@kici-dev/orchestrator 0.1.27 → 0.2.0

package/dist/db/migrations/100_held_runs_hold_type_vocabulary.d.ts

@@ -0,0 +1,31 @@
+import { type Kysely } from 'kysely';
+/**
+ * Realign `held_runs.hold_type` onto the engine's `HoldType` vocabulary.
+ *
+ * The column carries two spellings the gates never emit: `approval` for a
+ * reviewer hold and `wait_timer` for a workflow-install wait hold. The
+ * dashboard switches on the gate vocabulary, so both fall through to the gray
+ * unknown-type badge — and two semantically identical wait holds render
+ * differently depending on which gate produced them.
+ *
+ * Writers emit the gate vocabulary; this backfills the history. The read path
+ * also normalizes (`normalizePersistedHoldType`) and the wait-hold release
+ * sweep matches both spellings, so a row written by an un-upgraded
+ * orchestrator behaves correctly whether or not this has run — the two sides
+ * deploy independently.
+ *
+ * Idempotent: a second run matches no rows.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+/**
+ * Rewrite the gate vocabulary back to the legacy spellings.
+ *
+ * Deliberately asymmetric: it rewrites *every* `reviewer` / `timer` row,
+ * including rows that were always written that way (a dispatch-gate wait hold
+ * has persisted as `timer` all along). That is the right trade for a rollback —
+ * an orchestrator running the older code matches its wait-hold release sweep on
+ * `wait_timer` alone, so leaving those rows spelled `timer` would strand them
+ * in the expire-and-fail path.
+ */
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=100_held_runs_hold_type_vocabulary.d.ts.map

package/dist/db/migrations/101_contexts_hold_expiry_drop_default.d.ts

@@ -0,0 +1,31 @@
+import { type Kysely } from 'kysely';
+/**
+ * Give the context hold expiry a single default, and retire the stored zeroes.
+ *
+ * `contexts.hold_expiry_seconds` carried `DEFAULT 86400` while every read-side
+ * fallback and the operator docs used 3600 — so a context created without an
+ * expiry held for 24 h, and one whose expiry was cleared held for 1 h. Dropping
+ * the DDL default (rather than moving it to 3600) makes both paths land on NULL
+ * and resolve through `DEFAULT_HOLD_EXPIRY_SECONDS`, so the two cannot drift
+ * apart again.
+ *
+ * The backfill is the other half of rejecting a zero expiry at the write
+ * boundary: a stored `0` puts every hold's deadline at the current instant, so
+ * the hold is swept to `expired` before a reviewer can act. Validation alone
+ * only stops new zeroes arriving; these rows already exist and there was no CLI
+ * path to notice them.
+ *
+ * Idempotent: dropping an absent default is a no-op and the UPDATE matches no
+ * rows on a second run.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+/**
+ * Restore the column's original default.
+ *
+ * Deliberately asymmetric: the zeroed rows are NOT recreated. After the
+ * backfill they are indistinguishable from a deliberate NULL, and a row put
+ * back to `0` would resume cancelling every hold on its context — so a
+ * rollback keeps them on the fallback rather than re-breaking them.
+ */
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=101_contexts_hold_expiry_drop_default.d.ts.map

package/dist/db/migrations/102_dispatch_queue_agent_id.d.ts

@@ -0,0 +1,20 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `dispatch_queue.agent_id` (nullable text).
+ *
+ * The durable record of which agent a job was dispatched to. `ack_agent_id` is
+ * cleared the moment the agent answers the dispatch, so it cannot answer "who
+ * owns this job?" for the rest of the job's life; this column is written at
+ * dispatch and cleared only on requeue, so a coordinator that never saw the
+ * dispatch — a freshly-elected leader after a failover — can still resolve
+ * ownership of a live `dispatched` row straight from the database.
+ *
+ * Nullable with no backfill: a row dispatched before this migration keeps a NULL
+ * owner and resolves to "not owned", which is the behaviour it already had.
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has the
+ * column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=102_dispatch_queue_agent_id.d.ts.map

package/dist/db/migrations/103_cluster_settings_ownership_db_check_timeout_ms.d.ts

