@kici-dev/orchestrator 0.0.0 → 0.1.1

package/dist/config/resolver.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Config resolution chain.
+ *
+ * Two-phase design:
+ * - Phase 1: resolveLocalConfig() -- env + YAML only, returns database URL,
+ *   instance ID, server port (needed before DB is available)
+ * - Phase 2: resolveFullConfig() -- merges defaults -> DB -> YAML -> env,
+ *   validates with appConfigSchema, returns typed AppConfig
+ *
+ * Precedence: env var > local YAML > shared DB > defaults
+ */
+import type { AppConfig, SharedConfig } from './types.js';
+/**
+ * Phase 1 result: minimal config resolved from local sources only.
+ */
+export interface LocalPhaseResult {
+    /** The raw local config (from YAML + env overlay) */
+    local: Record<string, unknown>;
+    /** Resolved database URL */
+    databaseUrl: string;
+    /** Resolved instance ID */
+    instanceId: string;
+    /** Resolved server port */
+    port: number;
+    /** Resolved instance mode */
+    mode: 'platform' | 'hybrid' | 'independent';
+}
+/**
+ * Phase 1: Resolve local-only config.
+ * Loads YAML, applies env overrides for local fields.
+ * Returns database URL and instance ID (needed before DB init).
+ */
+export declare function resolveLocalConfig(configPath?: string): Promise<LocalPhaseResult>;
+/**
+ * Phase 2: Resolve full config by merging all 4 layers.
+ * Precedence: env var > local YAML > shared DB > defaults.
+ *
+ * @param localConfig - Raw local config object (from Phase 1 or YAML parse)
+ * @param dbConfig - Shared config from DB (null if no DB config exists)
+ * @param env - Environment variables (defaults to process.env)
+ */
+export declare function resolveFullConfig(localConfig: Record<string, unknown>, dbConfig: SharedConfig | null, env?: NodeJS.ProcessEnv): AppConfig;
+/**
+ * Get default values for shared config fields.
+ */
+export declare function getDefaults(): Partial<SharedConfig>;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/config/schema.d.ts

@@ -0,0 +1,210 @@
+/**
+ * Zod schemas for orchestrator configuration validation.
+ *
+ * Provides separate schemas for:
+ * - localConfigSchema: validates YAML structure for per-orchestrator settings
+ * - sharedConfigSchema: validates shared config stored in PostgreSQL
+ * - appConfigSchema: validates the final merged config with cross-field validation
+ *
+ * Provider configuration (GitHub Apps, etc.) is managed via the `sources` table
+ * and PgSecretStore, not through config schemas.
+ */
+import { z } from 'zod';
+/**
+ * Schema for the local YAML configuration file.
+ * All fields optional except database.url.
+ */
+export declare const localConfigSchema: z.ZodObject<{
+    database: z.ZodObject<{
+        url: z.ZodString;
+    }, z.core.$strip>;
+    instance: z.ZodOptional<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        mode: z.ZodOptional<z.ZodEnum<{
+            platform: "platform";
+            hybrid: "hybrid";
+            independent: "independent";
+        }>>;
+    }, z.core.$strip>>;
+    server: z.ZodOptional<z.ZodObject<{
+        port: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+        basePath: z.ZodOptional<z.ZodString>;
+        logLevel: z.ZodOptional<z.ZodEnum<{
+            error: "error";
+            debug: "debug";
+            info: "info";
+            warn: "warn";
+        }>>;
+        tlsCertPath: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    scaler: z.ZodOptional<z.ZodObject<{
+        configPath: z.ZodOptional<z.ZodString>;
+        configDir: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type LocalConfigSchemaType = z.infer<typeof localConfigSchema>;
+/**
+ * Schema for the shared configuration stored in PostgreSQL.
+ * All top-level fields are optional (DB may have partial config).
