@kya-os/cli 1.8.3 → 2.0.2

package/dist/orchestrator/daemon.js

@@ -1,242 +0,0 @@
-/**
- * Orchestrator daemon (ORC-W1 PR-2).
- *
- * The single writer to the ledger. Everything that mutates state does so here,
- * driven by verified protocol events, which is what lets the journal be read
- * as evidence of what happened rather than as a record of what something
- * claimed happened.
- *
- * It owns no judgement. Deciding what to staff, whether two tickets are
- * related, or when to escalate belongs to an orchestrator session on top of
- * this (ORC-W5). The dividing line: this file owns anything whose correctness
- * a test can check.
- *
- * @module orchestrator/daemon
- */
-import { hostname } from "node:os";
-import { openLedger } from "./db/index.js";
-import { registerJournalWriter, reconcileRecentEvents } from "./journal-writer.js";
-import { registerReviewReactor, reconcileReviewState } from "./review.js";
-import { beat, readLiveness, judgeLiveness, clearLiveness, isProcessAlive, } from "./db/liveness.js";
-/**
- * Atomically check for a live writer and, if there is none, claim sole-writer
- * status -- in ONE step, not two.
- *
- * The read and the claim used to be separate calls (this function only
- * asserted; the daemon's own first beat happened much later, after
- * subscribing and reconciling), which left a window where two processes
- * racing to start against the same ledger could both read "no live writer"
- * before either had claimed it, and both proceed (Bugbot finding on #686:
- * the earlier fix enforced the invariant against a SEQUENTIAL second start,
- * but not against two that begin in the same window). `BEGIN IMMEDIATE`
- * closes it: SQLite serializes immediate transactions against each other, so
- * a second process's transaction cannot even begin until the first's has
- * committed, and by the time it does begin, it reads the row the first just
- * claimed rather than the state from before it existed.
- *
- * The staleness/pid-liveness reasoning is unchanged: a recent beat alone
- * cannot tell "still running" from "beat once, then crashed" -- where the
- * row names a pid on THIS host, the OS is asked directly rather than
- * trusting the timestamp, so a genuinely dead process clears this regardless
- * of how recent its last beat was, and a row from another host falls back to
- * the staleness window, the same ambiguity `judgeLiveness` already lives
- * with.
- */
-export function claimSoleWriter(db, claim) {
-    db.transaction(() => {
-        const row = readLiveness(db);
-        if (row) {
-            const verdict = judgeLiveness(row, Date.now());
-            const deadOnThisHost = row.host === claim.host && row.pid !== null && !isProcessAlive(row.pid);
-            if (!verdict.stale && !deadOnThisHost) {
-                throw new Error(`orchestrator: ledger already has a live writer (pid ${row.pid ?? "unknown"} on ` +
-                    `${row.host ?? "an unknown host"}, last beat ${verdict.ageMs ?? "an unknown number of"}ms ago). Refusing to start a second daemon against the same ledger.`);
-            }
-        }
-        beat(db, claim);
-    }).immediate();
-}
-export class OrchestratorDaemon {
-    constructor(config) {
-        this.unsubscribers = [];
-        this.startedAt = null;
-        /** Did THIS start() successfully claim sole-writer status? Set only when
-         * `ownsLedger` and only after `claimSoleWriter` returns without throwing --
-         * distinct from `startedAt`, since a LATER step (subscribe, reconcile) can
-         * still fail after the claim already succeeded. */
-        this.claimedWriter = false;
-        this.reconciledOnBoot = 0;
-        this.movedOnBoot = 0;
-        this.hub = config.hub;
-        this.beatIntervalMs = config.beatIntervalMs ?? 30000;
-        this.providedLedger = config.ledger;
-        this.ledgerPath = config.ledgerPath;
-        this.ownsLedger = config.ledger === undefined;
-        this.reconcileLimit = config.reconcileLimit ?? 50;
-    }
-    /** The ledger handle, once started. Throws before start, by design. */
-    get ledger() {
-        if (!this.db)
-            throw new Error("orchestrator: daemon is not started");
-        return this.db;
-    }
-    /**
-     * Open the ledger, replay what we slept through, then subscribe.
-     *
-     * Order matters. Reconciling BEFORE subscribing would race: an event
-     * arriving mid-replay could be written twice under two different orderings.
-     * Subscribing first is safe only because journal ids are content-derived, so
-     * an event seen live and again in the replay window collapses to one row.
