapter, projectAgentsMdDefinition, resolvedHostModel };
+export { agentDispatchRoutes, entrypointDispatchBlock, grants, header, markdown, opencodeAdapter, projectAgentsMdDefinition, resolvedHostModel, shouldEmbedProjectGateway };

package/dist/install-commands/planner.js

@@ -15,7 +15,7 @@ const ADAPTERS = {
 	opencode: opencodeAdapter,
 	"claude-code": claudeCodeAdapter
 };
-const GLOBAL_EXCLUDED_PATHS = new Set(["AGENTS.md"]);
+const GLOBAL_EXCLUDED_PATHS = /* @__PURE__ */ new Set(["AGENTS.md"]);
 const GENERATED_CONTENT_MARKERS = [
 	GENERATED_MARKER,
 	GENERATED_TS_MARKER,

package/dist/install-hooks.js

@@ -20,7 +20,7 @@ const HOST_TARGET_ROOT = {
 	codex: ".codex",
 	opencode: ".opencode"
 };
-const NON_HOOK_OWNED_TARGETS = new Set([".opencode/opencode.json"]);
+const NON_HOOK_OWNED_TARGETS = /* @__PURE__ */ new Set([".opencode/opencode.json"]);
 function hashContent(content) {
 	return createHash("sha256").update(content).digest("hex");
 }

package/dist/loop/argo-poll.js

@@ -2,12 +2,12 @@ import { isRecord } from "../safe-json.js";
 import { Duration, Effect } from "effect";
 import { CustomObjectsApi, KubeConfig } from "@kubernetes/client-node";
 //#region src/loop/argo-poll.ts
-const TERMINAL_PHASES = new Set([
+const TERMINAL_PHASES = /* @__PURE__ */ new Set([
 	"Succeeded",
 	"Failed",
 	"Error"
 ]);
-const KNOWN_RUNNING_PHASES = new Set([
+const KNOWN_RUNNING_PHASES = /* @__PURE__ */ new Set([
 	"Running",
 	"Pending",
 	""

package/dist/loop/loop-command.js

@@ -88,4 +88,4 @@ function loopControllerSubmitInput(input) {
 	};
 }
 //#endregion
-export { parseLoopFlags, runLoopSubmit };
+export { loopControllerArgv, parseLoopFlags, runLoopSubmit };

package/dist/loop/merge.js

@@ -117,4 +117,4 @@ function mergeForClassification(input) {
 	return adminMerge(input.pr, token, input.gh);
 }
 //#endregion
-export { mergeForClassification };
+export { adminMerge, enableAutoMerge, mergeForClassification, secretToken, selectMergeAction };

package/dist/moka-global-config.d.ts

@@ -33,6 +33,7 @@ declare const mokaGlobalConfigSchema: z.ZodObject<{
       gitCredentialsSecretName: z.ZodString;
       githubAuthSecretName: z.ZodString;
       imagePullSecretName: z.ZodString;
+      npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
       serviceAccountName: z.ZodString;
     }, z.core.$strict>;
   }, z.core.$strict>;

package/dist/moka-global-config.js

@@ -26,6 +26,7 @@ const mokaSubmitGlobalConfigSchema = z.object({
 	gitCredentialsSecretName: z.string().min(1),
 	githubAuthSecretName: z.string().min(1),
 	imagePullSecretName: z.string().min(1),
+	npmRegistryAuthSecretName: z.string().min(1).optional(),
 	serviceAccountName: z.string().min(1)
 }).strict();
 const mokaKubernetesGlobalConfigSchema = z.object({

package/dist/moka-submit.d.ts

@@ -201,6 +201,7 @@ declare const mokaSubmitBaseOptionsSchema: z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     headBranch: z.ZodOptional<z.ZodString>;
@@ -315,6 +316,7 @@ declare const mokaGraphSubmitOptionsSchema: z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     headBranch: z.ZodOptional<z.ZodString>;
@@ -446,6 +448,7 @@ declare const mokaCommandSubmitOptionsSchema: z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     headBranch: z.ZodOptional<z.ZodString>;
@@ -572,6 +575,7 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     headBranch: z.ZodOptional<z.ZodString>;
@@ -702,6 +706,7 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     headBranch: z.ZodOptional<z.ZodString>;

package/dist/moka-submit.js

@@ -70,6 +70,7 @@ const mokaSubmitBaseOptionsSchema = z.object({
 	kubeconfigPath: z.string().min(1).optional(),
 	name: z.string().min(1).optional(),
 	namespace: z.string().min(1).optional(),
+	npmRegistryAuthSecretName: z.string().min(1).optional(),
 	repository: runnerRepositoryContextSchema.optional(),
 	run: runnerRunIdentitySchema.optional(),
 	serviceAccountName: z.string().min(1).optional()