+ */
+export declare const sharedConfigSchema: z.ZodObject<{
+    platform: z.ZodOptional<z.ZodObject<{
+        url: z.ZodOptional<z.ZodString>;
+        token: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    storage: z.ZodOptional<z.ZodObject<{
+        type: z.ZodOptional<z.ZodEnum<{
+            s3: "s3";
+        }>>;
+        bucket: z.ZodOptional<z.ZodString>;
+        prefix: z.ZodOptional<z.ZodString>;
+        region: z.ZodOptional<z.ZodString>;
+        endpoint: z.ZodOptional<z.ZodString>;
+        externalEndpoint: z.ZodOptional<z.ZodString>;
+        forcePathStyle: z.ZodOptional<z.ZodBoolean>;
+        logBucket: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    agentAuth: z.ZodOptional<z.ZodEnum<{
+        token: "token";
+        none: "none";
+    }>>;
+    agentTokenTtlMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    queue: z.ZodOptional<z.ZodObject<{
+        maxDepth: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+        timeoutMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+        backpressureThreshold: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    }, z.core.$strip>>;
+    lockfileCache: z.ZodOptional<z.ZodObject<{
+        max: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+        ttlMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    }, z.core.$strip>>;
+    staleDetector: z.ZodOptional<z.ZodObject<{
+        scanIntervalMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+        thresholdMultiplier: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+        heartbeatIntervalMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    }, z.core.$strip>>;
+    secrets: z.ZodOptional<z.ZodObject<{
+        key: z.ZodOptional<z.ZodString>;
+        keyFile: z.ZodOptional<z.ZodString>;
+        bootstrapAdminToken: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    pgCustomerSecrets: z.ZodDefault<z.ZodBoolean>;
+    cluster: z.ZodOptional<z.ZodObject<{
+        joinToken: z.ZodOptional<z.ZodString>;
+        raftElectionTimeoutMinMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+        raftElectionTimeoutMaxMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+        raftHeartbeatMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+        peerHeartbeatIntervalMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+        peerMaxReconnectDelayMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+        role: z.ZodOptional<z.ZodEnum<{
+            coordinator: "coordinator";
+            worker: "worker";
+        }>>;
+        coordinatorUrl: z.ZodOptional<z.ZodString>;
+        peerStaleTimeoutMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    }, z.core.$strip>>;
+    webhookPayloadDir: z.ZodOptional<z.ZodString>;
+    cacheTtlDays: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    cacheBuildTimeoutMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    cacheMaxTarballBytes: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    eventRouter: z.ZodOptional<z.ZodObject<{
+        maxChainDepth: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+        rateLimitPerWorkflowPerMinute: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+        eventTtlSeconds: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+        cleanupIntervalMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    }, z.core.$strip>>;
+    eventLog: z.ZodOptional<z.ZodObject<{
+        maxPayloadBytes: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type SharedConfigSchemaType = z.infer<typeof sharedConfigSchema>;
+/**
+ * Schema for the final merged application configuration.
+ * Includes cross-field validation via superRefine.