-     */
-    start() {
-        if (this.startedAt)
-            return;
-        this.db = this.providedLedger ?? openLedger(this.ledgerPath);
-        try {
-            // Beat once synchronously (as part of the claim, when we own the
-            // ledger; on its own otherwise), so a reader can tell a live daemon
-            // from a dead one immediately rather than only after the first
-            // interval elapses. A freshly started daemon that has not beaten yet
-            // is indistinguishable from one that died, which is the exact
-            // confusion liveness exists to end.
-            const claim = { startedAt: new Date().toISOString(), pid: process.pid, host: hostname() };
-            if (this.ownsLedger) {
-                // Only when WE opened the connection: a ledger the caller shared
-                // with us (tests do this deliberately, to observe two reconcile
-                // passes against one database) is the caller's own concurrency to
-                // manage, not a second daemon PROCESS this check exists to catch.
-                //
-                // Check-and-claim as one atomic step -- this is also the daemon's
-                // FIRST beat, so a reader can tell this daemon apart from a dead one
-                // from the moment it wins the claim, before subscribing or
-                // reconciling even begin.
-                claimSoleWriter(this.db, claim);
-                this.claimedWriter = true;
-            }
-            else {
-                beat(this.db, claim);
-            }
-            this.unsubscribers.push(registerJournalWriter(this.db, this.hub));
-            // AFTER the journal writer, so the raw event is recorded before any
-            // status derived from it. Reversed, a throw in the reactor could leave a
-            // transition with no evidence of the event that caused it.
-            this.unsubscribers.push(registerReviewReactor(this.db, this.hub));
-            this.reconciledOnBoot = reconcileRecentEvents(this.db, this.hub, this.reconcileLimit);
-            // Journalling the window is not enough: the reactor is live-only, so a
-            // verdict that arrived while this daemon was down would be on record with
-            // the ticket never moved.
-            this.movedOnBoot = reconcileReviewState(this.db, this.hub, this.reconcileLimit);
-            const db = this.db;
-            this.beatTimer = setInterval(() => {
-                try {
-                    beat(db, { pid: process.pid, host: hostname() });
-                }
-                catch (err) {
-                    // A failed beat must not kill the daemon. Not being able to write
-                    // makes it LOOK dead to readers, which is the honest outcome, and
-                    // recovery is simply the next beat succeeding.
-                    console.error(`[orchestrator] liveness beat failed: ${err instanceof Error ? err.message : String(err)}`);
-                }
-            }, this.beatIntervalMs);
-            // Never hold the process open for a heartbeat alone, or a CLI that starts
-            // a daemon can never exit.
-            this.beatTimer.unref?.();
-        }
-        catch (err) {
-            // Start is all-or-nothing. Without this unwind a failure between
-            // subscribing and finishing leaves a LIVE handler on a daemon that
-            // reports itself stopped: `startedAt` is never set, so the idempotence
-            // guard above does not trip, and the next start() stacks a second
-            // subscription on top of a leaked ledger handle. Half-started is a
-            // worse state than not started, because nothing looks wrong.
-            this.teardown();
-            throw err;
-        }
-        this.startedAt = new Date().toISOString();
-    }
-    /**
-     * Detach everything and release the ledger, running every step even if an
-     * earlier one throws.
-     *
-     * Shared by {@link stop} and by start()'s failure path so the two cannot
-     * drift: a cleanup that only the error path exercises is a cleanup nobody
-     * tests. Returns the errors it collected rather than throwing, leaving the
-     * caller to decide whether a teardown failure should surface.
-     */
-    teardown() {
-        // First, so no beat can fire against a ledger this method is about to close.
-        // The reverse order is the same class of bug as leaving a hub handler
-        // attached: a timer outliving its database throws from a stack nobody owns.
-        if (this.beatTimer !== undefined) {
-            clearInterval(this.beatTimer);
-            this.beatTimer = undefined;
-        }
-        const errors = [];
-        for (const off of this.unsubscribers.splice(0)) {
-            try {
-                off();
-            }
-            catch (err) {
-                // Keep going. One hostile unsubscribe must not strand the others,
-                // and must not cost us the ledger close below.
-                errors.push(err);
-            }
-        }
-        if (this.ownsLedger && this.db) {
-            // Only a start() that actually WON the claim ever wrote this row.
-            // Erasing it after a start() that failed before claiming -- e.g.
