@kici-dev/orchestrator 0.17.0 → 0.18.0

package/dist/db/migrations/157_host_roster_identity_source.d.ts

@@ -1,20 +1,16 @@
 import { type Kysely } from 'kysely';
 /**
- * Add `host_roster.identity_source text NOT NULL DEFAULT 'operator'`, limited
- * to `agent`, `operator` and `platform`.
+ * `host_roster.identity_source` (`agent` | `operator` | `platform`): who last set a host's
+ * identity (labels, hostname, properties) — its agent registration, a local
+ * `kici-admin host declare`, or a Platform-relayed dashboard declare. A `platform` row is an
+ * unconfirmed placeholder that fan-out, inventory and the unreachable alarm skip.
  *
- * It records who last set a host's identity (labels, hostname, properties):
- * the host's own agent registration, a local `kici-admin host declare`, or a
- * Platform-relayed dashboard declare. A `platform` row is an unconfirmed
- * placeholder that fan-out, inventory and the unreachable alarm skip.
+ * Backfill: only an agent registration writes the `platform` column, so a row with it set
+ * becomes `agent`. Others stay `operator`: an older dashboard-created row is indistinguishable
+ * from a `kici-admin` declare, and `platform` would drop every declared, never-connected host
+ * out of fan-out.
  *
- * Backfill: a row whose `platform` column is set has registered at least once
- * (only an agent registration writes `platform`), so it becomes `agent`. Every
- * other row stays `operator`: a dashboard-created row from before this column
- * cannot be told apart from a `kici-admin` declare, and treating it as
- * `platform` would drop every declared, never-connected host out of fan-out.
- *
- * Idempotent: a re-run on a database that already has the column is a no-op.
+ * Idempotent.
  */
 export declare function up(db: Kysely<unknown>): Promise<void>;
 export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/db/migrations/159_org_id_widen_to_source_width.d.ts

@@ -0,0 +1,5 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+/** Fails when a row holds an org id longer than 16 characters, rather than truncating it. */
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=159_org_id_widen_to_source_width.d.ts.map

package/dist/db/migrator.d.ts

@@ -1,8 +1,6 @@
 /**
- * Auto-migrate module with PostgreSQL advisory lock for HA safety.
- *
- * Uses pg_advisory_lock to ensure only one orchestrator instance runs
- * migrations at a time, preventing conflicts in multi-instance deployments.
+ * Auto-migrate under a `pg_advisory_lock`, so only one orchestrator instance
+ * runs migrations at a time in a multi-instance deployment.
  */
 import { type MigrationResult } from 'kysely/migration';
 import type { Kysely } from 'kysely';
@@ -14,12 +12,10 @@ interface MigrateOptions {
 /**
  * Build a pool reserved for schema work.
  *
- * Migrations run DDL and backfills that legitimately take minutes on a
- * database holding real history, so they must not inherit the hot path's
- * `statement_timeout`. pg treats `0` as "no limit". Kysely's `Migrator`
- * acquires its own connections from whatever pool backs the `Kysely` instance
- * it is given, so the exemption has to be set on the pool — a `SET` issued on
- * one client would not reach the connections that run the migrations.
+ * DDL and backfills can take minutes on real history, so they must not inherit
+ * the hot path's `statement_timeout` (`0` means no limit). Kysely's `Migrator`
+ * takes connections from the pool behind its `Kysely` instance, so the
+ * exemption goes on the pool: a `SET` on one client would not reach them.
  *
  * `max: 2` covers the advisory-lock client plus the one Kysely checks out.
  */
@@ -31,9 +27,9 @@ export declare function withMigrationPool<T>(databaseUrl: string, fn: (opts: Mig
 /** True when a driver error is a cancelled statement rather than bad SQL. */
 export declare function isStatementTimeoutError(message: string): boolean;
 /**
- * Restate a migration failure so the log names the migration that failed and,
- * on a cancelled statement, the way out. The bare driver message names
- * neither, which is what left an operator with a boot loop and no next step.
+ * Restate a migration failure so the log names the failed migration and, on a
+ * cancelled statement, the way out. The bare driver message names neither,
+ * which left an operator with a boot loop and no next step.
  */
 export declare function describeMigrationFailure(message: string, migrationName?: string): string;
 interface MigrationStatusEntry {
@@ -42,11 +38,8 @@ interface MigrationStatusEntry {
     appliedAt?: Date;
 }
 /**
- * Run all pending migrations with an advisory lock for concurrency safety.
- *
- * Acquires pg_advisory_lock before migrating to prevent concurrent
- * migration attempts from multiple orchestrator instances. The lock
- * is always released in the finally block, even on error.
+ * Run all pending migrations under the advisory lock, which blocks concurrent
+ * attempts from other orchestrator instances and is released even on error.
  */
 export declare function runMigrations(opts: MigrateOptions): Promise<MigrationResult[]>;
 /**
@@ -65,14 +58,13 @@ export interface MigrateToResult {
 /**
  * Migrate the ledger to a named migration, in either direction.
  *
- * The point of this is rollback: a previous release's static provider does not
- * carry the newer migrations' names, so Kysely refuses to start against a
- * ledger that records them (`corrupted migrations: previously executed
- * migration <name> is missing`). Reverting to the head that release was
- * running at is what makes the old binary bootable again.
+ * For rollback: an older release's provider lacks the newer migrations, so
+ * Kysely refuses its ledger (`corrupted migrations: previously executed
+ * migration <name> is missing`). Reverting to that release's head makes the
+ * old binary bootable again.
  *
- * It runs under the same advisory lock as {@link runMigrations}, so a peer
- * cannot be applying migrations while this reverts them.
+ * Runs under the same advisory lock as {@link runMigrations}, so no peer
+ * applies migrations while this reverts them.
  */
 export declare function migrateTo(opts: MigrateOptions, name: string): Promise<MigrateToResult>;
 export {};