+ */
+export declare const appConfigSchema: z.ZodObject<{
+    instanceId: z.ZodDefault<z.ZodString>;
+    mode: z.ZodDefault<z.ZodEnum<{
+        platform: "platform";
+        hybrid: "hybrid";
+        independent: "independent";
+    }>>;
+    databaseUrl: z.ZodDefault<z.ZodString>;
+    port: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    basePath: z.ZodDefault<z.ZodString>;
+    tlsCertPath: z.ZodOptional<z.ZodString>;
+    scalerConfigPath: z.ZodOptional<z.ZodString>;
+    scalerConfigDir: z.ZodOptional<z.ZodString>;
+    platformUrl: z.ZodOptional<z.ZodString>;
+    platformToken: z.ZodOptional<z.ZodString>;
+    storage: z.ZodOptional<z.ZodObject<{
+        type: z.ZodOptional<z.ZodEnum<{
+            s3: "s3";
+        }>>;
+        bucket: z.ZodOptional<z.ZodString>;
+        prefix: z.ZodOptional<z.ZodString>;
+        region: z.ZodOptional<z.ZodString>;
+        endpoint: z.ZodOptional<z.ZodString>;
+        externalEndpoint: z.ZodOptional<z.ZodString>;
+        forcePathStyle: z.ZodOptional<z.ZodBoolean>;
+        logBucket: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    agentAuth: z.ZodDefault<z.ZodEnum<{
+        token: "token";
+        none: "none";
+    }>>;
+    agentTokenTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    queueMaxDepth: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    queueTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    queueBackpressureThreshold: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    lockfileCacheMax: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    lockfileCacheTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    staleDetectorScanIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    staleDetectorThresholdMultiplier: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    jobHeartbeatIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    secretKey: z.ZodOptional<z.ZodString>;
+    secretKeyFile: z.ZodOptional<z.ZodString>;
+    bootstrapAdminToken: z.ZodOptional<z.ZodString>;
+    pgCustomerSecrets: z.ZodDefault<z.ZodBoolean>;
+    cluster: z.ZodPrefault<z.ZodObject<{
+        instanceId: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        address: z.ZodOptional<z.ZodString>;
+        joinToken: z.ZodOptional<z.ZodString>;
+        credentialFile: z.ZodDefault<z.ZodString>;
+        autoRotateCredentials: z.ZodDefault<z.ZodBoolean>;
+        peers: z.ZodDefault<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodPipe<z.ZodString, z.ZodTransform<string[], string>>]>>;
+        raftElectionTimeoutMinMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+        raftElectionTimeoutMaxMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+        raftHeartbeatMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+        peerHeartbeatIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+        peerMaxReconnectDelayMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+        role: z.ZodDefault<z.ZodEnum<{
+            coordinator: "coordinator";
+            worker: "worker";
+        }>>;
+        coordinatorUrl: z.ZodOptional<z.ZodString>;
+        peerStaleTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    }, z.core.$strip>>;
+    webhookPayloadDir: z.ZodOptional<z.ZodString>;
+    cacheTtlDays: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    cacheBuildTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    cacheMaxTarballBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    eventRouterMaxChainDepth: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    eventRouterRateLimitPerWorkflowPerMinute: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    eventRouterEventTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    eventRouterCleanupIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    eventLogMaxPayloadBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    logLevel: z.ZodDefault<z.ZodEnum<{
+        error: "error";
+        debug: "debug";
+        info: "info";
+        warn: "warn";
+    }>>;
+    nodeEnv: z.ZodDefault<z.ZodEnum<{
+        development: "development";
+        production: "production";
+        test: "test";
+    }>>;
+}, z.core.$strip>;
+export type AppConfigSchemaType = z.infer<typeof appConfigSchema>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/config/shared-store.d.ts

@@ -0,0 +1,142 @@
+/**
+ * Database-backed shared configuration store with versioning.
+ *
+ * Provides CRUD operations for orchestrator shared configuration stored
+ * in the config_versions PostgreSQL table. Each save creates a new immutable
+ * version with audit trail. Sensitive fields are encrypted at rest using
+ * AES-256-GCM via the master key.
+ *
+ * Key operations:
+ * - getLatest(): retrieve current config (decrypted)
+ * - getByVersion(): retrieve a specific version
+ * - save(): validate, encrypt sensitive fields, store new version
+ * - rollback(): copy a previous version as a new version
+ * - listHistory(): version audit trail (metadata only)
+ * - getCurrentVersion(): current version number (for cluster heartbeat)
+ * - exportRedacted(): config with sensitive fields masked
+ */
+import { type Kysely } from 'kysely';
+import type { Database } from '../db/types.js';
+import type { SharedConfig } from './types.js';
+/**
+ * Version metadata returned by listHistory().
+ */
+export interface ConfigVersionMeta {
+    version: number;
+    createdAt: Date;
+    createdBy: string;
+    description: string | null;
+}
+/**
+ * Database-backed shared configuration store with versioning, encryption, and audit trail.