-            // because claimSoleWriter refused it -- would destroy the OTHER
-            // daemon's evidence of being alive rather than our own. Distinct from
-            // `startedAt`: a LATER step (subscribe, reconcile) can still fail
-            // after the claim already succeeded, and this row is ours to clear
-            // either way.
-            if (this.claimedWriter) {
-                try {
-                    clearLiveness(this.db);
-                }
-                catch {
-                    // Best effort. Must not block closing the ledger below: a daemon
-                    // that leaked its handle over a failed liveness cleanup would be a
-                    // worse outcome than the next reader waiting out the stale window.
-                }
-            }
-            try {
-                this.db.close();
-            }
-            catch (err) {
-                errors.push(err);
-            }
-        }
-        this.db = undefined;
-        this.startedAt = null;
-        this.claimedWriter = false;
-        this.reconciledOnBoot = 0;
-        this.movedOnBoot = 0;
-        return errors;
-    }
-    /**
-     * Detach every subscription, then release the ledger if we opened it.
-     *
-     * Unsubscribing before closing is not tidiness: a handler still attached to
-     * a closed database throws inside the hub's emit loop, which is a failure in
-     * someone else's code caused by ours.
-     */
-    stop() {
-        const errors = this.teardown();
-        if (errors.length > 0) {
-            // Surface the failure, but only after every other step has run. A
-            // teardown that aborts on its first error is how a ledger handle leaks.
-            throw errors[0];
-        }
-    }
-    status() {
-        return {
-            running: this.startedAt !== null,
-            startedAt: this.startedAt,
-            reconciledOnBoot: this.reconciledOnBoot,
-            movedOnBoot: this.movedOnBoot,
-            liveness: this.db ? judgeLiveness(readLiveness(this.db), Date.now()) : null,
-        };
-    }
-}
-//# sourceMappingURL=daemon.js.map

package/dist/orchestrator/daemon.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"daemon.js","sourceRoot":"","sources":["../../src/orchestrator/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,UAAU,EAAe,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EACL,IAAI,EACJ,YAAY,EACZ,aAAa,EACb,aAAa,EACb,cAAc,GAEf,MAAM,kBAAkB,CAAC;AAG1B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,eAAe,CAAC,EAAU,EAAE,KAAgD;IAC1F,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;QAClB,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC/C,MAAM,cAAc,GAClB,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1E,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CACb,uDAAuD,GAAG,CAAC,GAAG,IAAI,SAAS,MAAM;oBAC/E,GAAG,GAAG,CAAC,IAAI,IAAI,iBAAiB,eAC9B,OAAO,CAAC,KAAK,IAAI,sBACnB,qEAAqE,CACxE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AACjB,CAAC;AAwCD,MAAM,OAAO,kBAAkB;IAmB7B,YAAY,MAAoB;QAfxB,kBAAa,GAAsB,EAAE,CAAC;QACtC,cAAS,GAAkB,IAAI,CAAC;QACxC;;;2DAGmD;QAC3C,kBAAa,GAAG,KAAK,CAAC;QACtB,qBAAgB,GAAG,CAAC,CAAC;QACrB,gBAAW,GAAG,CAAC,CAAC;QAQtB,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACtB,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,KAAM,CAAC;QACtD,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC;QAC9C,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;IACpD,CAAC;IAED,uEAAuE;IACvE,IAAI,MAAM;QACR,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,cAAc,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAE7D,IAAI,CAAC;YACH,iEAAiE;YACjE,oEAAoE;YACpE,+DAA+D;YAC/D,qEAAqE;YACrE,8DAA8D;YAC9D,oCAAoC;YACpC,MAAM,KAAK,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;YAC1F,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,iEAAiE;gBACjE,gEAAgE;gBAChE,kEAAkE;gBAClE,kEAAkE;gBAClE,EAAE;gBACF,kEAAkE;gBAClE,qEAAqE;gBACrE,2DAA2D;gBAC3D,0BAA0B;gBAC1B,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;gBAChC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACvB,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,oEAAoE;YACpE,yEAAyE;YACzE,2DAA2D;YAC3D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC,gBAAgB,GAAG,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YACtF,uEAAuE;YACvE,0EAA0E;YAC1E,0BAA0B;YAC1B,IAAI,CAAC,WAAW,GAAG,oBAAoB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YAEhF,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;gBAChC,IAAI,CAAC;oBACH,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;gBACnD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,kEAAkE;oBAClE,kEAAkE;oBAClE,+CAA+C;oBAC/C,OAAO,CAAC,KAAK,CACX,wCACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;gBACJ,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YACxB,0EAA0E;YAC1E,2BAA2B;YAC3B,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iEAAiE;YACjE,mEAAmE;YACnE,uEAAuE;YACvE,kEAAkE;YAClE,mEAAmE;YACnE,6DAA6D;YAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,CAAC;IAED;;;;;;;;OAQG;IACK,QAAQ;QACd,6EAA6E;QAC7E,sEAAsE;QACtE,4EAA4E;QAC5E,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC9B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7B,CAAC;QACD,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,GAAG,EAAE,CAAC;YACR,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,kEAAkE;gBAClE,+CAA+C;gBAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YAC/B,kEAAkE;YAClE,iEAAiE;YACjE,gEAAgE;YAChE,sEAAsE;YACtE,kEAAkE;YAClE,mEAAmE;YACnE,cAAc;YACd,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACzB,CAAC;gBAAC,MAAM,CAAC;oBACP,iEAAiE;oBACjE,mEAAmE;oBACnE,mEAAmE;gBACrE,CAAC;YACH,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,EAAE,GAAG,SAAS,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;QAC3B,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,IAAI;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,kEAAkE;YAClE,wEAAwE;YACxE,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,MAAM;QACJ,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI;YAChC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;SAC5E,CAAC;IACJ,CAAC;CACF"}

package/dist/orchestrator/db/dispatches.d.ts

@@ -1,108 +0,0 @@
-/**
- * Dispatch store (ORC-W1 PR-2).
- *
- * One row per task handed to a worker. Its job in PR-2 is correlation: it is
- * how an incoming hub event, which knows a taskId, becomes a journal entry
- * attached to the right ticket.
- *
- * @module orchestrator/db/dispatches
- */
-import { z } from "zod";
-import { type Ledger } from "./index.js";
-export declare const DispatchStatusSchema: z.ZodEnum<["dispatched", "in-progress", "completed", "failed"]>;
-export type DispatchStatus = z.infer<typeof DispatchStatusSchema>;
-export declare const DispatchRowSchema: z.ZodObject<{
-    task_id: z.ZodString;
-    ticket_id: z.ZodString;
-    worker_did: z.ZodString;
-    repo: z.ZodNullable<z.ZodString>;
-    branch: z.ZodNullable<z.ZodString>;
-    pr_number: z.ZodNullable<z.ZodNumber>;
-    status: z.ZodEnum<["dispatched", "in-progress", "completed", "failed"]>;
-    dispatched_at: z.ZodString;
-    completed_at: z.ZodNullable<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    status: "failed" | "completed" | "in-progress" | "dispatched";
-    repo: string | null;
-    ticket_id: string;
-    task_id: string;
-    worker_did: string;
-    branch: string | null;
-    pr_number: number | null;
-    dispatched_at: string;
-    completed_at: string | null;
-}, {
-    status: "failed" | "completed" | "in-progress" | "dispatched";
-    repo: string | null;
-    ticket_id: string;
-    task_id: string;
-    worker_did: string;
-    branch: string | null;
-    pr_number: number | null;
-    dispatched_at: string;
-    completed_at: string | null;
-}>;
-export type DispatchRow = z.infer<typeof DispatchRowSchema>;
-export interface RecordDispatchInput {
-    taskId: string;
-    ticketId: string;
-    workerDid: string;
-    repo?: string;
-    branch?: string;
-    prNumber?: number;
-}
-export declare function recordDispatch(db: Ledger, input: RecordDispatchInput): DispatchRow;
-export declare function getDispatch(db: Ledger, taskId: string): DispatchRow | undefined;
-/**
- * The ticket a task belongs to, or null when this task was never dispatched
- * through the ledger.
- *
- * Null is an ordinary answer, not an error: the hub is multi-tenant and emits
- * events for work this orchestrator did not start. The caller records the
- * observation with no ticket rather than guessing at one.
- */
-export declare function findTicketIdByTaskId(db: Ledger, taskId: string): string | null;
-/**
- * Find the ticket behind a pull request.