package/dist/planning/generate.js

@@ -41,7 +41,7 @@ const SCHEDULE_BUILTINS = [
 	"test",
 	"typecheck"
 ];
-const PARALLEL_MERGE_BUILTINS = new Set(["drain-merge"]);
+const PARALLEL_MERGE_BUILTINS = /* @__PURE__ */ new Set(["drain-merge"]);
 const scheduleArtifactSchema = z.object({
 	generated_at: z.string().datetime(),
 	kind: z.literal(SCHEDULE_KIND),

package/dist/remote/argo/model.d.ts

@@ -32,6 +32,7 @@ declare const buildRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   }, z.core.$strict>>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   payloadConfigMapKey: z.ZodDefault<z.ZodString>;
   payloadConfigMapName: z.ZodString;
   resources: z.ZodOptional<z.ZodObject<{
@@ -79,6 +80,7 @@ declare const buildDynamicRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   }, z.core.$strict>>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   payloadConfigMapKey: z.ZodDefault<z.ZodString>;
   payloadConfigMapName: z.ZodString;
   resources: z.ZodOptional<z.ZodObject<{

package/dist/remote/argo/model.js

@@ -198,6 +198,7 @@ const runnerArgoWorkflowBaseOptionsSchema = z.object({
 	mcpGatewayAuth: mcpGatewayAuthOptionSchema.optional(),
 	name: z.string().min(1).optional(),
 	namespace: kubernetesNameSchema,
+	npmRegistryAuthSecretName: kubernetesNameSchema.optional(),
 	payloadConfigMapKey: z.string().min(1).default("payload.json"),
 	payloadConfigMapName: kubernetesNameSchema,
 	resources: argoWorkflowResourceRequirementsSchema.optional(),

package/dist/remote/argo/storage.js

@@ -32,9 +32,7 @@ function runnerWorkflowStorage(options, tasks) {
 		readOnly: true,
 		subPath: "schedule.yaml"
 	}];
-	appendEventAuthStorage(options, volumes, volumeMounts);
-	appendGitCredentialsStorage(options, volumes, volumeMounts);
-	appendGithubAuthStorage(options, volumes, volumeMounts);
+	appendSharedSecretStorage(options, volumes, volumeMounts);
 	return {
 		volumeMounts: z.array(argoWorkflowVolumeMountSchema).parse(volumeMounts),
 		volumes: z.array(argoWorkflowVolumeSchema).parse(volumes)
@@ -43,14 +41,18 @@ function runnerWorkflowStorage(options, tasks) {
 function dynamicRunnerWorkflowStorage(options) {
 	const volumes = [runnerPayloadVolume(options)];
 	const volumeMounts = [runnerPayloadVolumeMount()];
-	appendEventAuthStorage(options, volumes, volumeMounts);
-	appendGitCredentialsStorage(options, volumes, volumeMounts);
-	appendGithubAuthStorage(options, volumes, volumeMounts);
+	appendSharedSecretStorage(options, volumes, volumeMounts);
 	return {
 		volumeMounts: z.array(argoWorkflowVolumeMountSchema).parse(volumeMounts),
 		volumes: z.array(argoWorkflowVolumeSchema).parse(volumes)
 	};
 }
+function appendSharedSecretStorage(options, volumes, volumeMounts) {
+	appendEventAuthStorage(options, volumes, volumeMounts);
+	appendGitCredentialsStorage(options, volumes, volumeMounts);
+	appendGithubAuthStorage(options, volumes, volumeMounts);
+	appendNpmRegistryAuthStorage(options, volumes, volumeMounts);
+}
 function runnerPayloadVolume(options) {
 	return {
 		configMap: {
@@ -123,5 +125,24 @@ function appendGithubAuthStorage(options, volumes, volumeMounts) {
 		subPath: "hosts.yml"
 	});
 }
+function appendNpmRegistryAuthStorage(options, volumes, volumeMounts) {
+	if (!options.npmRegistryAuthSecretName) return;
+	volumes.push({
+		name: "npm-registry-auth",
+		secret: {
+			items: [{
+				key: "npmrc",
+				path: "npmrc"
+			}],
+			secretName: options.npmRegistryAuthSecretName
+		}
+	});
+	volumeMounts.push({
+		mountPath: "/root/.npmrc",
+		name: "npm-registry-auth",
+		readOnly: true,
+		subPath: "npmrc"
+	});
+}
 //#endregion
 export { dynamicRunnerWorkflowStorage, runnerWorkflowStorage };