+ */
+export declare class SharedConfigStore {
+    private db;
+    private masterKey;
+    /** Previous master key, accepted during the rotation grace window. */
+    private oldMasterKey;
+    /**
+     * Active master-key generation. New inserts stamp this value into
+     * `config_versions.key_version`; rotation bumps it after re-encrypting
+     * every row in a single transaction.
+     */
+    private keyVersion;
+    constructor(db: Kysely<Database>, masterKey: Buffer | null, 
+    /** Previous master key, accepted during the rotation grace window. */
+    oldMasterKey?: Buffer | null, keyVersion?: number);
+    /**
+     * Construct a `SharedConfigStore` with the active key generation hydrated
+     * from the database.
+     *
+     * Mirrors `PgSecretStore.create`: reads `MAX(key_version)` from
+     * `config_versions` so a freshly-restarted orchestrator keeps writing under
+     * the same generation as the last row committed before shutdown. Empty
+     * tables fall back to generation 1.
+     */
+    static create(db: Kysely<Database>, masterKey: Buffer | null, oldMasterKey?: Buffer | null): Promise<SharedConfigStore>;
+    /**
+     * Get the latest config version (decrypt if master key available).
+     * Returns null if no config versions exist.
+     */
+    getLatest(): Promise<{
+        config: SharedConfig;
+        version: number;
+    } | null>;
+    /**
+     * Get a specific config version by version number.
+     * Returns null if the version doesn't exist.
+     */
+    getByVersion(version: number): Promise<{
+        config: SharedConfig;
+        version: number;
+    } | null>;
+    /**
+     * Save a new config version.
+     * Validates with sharedConfigSchema, encrypts sensitive fields,
+     * and stores as a new immutable version.
+     *
+     * @param config - The config object to save
+     * @param createdBy - Who created this version (e.g., "cli:seed", "api:set")
+     * @param description - Human-readable change description
+     * @returns The new version number
+     */
+    save(config: Record<string, unknown>, createdBy: string, description?: string): Promise<number>;
+    /**
+     * List version history (metadata only, no config bodies).
+     * Returns versions in reverse chronological order.
+     *
+     * @param limit - Maximum number of versions to return (default 50)
+     */
+    listHistory(limit?: number): Promise<ConfigVersionMeta[]>;
+    /**
+     * Rollback to a specific version.
+     * Reads the target version and creates a new version as a copy.
+     *
+     * @param targetVersion - Version number to rollback to
+     * @param createdBy - Who initiated the rollback
+     * @returns The new version number
+     * @throws Error if target version doesn't exist
+     */
+    rollback(targetVersion: number, createdBy: string): Promise<number>;
+    /**
+     * Get the current (latest) version number.
+     * Returns 0 if no versions exist.
+     * Used by cluster heartbeats to broadcast config version.
+     */
+    getCurrentVersion(): Promise<number>;
+    /**
+     * Export the current config with sensitive fields redacted.
+     * Returns null if no config versions exist.
+     * Used for CLI export and diff operations.
+     */
+    exportRedacted(): Promise<Record<string, unknown> | null>;
+    /**
+     * Rotate the master-key generation for every row in `config_versions`.
+     *
+     * Mirrors `PgSecretStore.rotateKey`: opens a transaction, loads every row,
+     * decrypts with the current key (falling back to `oldMasterKey` when set),
+     * re-encrypts under the current master key at `max(key_version) + 1`, and
+     * updates only `config` + `key_version`. Audit columns (`created_at`,
+     * `created_by`, `description`, `version`, `encrypted_paths`) are
+     * deliberately untouched so the history trail stays immutable and
+     * `rollback()` / `getByVersion()` keep their semantics.
+     *
+     * Historical rows are re-encrypted too — otherwise rollback to an older
+     * version would fail once `KICI_SECRET_KEY_OLD` is removed.
+     *
+     * Rows with no encrypted fields (`encrypted_paths = []`) still have their
+     * `key_version` bumped so a fully-rotated table has a single generation,
+     * but they don't contribute to the `reEncrypted` counter.
+     *
+     * @returns The number of rows whose ciphertext was re-sealed.