- *
- * The only correlation available for review events. `pr_quorum_reached` carries
- * `repo`/`prNumber`/`headSha` and no task id at all, and `review_verdict`'s task
- * id is optional AND belongs to the reviewer's task rather than the dispatch
- * that produced the branch. Without this, every quorum event lands in the
- * journal with a null ticket, which is why the Review lens could show that
- * something was approved but not what.
- *
- * `idx_dispatches_pr` already indexed (repo, pr_number) with no reader; this is
- * the reader it was waiting for.
- *
- * Newest dispatch wins. A PR reopened after a failed first attempt has two
- * dispatch rows, and the live one is the recent one.
- *
- * Ties break on `rowid` DESC, meaning last-inserted, because `dispatched_at`
- * has millisecond resolution and a retry loop can record two dispatches inside
- * one millisecond. Tiebreaking on `task_id` instead would order them
- * alphabetically, which silently returns whichever id happens to sort lower --
- * the older attempt as often as not.
- *
- * Null is an ordinary answer for the same reason as {@link findTicketIdByTaskId}:
- * the hub is multi-tenant and reviews PRs this orchestrator never dispatched.
- */
-export declare function findTicketIdByPr(db: Ledger, repo: string, prNumber: number): string | null;
-export declare function setDispatchStatus(db: Ledger, taskId: string, status: DispatchStatus): DispatchRow;
-/**
- * Read dispatches, newest first, optionally capped.
- *
- * The cap is applied in SQL rather than by the caller slicing the result.
- * Dispatches are never deleted, so this table only grows: a cap enforced after
- * the read bounds the RESPONSE while still asking SQLite to materialise every
- * dispatch ever recorded, which is the opposite of what a row cap is for. The
- * ticket and journal readers already capped in SQL for this reason; this one was
- * the outlier.
- *
- * `task_id` breaks ties because `dispatched_at` is an ISO timestamp and not
- * unique -- two dispatches recorded in the same millisecond would otherwise
- * order arbitrarily, and an arbitrary order at the cap boundary decides which
- * row is visible at all.
- */
-export declare function listDispatches(db: Ledger, limit?: number): DispatchRow[];
-//# sourceMappingURL=dispatches.d.ts.map

package/dist/orchestrator/db/dispatches.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dispatches.d.ts","sourceRoot":"","sources":["../../../src/orchestrator/db/dispatches.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAU,KAAK,MAAM,EAAE,MAAM,YAAY,CAAC;AAEjD,eAAO,MAAM,oBAAoB,iEAK/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAU5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,WAAW,CAelF;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAI/E;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI9E;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW1F;AAED,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,cAAc,GACrB,WAAW,CAUb;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,WAAW,EAAE,CAKxE"}

package/dist/orchestrator/db/dispatches.js

@@ -1,122 +0,0 @@
-/**
- * Dispatch store (ORC-W1 PR-2).
- *
- * One row per task handed to a worker. Its job in PR-2 is correlation: it is
- * how an incoming hub event, which knows a taskId, becomes a journal entry
- * attached to the right ticket.
- *
- * @module orchestrator/db/dispatches
- */
-import { z } from "zod";
-import { rowCap } from "./index.js";
-export const DispatchStatusSchema = z.enum([
-    "dispatched",
-    "in-progress",
-    "completed",
-    "failed",
-]);
-export const DispatchRowSchema = z.object({
-    task_id: z.string(),
-    ticket_id: z.string(),
-    worker_did: z.string(),
-    repo: z.string().nullable(),
-    branch: z.string().nullable(),
-    pr_number: z.number().nullable(),
-    status: DispatchStatusSchema,
-    dispatched_at: z.string(),
-    completed_at: z.string().nullable(),
-});
-export function recordDispatch(db, input) {
-    db.prepare(`INSERT INTO dispatches
-       (task_id, ticket_id, worker_did, repo, branch, pr_number, status, dispatched_at)
-     VALUES (?, ?, ?, ?, ?, ?, 'dispatched', ?)`).run(input.taskId, input.ticketId, input.workerDid, input.repo ?? null, input.branch ?? null, input.prNumber ?? null, new Date().toISOString());
-    return getDispatch(db, input.taskId);
-}
-export function getDispatch(db, taskId) {
-    const row = db.prepare(`SELECT * FROM dispatches WHERE task_id = ?`).get(taskId);
-    if (row === undefined || row === null)
-        return undefined;
-    return DispatchRowSchema.parse(row);
-}
-/**
- * The ticket a task belongs to, or null when this task was never dispatched
- * through the ledger.