package/dist/remote/submit/argo-submission.d.ts

@@ -26,6 +26,7 @@ interface MokaWorkflowSubmitOptions {
   };
   name?: string;
   namespace: string;
+  npmRegistryAuthSecretName?: string;
   payloadJson: string;
   scheduleYaml?: string;
   serviceAccountName?: string;

package/dist/remote/submit/argo-submission.js

@@ -54,6 +54,7 @@ function workflowSubmitOptions(options) {
 		kubeconfigPath: options.kubeconfigPath,
 		name: options.name,
 		namespace: requireSubmitOption(options.namespace, "namespace"),
+		npmRegistryAuthSecretName: options.npmRegistryAuthSecretName,
 		serviceAccountName: options.serviceAccountName
 	};
 }

package/dist/remote/submit/io.js

@@ -1,6 +1,6 @@
 import { normalizeRunnerRepositoryForSubmit } from "../../git-remote-url.js";
 import { readFileSync } from "node:fs";
-import { simpleGit } from "simple-git";
+import { simpleGit as simpleGit$1 } from "simple-git";
 import parseGitUrl from "git-url-parse";
 //#region src/remote/submit/io.ts
 function readScheduleFile(dependencies, path) {
@@ -47,7 +47,7 @@ function runContext(options, git, runId) {
 }
 async function resolveGit(worktreePath, dependencies) {
 	if (dependencies.resolveGitContext) return dependencies.resolveGitContext(worktreePath);
-	const git = simpleGit({ baseDir: worktreePath });
+	const git = simpleGit$1({ baseDir: worktreePath });
 	const [branchResult, sha, remoteConfig] = await Promise.all([
 		git.branch(),
 		git.revparse(["HEAD"]),

package/dist/run-control/contracts.d.ts

@@ -103,4 +103,4 @@ type RunEffort = z.infer<typeof runEffortSchema>;
 type RunMode = z.infer<typeof runModeSchema>;
 type MokaRunManifest = z.infer<typeof mokaRunManifestSchema>;
 //#endregion
-export { MokaRunManifest, RunEffort, RunMode, RunTarget };
+export { MokaRunManifest, RunEffort, RunMode, RunTarget, mokaRunManifestSchema, runEffortSchema, runModeSchema, runTargetSchema };

package/dist/run-control/contracts.js

@@ -127,4 +127,4 @@ function parseMokaRunManifest(input) {
 	return mokaRunManifestSchema.parse(input);
 }
 //#endregion
-export { DEFAULT_RUN_CONTROL_HEARTBEAT_INTERVAL_MS, DEFAULT_RUN_CONTROL_NODE_STALE_AFTER_MS, DEFAULT_RUN_CONTROL_STALE_DETECTION, mokaNodeStatusSchema, mokaRunStatusSchema, parseMokaNodeStatus, parseMokaRunController, parseMokaRunEvent, parseMokaRunManifest, parseMokaRunStatus, parseRunControlStaleDetection, parseRunEffort, parseRunMode, parseRunTarget };
+export { DEFAULT_RUN_CONTROL_HEARTBEAT_INTERVAL_MS, DEFAULT_RUN_CONTROL_NODE_STALE_AFTER_MS, DEFAULT_RUN_CONTROL_STALE_DETECTION, MOKA_NODE_STATUSES, MOKA_RUN_STATUSES, RUN_EFFORTS, RUN_MODES, RUN_TARGETS, mokaNodeStatusEventSchema, mokaNodeStatusSchema, mokaRunControlEventSchema, mokaRunControllerSchema, mokaRunEventSchema, mokaRunHeartbeatEventSchema, mokaRunManifestSchema, mokaRunStatusEventSchema, mokaRunStatusSchema, parseMokaNodeStatus, parseMokaRunController, parseMokaRunEvent, parseMokaRunManifest, parseMokaRunStatus, parseRunControlStaleDetection, parseRunEffort, parseRunMode, parseRunTarget, runControlStaleDetectionSchema, runEffortSchema, runModeSchema, runTargetSchema };

package/dist/run-control/detach.js

@@ -76,4 +76,4 @@ function waitForControllerSpawnEffect(child) {
 	});
 }
 //#endregion
-export { startDetachedRunController };
+export { startDetachedRunController, startDetachedRunControllerEffect };