+     */
+    rotateKey(): Promise<{
+        reEncrypted: number;
+        skipped: number;
+    }>;
+    /**
+     * Convert a DB row to a SharedConfig with decryption.
+     */
+    private rowToConfig;
+}
+//# sourceMappingURL=shared-store.d.ts.map

package/dist/config/types.d.ts

@@ -0,0 +1,218 @@
+/**
+ * Configuration type system for the orchestrator.
+ *
+ * Three-layer config model:
+ * - LocalConfig: per-orchestrator settings from YAML file
+ * - SharedConfig: shared settings stored in PostgreSQL config_versions table
+ * - AppConfig: merged result type used throughout the codebase
+ */
+/**
+ * Per-orchestrator settings loaded from YAML file.
+ * These are instance-specific and never shared across orchestrators.
+ */
+export interface LocalConfig {
+    database: {
+        url: string;
+    };
+    instance?: {
+        id?: string;
+        mode?: 'platform' | 'hybrid' | 'independent';
+    };
+    server?: {
+        port?: number;
+        basePath?: string;
+        logLevel?: 'debug' | 'info' | 'warn' | 'error';
+        tlsCertPath?: string;
+    };
+    scaler?: {
+        configPath?: string;
+        configDir?: string;
+    };
+}
+/**
+ * Shared configuration stored in PostgreSQL config_versions table.
+ * Defined once, shared across all orchestrator instances.
+ */
+export interface SharedConfig {
+    platform?: {
+        url?: string;
+        token?: string;
+    };
+    storage?: {
+        type?: 's3';
+        bucket?: string;
+        prefix?: string;
+        region?: string;
+        endpoint?: string;
+        externalEndpoint?: string;
+        forcePathStyle?: boolean;
+        logBucket?: string;
+    };
+    agentAuth?: 'token' | 'none';
+    agentTokenTtlMs?: number;
+    queue?: {
+        maxDepth?: number;
+        timeoutMs?: number;
+        /**
+         * Pending-depth threshold that triggers the operator-facing backpressure
+         * warning. `0` disables the warner (metrics still exported).
+         */
+        backpressureThreshold?: number;
+    };
+    lockfileCache?: {
+        max?: number;
+        ttlMs?: number;
+    };
+    staleDetector?: {
+        scanIntervalMs?: number;
+        thresholdMultiplier?: number;
+        heartbeatIntervalMs?: number;
+    };
+    secrets?: {
+        key?: string;
+        keyFile?: string;
+        bootstrapAdminToken?: string;
+    };
+    pgCustomerSecrets?: boolean;
+    cluster?: {
+        joinToken?: string;
+        raftElectionTimeoutMinMs?: number;
+        raftElectionTimeoutMaxMs?: number;
+        raftHeartbeatMs?: number;
+        peerHeartbeatIntervalMs?: number;
+        peerMaxReconnectDelayMs?: number;
+    };
+    webhookPayloadDir?: string;
+    cacheTtlDays?: number;
+    cacheBuildTimeoutMs?: number;
+    cacheMaxTarballBytes?: number;
+    eventRouter?: {
+        maxChainDepth?: number;
+        rateLimitPerWorkflowPerMinute?: number;
+        eventTtlSeconds?: number;
+        cleanupIntervalMs?: number;
+    };
+    eventLog?: {
+        maxPayloadBytes?: number;
+    };
+}
+/**
+ * Merged application configuration used throughout the codebase.
+ * Combines LocalConfig + SharedConfig with resolved defaults.