@@ -0,0 +1,20 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.ownership_db_check_timeout_ms` (nullable bigint).
+ *
+ * Deadline for a single database-backed agent-ownership lookup. The lookup runs
+ * on the inbound path of every job-scoped agent frame whose in-memory ownership
+ * check misses, so a slow database would otherwise stall the frame; past the
+ * deadline the lookup resolves as undecided and the frame is refused without
+ * counting an ownership violation.
+ *
+ * Cluster-global (every coordinator talks to the same database), so it lives on
+ * `cluster_settings` rather than `org_settings`. NULL ⇒ the orchestrator's own
+ * configured default applies.
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has the
+ * column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=103_cluster_settings_ownership_db_check_timeout_ms.d.ts.map

package/dist/db/migrations/104_check_run_terminal_sent.d.ts

@@ -0,0 +1,22 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `check_run_tracking.terminal_sent_at` (nullable timestamptz).
+ *
+ * `check_run_id` is written at CREATE time, while the check run is still
+ * `queued`, so it proves creation and never completion. Without a completion
+ * signal a check run stuck `queued` on the provider is indistinguishable from
+ * the provider simply lagging, which is what made a check-run poll timeout
+ * unattributable: nothing on our side recorded whether the terminal update had
+ * been sent at all.
+ *
+ * Stamped only after the provider accepts a `completed` update. Nullable and
+ * best-effort like every write on this table — a tracking write must never
+ * break check-run reporting — so NULL means "we have no record of sending it",
+ * not "it was never sent".
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has
+ * the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=104_check_run_terminal_sent.d.ts.map

package/dist/db/migrations/105_org_trust_policy.d.ts

@@ -0,0 +1,19 @@
+import { type Kysely } from 'kysely';
+/**
+ * Create `org_trust_policy` — the orchestrator's cache of the Platform-owned org
+ * trust policy pushed on `trust_policy.update`.
+ *
+ * A dedicated table rather than `org_settings` columns, because this is
+ * Platform-owned policy the orchestrator consumes, not operator-owned config the
+ * operator tunes. `source` records which of the two wrote the row so the admin
+ * surface can present a Platform-managed policy as read-only.
+ *
+ * Persisting rather than caching in memory is deliberate: a security policy that
+ * silently reverts to a default across a restart is worse than one that is never
+ * applied.
+ *
+ * Idempotent: guarded by IF NOT EXISTS, so a re-run is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=105_org_trust_policy.d.ts.map

package/dist/db/migrations/106_cluster_settings_check_run_tracking_ttl_days.d.ts

@@ -0,0 +1,18 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.check_run_tracking_ttl_days` (nullable integer).
+ *
+ * Retention window for `check_run_tracking` rows. The hourly cleanup sweep
+ * deletes rows untouched for longer than this; 0 disables the sweep.
+ *
+ * Cluster-global (the sweep runs once per fleet on the cleanup tick, with no
+ * tenant in scope at the read site), so it lives on `cluster_settings` rather
+ * than `org_settings`. NULL means the orchestrator's own configured default
+ * applies.
+ *
+ * Idempotent: guarded on column existence; a re-run on a database that already
+ * has the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=106_cluster_settings_check_run_tracking_ttl_days.d.ts.map

package/dist/db/migrations/107_check_run_tracking_updated_at_index.d.ts

@@ -0,0 +1,23 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `idx_check_run_tracking_updated_at` on `check_run_tracking (updated_at)`.
+ *
+ * `CheckRunTrackingStore.pruneStale` — the hourly retention sweep — filters
+ * `WHERE updated_at < now() - <window>`. The table already carries two indexes
+ * — the primary key on `(provider, owner, repo, sha, check_name)` and the
+ * partial `idx_check_run_tracking_run_id` — but `updated_at` leads neither, so
+ * that predicate can use neither and without this index every sweep
+ * sequentially scans the whole table. The scan
+ * is worst exactly where it hurts: a deployment that accumulated rows before
+ * retention existed has the largest table and gets the scan hourly, on every
+ * coordinator, since the cleanup tick is not leader-gated.
+ *
+ * Mirrors `idx_dispatch_queue_run_id` (migration 072) and
+ * `idx_request_idempotency_created_at` (migration 068), both of which exist to
+ * index a TTL sweep's prune predicate.
+ *
+ * Idempotent: `IF NOT EXISTS` makes a re-run a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=107_check_run_tracking_updated_at_index.d.ts.map