package/dist/run-control/next-node.js

@@ -115,4 +115,4 @@ function printNextNodeEnvelopeScoped(runId) {
 	});
 }
 //#endregion
-export { readPersistedScheduleEffect, readyNodeIdsFromRunStore, registerNextNodeSubcommand };
+export { buildNextNodeEnvelope, buildNextNodeEnvelopeFromRunStore, readPersistedScheduleEffect, readyNodeIdsFromRunStore, registerNextNodeSubcommand };

package/dist/run-control/run-artifacts-command.js

@@ -14,7 +14,7 @@ const WATCH_INTERVAL_MS = 1e3;
 const SENSITIVE_BASENAME_PARTS = ["prompt", "session"];
 const SENSITIVE_BASENAME_PREFIXES = ["body."];
 const SENSITIVE_PATH_PARTS = ["session-body", "session_body"];
-const SENSITIVE_BASENAMES = new Set(["body"]);
+const SENSITIVE_BASENAMES = /* @__PURE__ */ new Set(["body"]);
 function printLogsEffect(input) {
 	return Effect.gen(function* () {
 		const run = yield* requireRunEffect(input.store, input.runId);

package/dist/run-control/run-command-domain.js

@@ -1,13 +1,13 @@
 import { parseLogicalSegment } from "./logical-segment.js";
 import { Effect } from "effect";
 //#region src/run-control/run-command-domain.ts
-const ACTIVE_RUN_STATUSES = new Set([
+const ACTIVE_RUN_STATUSES = /* @__PURE__ */ new Set([
 	"queued",
 	"starting",
 	"running",
 	"stalled"
 ]);
-const ACTIVE_NODE_STATUSES = new Set([
+const ACTIVE_NODE_STATUSES = /* @__PURE__ */ new Set([
 	"queued",
 	"starting",
 	"running",

package/dist/run-control/runtime-reporter.js

@@ -132,4 +132,4 @@ function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
-export { createRunStoreRuntimeReporter };
+export { createRunStoreRuntimeReporter, createRunStoreRuntimeReporterEffect };

package/dist/run-control/store-paths.js

@@ -20,4 +20,4 @@ function runPaths(workspaceRoot, runId) {
 	};
 }
 //#endregion
-export { runPaths };
+export { RUNS_DIRECTORY, runPaths };

package/dist/run-control/submit-result.js

@@ -57,4 +57,4 @@ function submitResultEffect(runId, nodeId, resultJson) {
 	}));
 }
 //#endregion
-export { registerSubmitResultSubcommand };
+export { recordSubmitResult, registerSubmitResultSubcommand };

package/dist/run-control/supervisor.js

@@ -3,7 +3,7 @@ import { createSerializedWriteQueue } from "../serialized-write-queue.js";
 import { createRunStoreRuntimeReporter } from "./runtime-reporter.js";
 import { Effect } from "effect";
 //#region src/run-control/supervisor.ts
-const RUNNING_NODE_EVENT_TYPES = new Set([
+const RUNNING_NODE_EVENT_TYPES = /* @__PURE__ */ new Set([
 	"agent.start",
 	"artifact.check.start",
 	"gate.start",
@@ -193,4 +193,4 @@ function shouldMarkNodeRunning(event) {
 	}
 }
 //#endregion
-export { createRunControlSupervisor };
+export { createRunControlSupervisor, createRunControlSupervisorEffect };

package/dist/run-state/git-refs.js

@@ -347,4 +347,4 @@ function shellQuote(value) {
 	return `'${value.replaceAll("'", `'\\''`)}'`;
 }
 //#endregion
-export { commitAndPushNodeRef, mergeDependencyRefs, prepareRunnerGitWorkspace, promoteFinalRef, runAuthenticatedGit };
+export { commitAndPushNodeRef, mergeDependencyRefs, prepareRunnerGitWorkspace, promoteFinalRef, runAuthenticatedGit, runnerCommitMessage };

package/dist/runner-command/run.js

@@ -572,4 +572,4 @@ function createRunnerLogger(options) {
 	}, pino.multistream(streams, { dedupe: true }));
 }
 //#endregion
-export { runRunnerCommand, runnerTaskTextEffect };
+export { nodeProcessExitCode, runRunnerCommand, runnerTaskTextEffect };

package/dist/runtime/actor-ids.d.ts

@@ -124,4 +124,4 @@ type RuntimeObservabilityEvent = {
   type: "runtime.retry.exhausted";
 };
 //#endregion
-export { RuntimeActorDescriptor, RuntimeObservabilityEvent };
+export { RetryReason, RuntimeActorDescriptor, RuntimeActorKind, RuntimeObservabilityEvent };

package/dist/runtime/agent-node/index.js

@@ -1,2 +1,2 @@
-import "./agent-node.js";
-export {};
+import { executeAgentNode } from "./agent-node.js";
+export { executeAgentNode };