- *
- * Null is an ordinary answer, not an error: the hub is multi-tenant and emits
- * events for work this orchestrator did not start. The caller records the
- * observation with no ticket rather than guessing at one.
- */
-export function findTicketIdByTaskId(db, taskId) {
-    const row = db.prepare(`SELECT ticket_id FROM dispatches WHERE task_id = ?`).get(taskId);
-    if (row === undefined || row === null)
-        return null;
-    return z.object({ ticket_id: z.string() }).parse(row).ticket_id;
-}
-/**
- * Find the ticket behind a pull request.
- *
- * The only correlation available for review events. `pr_quorum_reached` carries
- * `repo`/`prNumber`/`headSha` and no task id at all, and `review_verdict`'s task
- * id is optional AND belongs to the reviewer's task rather than the dispatch
- * that produced the branch. Without this, every quorum event lands in the
- * journal with a null ticket, which is why the Review lens could show that
- * something was approved but not what.
- *
- * `idx_dispatches_pr` already indexed (repo, pr_number) with no reader; this is
- * the reader it was waiting for.
- *
- * Newest dispatch wins. A PR reopened after a failed first attempt has two
- * dispatch rows, and the live one is the recent one.
- *
- * Ties break on `rowid` DESC, meaning last-inserted, because `dispatched_at`
- * has millisecond resolution and a retry loop can record two dispatches inside
- * one millisecond. Tiebreaking on `task_id` instead would order them
- * alphabetically, which silently returns whichever id happens to sort lower --
- * the older attempt as often as not.
- *
- * Null is an ordinary answer for the same reason as {@link findTicketIdByTaskId}:
- * the hub is multi-tenant and reviews PRs this orchestrator never dispatched.
- */
-export function findTicketIdByPr(db, repo, prNumber) {
-    const row = db
-        .prepare(`SELECT ticket_id FROM dispatches
-        WHERE repo = ? AND pr_number = ?
-        ORDER BY dispatched_at DESC, rowid DESC
-        LIMIT 1`)
-        .get(repo, prNumber);
-    if (row === undefined || row === null)
-        return null;
-    return z.object({ ticket_id: z.string() }).parse(row).ticket_id;
-}
-export function setDispatchStatus(db, taskId, status) {
-    const completedAt = status === "completed" || status === "failed" ? new Date().toISOString() : null;
-    const info = db
-        .prepare(`UPDATE dispatches SET status = ?, completed_at = ? WHERE task_id = ?`)
-        .run(status, completedAt, taskId);
-    if (info.changes === 0) {
-        throw new Error(`orchestrator: cannot update unknown dispatch ${taskId}`);
-    }
-    return getDispatch(db, taskId);
-}
-/**
- * Read dispatches, newest first, optionally capped.
- *
- * The cap is applied in SQL rather than by the caller slicing the result.
- * Dispatches are never deleted, so this table only grows: a cap enforced after
- * the read bounds the RESPONSE while still asking SQLite to materialise every
- * dispatch ever recorded, which is the opposite of what a row cap is for. The
- * ticket and journal readers already capped in SQL for this reason; this one was
- * the outlier.
- *
- * `task_id` breaks ties because `dispatched_at` is an ISO timestamp and not
- * unique -- two dispatches recorded in the same millisecond would otherwise
- * order arbitrarily, and an arbitrary order at the cap boundary decides which
- * row is visible at all.
- */
-export function listDispatches(db, limit) {
-    const rows = db
-        .prepare(`SELECT * FROM dispatches ORDER BY dispatched_at DESC, task_id DESC LIMIT ?`)
-        .all(rowCap(limit));
-    return z.array(DispatchRowSchema).parse(rows);
-}
-//# sourceMappingURL=dispatches.js.map

package/dist/orchestrator/db/dispatches.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dispatches.js","sourceRoot":"","sources":["../../../src/orchestrator/db/dispatches.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,EAAe,MAAM,YAAY,CAAC;AAEjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC;IACzC,YAAY;IACZ,aAAa;IACb,WAAW;IACX,QAAQ;CACT,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,oBAAoB;IAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAYH,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,KAA0B;IACnE,EAAE,CAAC,OAAO,CACR;;gDAE4C,CAC7C,CAAC,GAAG,CACH,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,IAAI,IAAI,IAAI,EAClB,KAAK,CAAC,MAAM,IAAI,IAAI,EACpB,KAAK,CAAC,QAAQ,IAAI,IAAI,EACtB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CACzB,CAAC;IACF,OAAO,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAU,EAAE,MAAc;IACpD,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjF,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxD,OAAO,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAU,EAAE,MAAc;IAC7D,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzF,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAU,EAAE,IAAY,EAAE,QAAgB;IACzE,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CACN;;;gBAGU,CACX;SACA,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,EAAU,EACV,MAAc,EACd,MAAsB;IAEtB,MAAM,WAAW,GACf,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,sEAAsE,CAAC;SAC/E,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,gDAAgD,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,WAAW,CAAC,EAAE,EAAE,MAAM,CAAE,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,KAAc;IACvD,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,4EAA4E,CAAC;SACrF,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtB,OAAO,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC"}

package/dist/orchestrator/db/index.d.ts

@@ -1,50 +0,0 @@
-/**
- * Ledger open + schema application.