package/dist/db/repos/dashboard-encryption-keys-repo.d.ts

@@ -0,0 +1,48 @@
+import type { Kysely } from 'kysely';
+import type { Database, DashboardEncryptionKeyRow } from '../types.js';
+/** Lifecycle status values for a dashboard-encryption key. */
+export declare const DashboardEncryptionKeyStatus: {
+    readonly active: 'active';
+    readonly revoked: 'revoked';
+};
+export type DashboardEncryptionKeyStatus = (typeof DashboardEncryptionKeyStatus)[keyof typeof DashboardEncryptionKeyStatus];
+export interface UpsertActiveEncryptionKeyInput {
+    kid: string;
+    public_jwk: Record<string, unknown>;
+    /** AES-256-GCM-wrapped DER private key (master-key wrapped). */
+    encrypted_private_key: string;
+}
+/**
+ * Repository for the orchestrator's dashboard-encryption (X25519) keys. One
+ * `active` key seals browser writes; a rotated-out key is `revoked`, which drops
+ * it from the published JWKS ({@link listNonRevoked}) so new seals only ever use
+ * the current key, while its row — and therefore its wrapped private half —
+ * stays on record ({@link getByKid}) so an envelope a browser already sealed to
+ * the old `kid` still decrypts. Mirrors the activate/demote transaction shape of
+ * `OrchestratorSigningKeyRepo`.
+ */
+export declare class DashboardEncryptionKeyRepo {
+    private readonly db;
+    constructor(db: Kysely<Database>);
+    /** Public keys published in the JWKS (the active key; revoked ones drop out). */
+    listNonRevoked(): Promise<DashboardEncryptionKeyRow[]>;
+    /** Every key on record: the active one plus every rotated-out (revoked) one. */
+    listServed(): Promise<DashboardEncryptionKeyRow[]>;
+    /** The single currently-active key row, or null when none is active. */
+    getActiveRow(): Promise<DashboardEncryptionKeyRow | null>;
+    /** Resolve a key (active or rotated-out) by kid, or null. */
+    getByKid(kid: string): Promise<DashboardEncryptionKeyRow | null>;
+    /**
+     * Activate `input.kid`. If already active, no-op. Otherwise demote any
+     * current active key to `revoked` and insert this kid as `active`, in one
+     * transaction. Returns true when a NEW kid was activated (caller audits).
+     */
+    upsertActive(input: UpsertActiveEncryptionKeyInput): Promise<boolean>;
+    /**
+     * Mark a key revoked (rotation / compromise). It leaves the published JWKS
+     * immediately, but its private half stays on record, so a browser still
+     * holding the old kid keeps decrypting until the row is deleted.
+     */
+    revoke(kid: string, reason: string): Promise<void>;
+}
+//# sourceMappingURL=dashboard-encryption-keys-repo.d.ts.map

package/dist/db/repos/signing-keys-repo.d.ts

@@ -0,0 +1,34 @@
+import type { Kysely } from 'kysely';
+import type { Database, OrchestratorSigningKeyRow } from '../types.js';
+export interface UpsertActiveInput {
+    kid: string;
+    public_jwk: Record<string, unknown>;
+    /** Wrapped private JWK for `db` custody; null for `aws-kms` / `command`. */
+    encrypted_private_jwk: string | null;
+    alg: string;
+    signer_kind: string;
+    key_ref: string | null;
+}
+/**
+ * Repository for the orchestrator's provenance signing keys. Ports the Platform's
+ * `signing-keys-repo.ts` status model (activate / retire / revoke) and adds
+ * `encrypted_private_jwk` custody for `db` keys.
+ */
+export declare class OrchestratorSigningKeyRepo {
+    private readonly db;
+    constructor(db: Kysely<Database>);
+    /** Public keys served in the JWKS / trusted for verification (everything except revoked). */
+    listTrusted(): Promise<OrchestratorSigningKeyRow[]>;
+    /** The single currently-active key row, or null when none is active. */
+    getActiveRow(): Promise<OrchestratorSigningKeyRow | null>;
+    /**
+     * Activate `input.kid`. If it is already active, no-op. Otherwise demote any
+     * current active key to `retiring`, upsert this kid as `active`, in one
+     * transaction. Returns true when a NEW kid was activated (caller audits).
+     * Refuses to reactivate a `revoked` kid.
+     */
+    upsertActive(input: UpsertActiveInput): Promise<boolean>;
+    retire(kid: string): Promise<void>;
+    revoke(kid: string, reason: string): Promise<void>;
+}
+//# sourceMappingURL=signing-keys-repo.d.ts.map