package/dist/runtime/builtins/index.js

@@ -1,2 +1,2 @@
-import "./builtins.js";
-export {};
+import { executeBuiltin } from "./builtins.js";
+export { executeBuiltin };

package/dist/runtime/changed-files/changed-files.js

@@ -35,7 +35,7 @@ function pathFromPorcelainEntry(entry) {
 	return path ? [path] : [];
 }
 function diffChangedFiles(before, after, worktreePath) {
-	const files = [...new Set([...before.files, ...after.files])].filter((file) => !before.files.has(file) || before.fingerprints.get(file) !== (after.fingerprints.get(file) ?? fileFingerprint(worktreePath, file)));
+	const files = [.../* @__PURE__ */ new Set([...before.files, ...after.files])].filter((file) => !before.files.has(file) || before.fingerprints.get(file) !== (after.fingerprints.get(file) ?? fileFingerprint(worktreePath, file)));
 	return {
 		files: new Set(files),
 		fingerprints: new Map(files.map((file) => [file, after.fingerprints.get(file) ?? fileFingerprint(worktreePath, file)]))

package/dist/runtime/changed-files/index.js

@@ -1,2 +1,2 @@
-import "./changed-files.js";
-export {};
+import { diffChangedFiles, snapshotChangedFiles } from "./changed-files.js";
+export { diffChangedFiles, snapshotChangedFiles };

package/dist/runtime/command-executor/index.js

@@ -1,2 +1,2 @@
-import "./command-executor.js";
-export {};
+import { executeCommand } from "./command-executor.js";
+export { executeCommand };

package/dist/runtime/context/index.js

@@ -1,2 +1,2 @@
-import "./context.js";
-export {};
+import { createRuntimeContext, generateRuntimeRunId, resolveWorkflowSelection } from "./context.js";
+export { createRuntimeContext, generateRuntimeRunId, resolveWorkflowSelection };

package/dist/runtime/contracts/index.d.ts

@@ -1 +1,2 @@
-import { AcceptanceCriterion, HookRuntimePolicy, NodeExecutionState, NodeStatus, PipelineRuntimeEvent, PipelineRuntimeObservabilityLevel, PipelineRuntimeOptions, PipelineRuntimeResult, PipelineTaskContext, RuntimeFailure, RuntimeGateResult, RuntimeNodeResult, RuntimeStructuredOutput, UnmetCriterion } from "./contracts.js";
+import { AcceptanceCriterion, HookRuntimePolicy, NodeExecutionState, NodeStatus, PipelineRuntimeEvent, PipelineRuntimeObservabilityLevel, PipelineRuntimeOptions, PipelineRuntimeResult, PipelineTaskContext, RuntimeFailure, RuntimeGateResult, RuntimeNodeResult, RuntimeStructuredOutput, UnmetCriterion } from "./contracts.js";
+export { AcceptanceCriterion, HookRuntimePolicy, NodeExecutionState, NodeStatus, PipelineRuntimeEvent, PipelineRuntimeObservabilityLevel, PipelineRuntimeOptions, PipelineRuntimeResult, PipelineTaskContext, RuntimeFailure, RuntimeGateResult, RuntimeNodeResult, RuntimeStructuredOutput, UnmetCriterion };

package/dist/runtime/drain-merge/index.js

@@ -1,2 +1,2 @@
-import "./drain-merge.js";
-export {};
+import { executeDrainMergeBuiltin } from "./drain-merge.js";
+export { executeDrainMergeBuiltin };

package/dist/runtime/events/events.js

@@ -3,7 +3,7 @@ import { runtimeActorId } from "../actor-ids.js";
 import { parseRuntimeOutput, validateJsonSchemaSource } from "../json-validation/json-validation.js";
 import "../json-validation/index.js";
 //#region src/runtime/events/events.ts
-const warningRuntimeObservabilityTypes = new Set([
+const warningRuntimeObservabilityTypes = /* @__PURE__ */ new Set([
 	"runtime.gate.cancelled",
 	"runtime.gate.failed",
 	"runtime.hook.failed",
@@ -15,7 +15,7 @@ const primaryRuntimeObservabilityPrefixes = [
 	"runtime.hook.",
 	"runtime.state."
 ];
-const structuredOutputFormats = new Set([
+const structuredOutputFormats = /* @__PURE__ */ new Set([
 	"json",
 	"json_schema",
 	"jsonl"