- *
- * Lives inside `@kya-os/cli` rather than in a package of its own. The last
- * internal package extracted from this CLI (`@kya-os/cli-kit`) had exactly one
- * consumer and a `workspace:*` dependency that blocked publishing, and was
- * folded back in. One consumer does not justify a package.
- *
- * @module cli/orchestrator/db
- */
-import type BetterSqlite3 from "better-sqlite3";
-export type Ledger = BetterSqlite3.Database;
-/**
- * How long a writer waits on SQLite's own lock before giving up, in ms.
- *
- * Without this, a second connection's write against an already-locked
- * database gets `SQLITE_BUSY` back IMMEDIATELY -- not after a wait, on the
- * very first attempt -- and every caller here (the journal writer, the
- * liveness beat, a reconnect's replay) treats that as a genuine failure
- * rather than momentary contention. `busy_timeout` makes SQLite retry
- * acquiring the lock internally for this long before it reports busy, which
- * is what turns a same-instant collision between two writers into a queued
- * write instead of a dropped one.
- */
-export declare const LEDGER_BUSY_TIMEOUT_MS = 5000;
-/**
- * Turn an optional caller cap into a SQL `LIMIT` value.
- *
- * SQLite reads ANY negative LIMIT as "no limit", which is what makes the omitted
- * case a one-statement affair -- but it also means a caller who passes a bad cap
- * gets the whole table back. `-1` meaning unlimited is a deliberate sentinel;
- * `-5` arriving from a caller's arithmetic is a bug, and answering it with every
- * row is the exact failure a row cap exists to prevent, reached by asking for
- * fewer rows.
- *
- * Shared by every capped reader so the sentinel is written once and the
- * validation cannot be present in one store and missing in the next.
- */
-export declare function rowCap(limit: number | undefined): number;
-/** Per-user state directory for the orchestrator ledger. */
-export declare function stateDir(): string;
-/** Default on-disk location of the ledger. */
-export declare function defaultLedgerPath(): string;
-/**
- * Open (creating if absent) the ledger and apply the schema.
- *
- * Pass `":memory:"` for tests.
- */
-export declare function openLedger(path?: string): Ledger;
-//# sourceMappingURL=index.d.ts.map

package/dist/orchestrator/db/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/orchestrator/db/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,KAAK,aAAa,MAAM,gBAAgB,CAAC;AAGhD,MAAM,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC;AAI5C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,OAAQ,CAAC;AA0B5C;;;;;;;;;;;;GAYG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMxD;AAED,4DAA4D;AAC5D,wBAAgB,QAAQ,IAAI,MAAM,CAOjC;AAED,8CAA8C;AAC9C,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,GAAE,MAA4B,GAAG,MAAM,CA0BrE"}

package/dist/orchestrator/db/index.js

@@ -1,116 +0,0 @@
-/**
- * Ledger open + schema application.
- *
- * Lives inside `@kya-os/cli` rather than in a package of its own. The last
- * internal package extracted from this CLI (`@kya-os/cli-kit`) had exactly one
- * consumer and a `workspace:*` dependency that blocked publishing, and was
- * folded back in. One consumer does not justify a package.
- *
- * @module cli/orchestrator/db
- */
-import { createRequire } from "node:module";
-import { mkdirSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { homedir } from "node:os";
-import { LEDGER_SCHEMA } from "./schema.js";
-const require_ = createRequire(import.meta.url);
-/**
- * How long a writer waits on SQLite's own lock before giving up, in ms.