package/dist/db/notify-listener.d.ts

@@ -1,18 +1,15 @@
 /**
  * A LISTEN subscription that survives losing its connection.
  *
- * A `LISTEN` session is a single checked-out client sitting idle. A Postgres
- * failover, a restart, or an idle-backend sweep terminates it, and the pool's
- * own error handler discards the broken connection without re-acquiring — so
- * the subscription is silently gone while `/health` and `/ready` stay 200. The
- * process keeps running and never hears another NOTIFY on that channel.
+ * A `LISTEN` session is one idle checked-out client. A Postgres failover,
+ * restart or idle-backend sweep terminates it, and the pool discards the broken
+ * connection without re-acquiring — so the subscription is silently gone while
+ * `/health` and `/ready` stay 200.
  *
- * This wraps the pattern once: acquire, subscribe, `LISTEN`, and on `error` or
- * `end` release the dead client and reconnect with jittered exponential
- * backoff until `stop()`. NOTIFY has no durable log, so nothing can be
- * replayed — instead, after a successful re-`LISTEN` the consumer's
- * `onReconnect` re-derives whatever it missed from the database, which is
- * exactly what that consumer already does at cold boot.
+ * On `error` or `end` this releases the dead client and reconnects with
+ * jittered exponential backoff until `stop()`. NOTIFY has no durable log, so
+ * after a successful re-`LISTEN` the consumer's `onReconnect` re-derives what
+ * it missed from the database, as it does at cold boot.
  */
 import type pg from 'pg';
 import { type Logger } from '@kici-dev/shared';

package/dist/db/repos/dashboard-encryption-keys-repo.d.ts

@@ -13,13 +13,12 @@ export interface UpsertActiveEncryptionKeyInput {
     encrypted_private_key: string;
 }
 /**
- * Repository for the orchestrator's dashboard-encryption (X25519) keys. One
- * `active` key seals browser writes; a rotated-out key is `revoked`, which drops
- * it from the published JWKS ({@link listNonRevoked}) so new seals only ever use
- * the current key, while its row — and therefore its wrapped private half —
- * stays on record ({@link getByKid}) so an envelope a browser already sealed to
- * the old `kid` still decrypts. Mirrors the activate/demote transaction shape of
- * `OrchestratorSigningKeyRepo`.
+ * The orchestrator's dashboard-encryption (X25519) keys. One `active` key seals
+ * browser writes. A rotated-out key is `revoked`: it leaves the published JWKS
+ * ({@link listNonRevoked}) so new seals use only the current key, but its row
+ * and wrapped private half stay ({@link getByKid}) so envelopes sealed to the
+ * old `kid` still decrypt. Mirrors `OrchestratorSigningKeyRepo`'s
+ * activate/demote transaction shape.
  */
 export declare class DashboardEncryptionKeyRepo {
     private readonly db;
@@ -33,9 +32,9 @@ export declare class DashboardEncryptionKeyRepo {
     /** Resolve a key (active or rotated-out) by kid, or null. */
     getByKid(kid: string): Promise<DashboardEncryptionKeyRow | null>;
     /**
-     * Activate `input.kid`. If already active, no-op. Otherwise demote any
-     * current active key to `revoked` and insert this kid as `active`, in one
-     * transaction. Returns true when a NEW kid was activated (caller audits).
+     * Activate `input.kid` (no-op when already active), demoting the current
+     * active key to `revoked` in one transaction. Returns true when a NEW kid was
+     * activated (caller audits).
      */
     upsertActive(input: UpsertActiveEncryptionKeyInput): Promise<boolean>;
     /**

package/dist/db/synthetic-job-ids.d.ts

@@ -8,17 +8,15 @@
  * jobs), and it is swapped for the real job id the moment the job actually
  * dispatches (`dispatchReadyJob` → `findSyntheticJobId` → `addJobsToRun`).
  *
- * Lives here, beside the table it describes, because both the writers
- * (`pipeline/`) and the readers that must exclude these rows from an occupancy
- * count (`contexts/`) key on it, and neither layer imports the other.
+ * Lives here because the writers (`pipeline/`) and the readers that exclude
+ * these rows from an occupancy count (`contexts/`) both key on it, and neither
+ * layer imports the other.
  */
 export declare const NEEDS_PENDING_JOB_ID_PREFIX = "needs-pending-";
 /**
- * SQL `LIKE` pattern matching every placeholder `job_id`.
- *
- * `_` is a single-character wildcard in `LIKE`, so the literal underscore-free
- * prefix above needs no escaping — kept as one constant anyway so a caller can
- * never spell the pattern and the prefix differently.
+ * SQL `LIKE` pattern matching every placeholder `job_id`. The prefix has no
+ * `_` wildcard, so it needs no escaping; one constant keeps a caller from
+ * spelling the pattern and the prefix differently.
  */
 export declare const NEEDS_PENDING_JOB_ID_LIKE = "needs-pending-%";
 //# sourceMappingURL=synthetic-job-ids.d.ts.map