package/dist/runtime/events/index.js

@@ -1,2 +1,2 @@
-import "./events.js";
-export {};
+import { childReporter, createPublicRuntimeObservabilityEmitter, emit, emitAgentFinish, emitAgentStart, emitGateFinish, emitGateStart, emitNodeFinish, emitNodeOutputRecorded, emitNodeStart, emitWorkflowFinish, emitWorkflowPlanned, emitWorkflowStarted, runtimeNodeActorDescriptor, runtimeSystemId } from "./events.js";
+export { childReporter, createPublicRuntimeObservabilityEmitter, emit, emitAgentFinish, emitAgentStart, emitGateFinish, emitGateStart, emitNodeFinish, emitNodeOutputRecorded, emitNodeStart, emitWorkflowFinish, emitWorkflowPlanned, emitWorkflowStarted, runtimeNodeActorDescriptor, runtimeSystemId };

package/dist/runtime/gates/index.js

@@ -1,5 +1,5 @@
-import "./contract.js";
-import "./gates.js";
-import "./registry.js";
-import "./orchestrator.js";
-export {};
+import { forKind } from "./contract.js";
+import { parseGateJson } from "./gates.js";
+import { evaluateGate, gateRegistry } from "./registry.js";
+import { evaluateNodeGates } from "./orchestrator.js";
+export { evaluateGate, evaluateNodeGates, forKind, gateRegistry, parseGateJson };

package/dist/runtime/gates/kinds/acceptance/acceptance.js

@@ -106,4 +106,4 @@ function hasNonEmptyEvidence(value) {
 	return Array.isArray(value) && value.filter((item) => typeof item === "string" && item.trim()).length > 0;
 }
 //#endregion
-export { evaluateAcceptanceGate };
+export { acceptanceUnmetCriteria, evaluateAcceptanceGate };

package/dist/runtime/hooks/command-hook.js

@@ -20,7 +20,7 @@ function hookEnv(hook, context) {
 	};
 }
 function commandHookEnvEntries(hook, context) {
-	return [...new Set([...context.hookPolicy.envPassthrough, ...hook.env?.passthrough ?? []])].flatMap(commandHookEnvEntry);
+	return [.../* @__PURE__ */ new Set([...context.hookPolicy.envPassthrough, ...hook.env?.passthrough ?? []])].flatMap(commandHookEnvEntry);
 }
 function commandHookEnvEntry(name) {
 	const value = process.env[name];

package/dist/runtime/hooks/index.js

@@ -1,2 +1,2 @@
-import "./hooks.js";
-export {};
+import { dispatchHooks } from "./hooks.js";
+export { dispatchHooks };

package/dist/runtime/json-validation/index.js

@@ -1,2 +1,2 @@
-import "./json-validation.js";
-export {};
+import { normalizeJsonSource, parseJsonObject, parseRuntimeOutput, readJsonSchemaSource, readOptionalFile, validateJsonSchemaSource } from "./json-validation.js";
+export { normalizeJsonSource, parseJsonObject, parseRuntimeOutput, readJsonSchemaSource, readOptionalFile, validateJsonSchemaSource };

package/dist/runtime/node-protocol/node-protocol.js

@@ -80,4 +80,4 @@ function parseSubmitResult(value) {
 	return submitResultSchema.parse(value);
 }
 //#endregion
-export { parseSubmitResult };
+export { parseSubmitResult, submitResultSchema };

package/dist/runtime/node-state-store.js

@@ -95,4 +95,4 @@ function pendingNodeState(id) {
 	};
 }
 //#endregion
-export { initialNodeStateStore };
+export { NodeStateStore, initialNodeStateStore };

package/dist/runtime/open-pull-request/index.js

@@ -1,2 +1,2 @@
-import "./open-pull-request.js";
-export {};
+import { executeOpenPullRequestBuiltin, openPullRequestProgram } from "./open-pull-request.js";
+export { executeOpenPullRequestBuiltin, openPullRequestProgram };

package/dist/runtime/opencode-session-executor.js

@@ -200,7 +200,7 @@ function promptBody(plan) {
 		...plan.variant ? { variant: plan.variant } : {}
 	};
 }
-const FLAGS_TAKING_VALUE = new Set([
+const FLAGS_TAKING_VALUE = /* @__PURE__ */ new Set([
 	"--agent",
 	"--dir",
 	"--file",

package/dist/runtime/parallel-node/index.js

@@ -1,2 +1,2 @@
-import "./parallel-node.js";
-export {};
+import { executeParallelNode } from "./parallel-node.js";
+export { executeParallelNode };

package/dist/runtime/retry.js

@@ -30,4 +30,4 @@ function decideNodeRetry(input) {
 	};
 }
 //#endregion
-export { decideNodeRetry, nodeRetryPolicy };
+export { decideNodeRetry, nodeRetryPolicy, retryDelayMs };