- *
- * Without this, a second connection's write against an already-locked
- * database gets `SQLITE_BUSY` back IMMEDIATELY -- not after a wait, on the
- * very first attempt -- and every caller here (the journal writer, the
- * liveness beat, a reconnect's replay) treats that as a genuine failure
- * rather than momentary contention. `busy_timeout` makes SQLite retry
- * acquiring the lock internally for this long before it reports busy, which
- * is what turns a same-instant collision between two writers into a queued
- * write instead of a dropped one.
- */
-export const LEDGER_BUSY_TIMEOUT_MS = 5000;
-/**
- * Load the SQLite driver on first use.
- *
- * `better-sqlite3` is an OPTIONAL dependency, and loaded lazily so it stays
- * that way in practice. It is the only native addon `@kya-os/cli` pulls in,
- * and the overwhelming majority of this CLI's users run `init`, `register` or
- * `dco` and never touch the orchestrator at all. A top-level import would make
- * every one of them download or compile it, and would break the entire CLI on
- * any platform lacking a prebuild, rather than just the commands that need a
- * database.
- */
-function loadDriver() {
-    try {
-        return require_("better-sqlite3");
-    }
-    catch (err) {
-        throw new Error("Orchestrator commands need the optional 'better-sqlite3' dependency, " +
-            "which is not installed or failed to build. Install it with " +
-            "`npm install better-sqlite3`. " +
-            `Underlying error: ${err instanceof Error ? err.message : String(err)}`);
-    }
-}
-/**
- * Turn an optional caller cap into a SQL `LIMIT` value.
- *
- * SQLite reads ANY negative LIMIT as "no limit", which is what makes the omitted
- * case a one-statement affair -- but it also means a caller who passes a bad cap
- * gets the whole table back. `-1` meaning unlimited is a deliberate sentinel;
- * `-5` arriving from a caller's arithmetic is a bug, and answering it with every
- * row is the exact failure a row cap exists to prevent, reached by asking for
- * fewer rows.
- *
- * Shared by every capped reader so the sentinel is written once and the
- * validation cannot be present in one store and missing in the next.
- */
-export function rowCap(limit) {
-    if (limit === undefined)
-        return -1;
-    if (!Number.isInteger(limit) || limit < 1) {
-        throw new Error(`orchestrator: limit must be a positive integer, got ${String(limit)}`);
-    }
-    return limit;
-}
-/** Per-user state directory for the orchestrator ledger. */
-export function stateDir() {
-    const override = process.env.KYA_OS_ORCHESTRATOR_STATE_DIR;
-    if (override)
-        return override;
-    const xdg = process.env.XDG_STATE_HOME;
-    return xdg
-        ? join(xdg, "kya-os", "orchestrator")
-        : join(homedir(), ".local", "state", "kya-os", "orchestrator");
-}
-/** Default on-disk location of the ledger. */
-export function defaultLedgerPath() {
-    return join(stateDir(), "ledger.db");
-}
-/**
- * Open (creating if absent) the ledger and apply the schema.
- *
- * Pass `":memory:"` for tests.
- */
-export function openLedger(path = defaultLedgerPath()) {
-    if (path !== ":memory:") {
-        mkdirSync(dirname(path), { recursive: true });
-    }
-    const Database = loadDriver();
-    const db = new Database(path);
-    // See LEDGER_BUSY_TIMEOUT_MS. Meaningless for a private `:memory:` database
-    // (no other connection can ever reach it), but harmless to set regardless --
-    // one pragma applied unconditionally beats a conditional whose only purpose
-    // is to skip a no-op.
-    db.pragma(`busy_timeout = ${LEDGER_BUSY_TIMEOUT_MS}`);
-    // WAL so a reader (a TUI, another CLI invocation) never blocks the writer.
-    // An in-memory database cannot journal to a file, and asking it to silently
-    // leaves journal_mode at "memory", so only set it where it means something.
-    if (path !== ":memory:") {
-        db.pragma("journal_mode = WAL");
-    }
-    // The schema leans on foreign keys (superseded_by, dispatches.ticket_id).
-    // SQLite defaults this OFF per-connection, so forgetting it turns every
-    // referential guarantee into a comment.
-    db.pragma("foreign_keys = ON");
-    db.exec(LEDGER_SCHEMA);
-    return db;
-}
-//# sourceMappingURL=index.js.map