+ */
+export interface AppConfig {
+    /** Unique identifier for this orchestrator instance */
+    instanceId: string;
+    /** Operating mode */
+    mode: 'platform' | 'hybrid' | 'independent';
+    /** PostgreSQL connection URL */
+    databaseUrl: string;
+    /** HTTP server port */
+    port: number;
+    /** HTTP base path */
+    basePath: string;
+    /** Path to TLS certificate (PEM) for expiry diagnostic check. Optional. */
+    tlsCertPath?: string;
+    /** Scaler YAML config file path */
+    scalerConfigPath?: string;
+    /** Scaler scalers.d/ directory path */
+    scalerConfigDir?: string;
+    /** Platform relay connection settings */
+    platformUrl?: string;
+    platformToken?: string;
+    /** Object storage settings */
+    storage?: {
+        type?: 's3';
+        bucket?: string;
+        prefix?: string;
+        region?: string;
+        endpoint?: string;
+        externalEndpoint?: string;
+        forcePathStyle?: boolean;
+        logBucket?: string;
+    };
+    /** Agent authentication mode */
+    agentAuth: 'token' | 'none';
+    /** Agent token TTL in milliseconds */
+    agentTokenTtlMs: number;
+    /** Queue settings */
+    queueMaxDepth: number;
+    queueTimeoutMs: number;
+    /**
+     * Pending-depth threshold for operator backpressure warnings. When the
+     * pending dispatch_queue depth stays at or above this for two consecutive
+     * refresher ticks (~10s), a structured `logger.warn` is emitted. `0`
+     * disables the warner entirely (metrics still exported). Default: 100.
+     */
+    queueBackpressureThreshold: number;
+    /** Lockfile cache settings */
+    lockfileCacheMax: number;
+    lockfileCacheTtlMs: number;
+    /** Stale detector settings */
+    staleDetectorScanIntervalMs: number;
+    staleDetectorThresholdMultiplier: number;
+    jobHeartbeatIntervalMs: number;
+    /** Secrets management */
+    secretKey?: string;
+    secretKeyFile?: string;
+    bootstrapAdminToken?: string;
+    /** Allow dashboard users to create PG-stored secrets */
+    pgCustomerSecrets: boolean;
+    /** Cluster settings */
+    cluster: {
+        instanceId: string;
+        address?: string;
+        joinToken?: string;
+        credentialFile: string;
+        autoRotateCredentials: boolean;
+        peers: string[];
+        raftElectionTimeoutMinMs: number;
+        raftElectionTimeoutMaxMs: number;
+        raftHeartbeatMs: number;
+        peerHeartbeatIntervalMs: number;
+        peerMaxReconnectDelayMs: number;
+        /** Cluster role: coordinator (full orchestrator) or worker (delegated execution). */
+        role: 'coordinator' | 'worker';
+        /** URL of the coordinator to connect to when role=worker. */
+        coordinatorUrl?: string;
+        /** Stale peer timeout in ms. */
+        peerStaleTimeoutMs: number;
+    };
+    /** Webhook payload storage directory */
+    webhookPayloadDir?: string;
+    /** Cache TTL in days */
+    cacheTtlDays: number;
+    /** Cache build timeout in ms */
+    cacheBuildTimeoutMs: number;
+    /** Max dependency tarball size in bytes */
+    cacheMaxTarballBytes: number;
+    /** Event router: max chain depth before circuit breaker trips */
+    eventRouterMaxChainDepth: number;
+    /** Event router: max events per event name per minute */
+    eventRouterRateLimitPerWorkflowPerMinute: number;
+    /** Event router: event TTL in seconds */
+    eventRouterEventTtlSeconds: number;
+    /** Event router: cleanup interval in milliseconds */
+    eventRouterCleanupIntervalMs: number;
+    /** Inbound webhook delivery log: soft cap (bytes). Oversized deliveries are
+     *  recorded with payload_omitted=true rather than 413'd. */
+    eventLogMaxPayloadBytes: number;
+    /** Log level */
+    logLevel: 'debug' | 'info' | 'warn' | 'error';
+    /** Node environment */
+    nodeEnv: 'development' | 'production' | 'test';
+}
+/**
+ * Database row type for the config_versions table.
+ * Each row is an immutable snapshot of the shared configuration.
+ */
+export interface ConfigVersion {
+    id: string;
+    version: number;
+    config: Record<string, unknown>;
+    createdAt: Date;
+    createdBy: string;
+    description: string | null;
+    encryptedPaths: string[];
+}
+//# sourceMappingURL=types.d.ts.map