package/dist/runtime/scheduler.js

@@ -132,7 +132,7 @@ function computeReadyNodeIds(input) {
 	const completedIds = new Set((input.completed ?? []).map((r) => r.nodeId));
 	const runningIds = new Set(input.running ?? []);
 	const blockedIds = new Set(input.blocked ?? []);
-	const settled = new Set([...completedIds, ...runningIds]);
+	const settled = /* @__PURE__ */ new Set([...completedIds, ...runningIds]);
 	return orderedNodes(input.nodes).filter((node) => !(settled.has(node.id) || blockedIds.has(node.id))).filter((node) => node.needs.every((needId) => {
 		const result = (input.completed ?? []).find((r) => r.nodeId === needId);
 		if (result === void 0) return false;

package/dist/runtime/services/backlog-service.d.ts

@@ -13,4 +13,4 @@ declare const BacklogService_base: Context.ServiceClass<BacklogService, "Backlog
 }>;
 declare class BacklogService extends BacklogService_base {}
 //#endregion
-export { BacklogService };
+export { BacklogCommandError, BacklogService };

package/dist/runtime/services/backlog-service.js

@@ -21,4 +21,4 @@ const BacklogServiceLive = Layer.succeed(BacklogService, { run: (args, cwd) => E
 	try: () => execa("backlog", [...args], { cwd })
 }).pipe(Effect.map((result) => result.stdout)) });
 //#endregion
-export { BacklogService, BacklogServiceLive };
+export { BacklogCommandError, BacklogService, BacklogServiceLive };

package/dist/runtime/services/drain-merge-git-service.js

@@ -1,9 +1,9 @@
 import { Context, Effect, Layer } from "effect";
-import simpleGit$1 from "simple-git";
+import simpleGit from "simple-git";
 //#region src/runtime/services/drain-merge-git-service.ts
 var DrainMergeGitService = class extends Context.Service()("DrainMergeGitService") {};
 const DrainMergeGitServiceLive = Layer.succeed(DrainMergeGitService, { create: (baseDir) => Effect.sync(() => {
-	const git = simpleGit$1({ baseDir });
+	const git = simpleGit({ baseDir });
 	return { raw: (args) => Effect.tryPromise(() => git.raw(args)) };
 }) });
 //#endregion

package/dist/runtime/services/kubernetes-argo-service.js

@@ -100,4 +100,4 @@ function kubectlErrorStdout(error) {
 	return (error.stdout || "").trim();
 }
 //#endregion
-export { KubernetesArgoService, KubernetesArgoServiceLive };
+export { KubernetesArgoService, KubernetesArgoServiceLive, resolveKubeConfig };

package/dist/runtime/services/run-journal-file-service.js

@@ -17,4 +17,4 @@ Layer.succeed(RunJournalFileService, {
 	})
 });
 //#endregion
-export {};
+export { RunJournalFileService };

package/dist/tickets/backlog-task-store.js

@@ -127,4 +127,4 @@ function storeError(path, message) {
 	});
 }
 //#endregion
-export { loadBacklogTaskStoreEffect };
+export { BacklogTaskStoreError, loadBacklogTaskStoreEffect };

package/dist/tickets/completion/complete-ticket.js

@@ -93,4 +93,4 @@ function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
-export { backlogTicketCompletionStoreEffect, completeTicket, conservativeLayerAJudge };
+export { TicketCompletionError, backlogTicketCompletionStoreEffect, completeTicket, conservativeLayerAJudge };

package/dist/tickets/ticket-graph.js

@@ -21,7 +21,7 @@ function sequenceTicketBatchesEffect(graph, ticketIds = dependencyGraphNodeIds(g
 function scopedTicketIds(graph, rootId) {
 	if (!rootId) return dependencyGraphNodeIds(graph.dependencyGraph).sort(compareTaskIds);
 	if (!dependencyGraphHasNode(graph.dependencyGraph, rootId)) return [];
-	const ids = new Set([rootId]);
+	const ids = /* @__PURE__ */ new Set([rootId]);
 	const visit = (id) => {
 		for (const child of graph.childrenByParentId.get(id) ?? []) {
 			ids.add(child.id);
@@ -71,4 +71,4 @@ function compareTasks(a, b) {
 	return compareBacklogTasks(a, b);
 }
 //#endregion
-export { buildTicketGraphEffect, compareTaskIds, predecessorIds, scopedTicketIds, sequenceTicketBatchesEffect };
+export { TicketGraphError, buildTicketGraphEffect, compareTaskIds, predecessorIds, scopedTicketIds, sequenceTicketBatchesEffect };

package/dist/tickets/ticket-plan.d.ts

@@ -41,4 +41,4 @@ declare const ticketPlanSchema: z.ZodObject<{
 }, z.core.$strict>;
 type TicketPlan = z.output<typeof ticketPlanSchema>;
 //#endregion
-export { TicketPlan };
+export { TicketPlan, ticketPlanSchema };

package/docs/operator-guide.md

@@ -236,6 +236,7 @@ momokaya:
     gitCredentialsSecretName: <git-credentials-secret-name>
     githubAuthSecretName: <github-auth-secret-name>
     imagePullSecretName: <image-pull-secret-name>
+    npmRegistryAuthSecretName: <npm-registry-auth-secret-name>  # optional
     brokerAuth:
       secretName: <broker-api-key-secret-name>
       secretKey: api-key
@@ -334,6 +335,12 @@ Expected namespace resources:
 - The GitHub CLI auth Secret named by `submit.githubAuthSecretName` with key
   `hosts.yml`; this Secret is for `gh` and pull request delivery, not git
   clone/fetch/push authentication
+- Optional: the private-registry auth Secret named by
+  `submit.npmRegistryAuthSecretName` with key `npmrc`, mounted at
+  `/root/.npmrc`; lets `.moka/bootstrap.sh`'s dependency install step (e.g.
+  `nub ci`) authenticate to private-scoped package registries, e.g. GitHub
+  Packages. Absent by default — bootstrap then only has public-registry
+  access, matching current behavior
 - A pipeline-console event sink reachable from the pod
 
 Credential issuance and rotation are owned by the cluster/infra layer, not by

package/package.json

@@ -32,6 +32,8 @@
   "devDependencies": {
     "@biomejs/biome": "2.4.15",
     "@effect/vitest": "^4.0.0-beta.90",
+    "@mpsuesser/oxlint-plugin-effect": "0.3.0",
+    "@oisin-ee/oxlint-config": "1.0.0",
     "@semantic-release/commit-analyzer": "^13.0.1",
     "@semantic-release/exec": "^7.1.0",
     "@semantic-release/github": "^12.0.8",
@@ -42,6 +44,9 @@
     "@typescript/native-preview": "7.0.0-dev.20260629.1",
     "drizzle-kit": "0.31.10",
     "jscpd": "^4.0.5",
+    "oxfmt": "^0.56.0",
+    "oxlint": "^1.71.0",
+    "oxlint-tsgolint": "^0.23.0",
     "semantic-release": "^25.0.3",
     "tsdown": "^0.22.0",
     "typescript": "rc",
@@ -125,6 +130,7 @@
     "test:image": "mkdir -p /tmp/pipeline-test && printf '{}' > /tmp/pipeline-test/payload.json && printf 'kind: pipeline-schedule\\nversion: 1\\nschedule_id: smoke\\ngenerated_at: 2026-06-10T00:00:00.000Z\\nsource_entrypoint: custom\\ntask: smoke\\nroot_workflow: root\\nworkflows:\\n  root:\\n    nodes:\\n      - id: smoke\\n        kind: command\\n        command: [true]\\n' > /tmp/pipeline-test/schedule.yaml && printf '{\"nodeId\":\"smoke\"}' > /tmp/pipeline-test/task.json && printf 'test-token' > /tmp/pipeline-test/event-token && docker build -t pipeline-runner:test . && docker run --rm -v /tmp/pipeline-test/payload.json:/etc/pipeline/payload.json:ro -v /tmp/pipeline-test/schedule.yaml:/etc/pipeline/schedule.yaml:ro -v /tmp/pipeline-test/task.json:/etc/pipeline/task.json:ro -v /tmp/pipeline-test/event-token:/etc/pipeline/event-auth/token:ro pipeline-runner:test runner-command --payload-file /etc/pipeline/payload.json --schedule-file /etc/pipeline/schedule.yaml; test $? -eq 64",
     "test:dogfood": "vitest run tests/dogfood-installed.test.ts",
     "test:live-runners": "PIPELINE_LIVE_RUNNERS=1 vitest run tests/dogfood-live-runners.test.ts",
+    "local-orbstack:migrate": "nub scripts/local-orbstack/migrate-postgres.ts",
     "typecheck": "tsc --noEmit",
     "build": "nub run build:cli",
     "check": "ultracite check",
@@ -132,7 +138,7 @@
     "prepack": "nub run build:cli"
   },
   "type": "module",
-  "version": "3.19.5",
+  "version": "3.20.0",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",