@kya-os/cli 1.8.3 → 2.0.2

package/dist/orchestrator/db/schema.js

@@ -1,169 +0,0 @@
-/**
- * Orchestrator ledger schema.
- *
- * Inlined as a TypeScript constant rather than shipped as a `.sql` asset.
- * `@kya-os/cli` builds with a plain `tsc` chain that copies nothing, so a
- * separate file would need a build step to place it beside the compiled
- * output plus a runtime search to find it, and would fail only once, in a
- * published artifact, after passing every local test. A template literal has
- * none of those failure modes.
- *
- * @module cli/orchestrator/db/schema
- */
-export const LEDGER_SCHEMA = `
--- Two invariants are enforced here in SQL rather than in a prompt, because a
--- prompt cannot be atomic and a language model cannot be relied on to check a
--- precondition it was merely told about:
---
---   1. Claiming a ticket is one UPDATE (see db/tickets.ts claimNextTicket), so
---      two orchestrator ticks, or two orchestrators against one ledger, cannot
---      both staff the same ticket into two checkouts.
---   2. There is no delete path. A bad autonomous close and a clean backlog are
---      indistinguishable once the row is gone, so closing sets closed_reason
---      and leaves the row selectable.
-
--- Tickets: agent-native entries AND mirrored Linear issues in one table.
---   linear_id NULL  -> agent-native. Surfaced for a human to promote by hand;
---                      never auto-filed into Linear.
---   linear_id set   -> mirrored. The agent may comment and move status on it,
---                      and may never create one.
-CREATE TABLE IF NOT EXISTS tickets (
-  id             TEXT PRIMARY KEY,
-  linear_id      TEXT UNIQUE,
-  title          TEXT NOT NULL,
-  body           TEXT,
-  status         TEXT NOT NULL DEFAULT 'open',
-  severity       TEXT,
-  source         TEXT NOT NULL,
-  claimed_by     TEXT,
-  claimed_at     TEXT,
-  closed_reason  TEXT,
-  superseded_by  TEXT REFERENCES tickets(id),
-  created_at     TEXT NOT NULL,
-  updated_at     TEXT NOT NULL,
-  -- 'blocked' mirrors the DIDComm TaskStatus vocabulary and is the honest
-  -- resting place for work stalled on a human decision. Without it that
-  -- state has to be smuggled into prose, where nothing can query it.
-  CHECK (status IN ('open','claimed','in-progress','in-review','blocked','ready','closed')),
-  CHECK (severity IS NULL OR severity IN ('blocking','major','minor','nit')),
-  CHECK (source IN ('linear','log_scan','review_finding','manual')),
-  -- A ticket cannot supersede itself. Longer cycles are the store layer's
-  -- problem; this catches the trivial one for free.
-  CHECK (superseded_by IS NULL OR superseded_by <> id)
-);
-CREATE INDEX IF NOT EXISTS idx_tickets_status ON tickets(status);
-CREATE INDEX IF NOT EXISTS idx_tickets_linear ON tickets(linear_id);
--- Serves the newest-first window listTickets takes before it re-sorts. See the
--- note on idx_dispatches_dispatched: an unindexed ORDER BY makes the row cap
--- bound the response without bounding the scan behind it.
-CREATE INDEX IF NOT EXISTS idx_tickets_created ON tickets(created_at DESC, id DESC);
-
--- Journal: what the daemon OBSERVED, written from verified protocol events
--- rather than from a model narrating its own behaviour.
---
--- event_type is TEXT, deliberately not a CHECK constraint: the hub's event
--- union widens over time (review_verdict and pr_quorum_reached arrived with
--- PR #661), and a ledger that rejects an event type it has not been taught is
--- a ledger that loses exactly the events worth having.
-CREATE TABLE IF NOT EXISTS journal (
-  id          TEXT PRIMARY KEY,
-  ticket_id   TEXT REFERENCES tickets(id),
-  event_type  TEXT NOT NULL,
-  agent_did   TEXT,
-  agent_name  TEXT,
-  data        TEXT NOT NULL,
-  observed_at TEXT NOT NULL
-);
-CREATE INDEX IF NOT EXISTS idx_journal_ticket ON journal(ticket_id, observed_at DESC);
-CREATE INDEX IF NOT EXISTS idx_journal_observed ON journal(observed_at DESC);
-
--- Dispatches: one row per task handed to a worker.
-CREATE TABLE IF NOT EXISTS dispatches (
-  task_id       TEXT PRIMARY KEY,
-  ticket_id     TEXT NOT NULL REFERENCES tickets(id),
-  worker_did    TEXT NOT NULL,
-  repo          TEXT,
-  branch        TEXT,
-  pr_number     INTEGER,
-  status        TEXT NOT NULL,
-  dispatched_at TEXT NOT NULL,
-  completed_at  TEXT,
-  CHECK (status IN ('dispatched','in-progress','completed','failed'))
-);
-CREATE INDEX IF NOT EXISTS idx_dispatches_pr ON dispatches(repo, pr_number);
--- Serves the newest-first read. Without it a capped list is a full scan plus a
--- temp B-tree sort, so LIMIT bounds the answer while the work grows with a table
--- nothing ever deletes from. The journal's idx_journal_observed exists for the
--- same reason; these two were simply missed.
-CREATE INDEX IF NOT EXISTS idx_dispatches_dispatched
-  ON dispatches(dispatched_at DESC, task_id DESC);
-
--- Verdicts: populated once the review loop is wired. Created now so that is a
--- pure wire-up with no migration of its own.
---
--- The UNIQUE is what makes quorum counting idempotent under replay: one
--- verdict per reviewer per head SHA, so a redelivered event updates rather
--- than double-counts.
-CREATE TABLE IF NOT EXISTS verdicts (
-  id           TEXT PRIMARY KEY,
-  ticket_id    TEXT REFERENCES tickets(id),
-  repo         TEXT NOT NULL,
-  pr_number    INTEGER NOT NULL,
-  head_sha     TEXT NOT NULL,
-  reviewer_did TEXT NOT NULL,
-  verdict      TEXT NOT NULL,
-  findings     TEXT,
-  counted      INTEGER NOT NULL DEFAULT 0,
-  received_at  TEXT NOT NULL,
-  UNIQUE (repo, pr_number, head_sha, reviewer_did),
-  CHECK (verdict IN ('approve','request-changes','comment'))
-);
-CREATE INDEX IF NOT EXISTS idx_verdicts_pr ON verdicts(repo, pr_number, head_sha);
-
--- Quorum reached, at the grain quorum actually has: a property of one PR head,
--- not of a reviewer. It cannot live in the verdicts table, whose natural key
--- includes reviewer_did. The hub is the authority on whether quorum was met: it
--- owns verdict validation, so re-deriving the threshold here could disagree
--- with it. Recording the hub's conclusion under its own natural key is what
--- makes acting on it idempotent without a synthetic marker.
--- Daemon liveness. Deliberately NOT called a heartbeat: compute already owns
--- that word for agent liveness posted to AgentShield, which is a different
--- process reporting a different thing to a different consumer. Conflating them
--- would also drag the daemon toward compute, against the placement decision
--- that keeps the single writer of this ledger out of a Fly worker's PID 1.
---
--- ONE row, replaced in place, and the only table here that is not append-only.
--- Liveness is a current fact: "is the daemon up" has one answer, and a history
--- of beats grows without bound while answering nothing the journal cannot.
-CREATE TABLE IF NOT EXISTS daemon_liveness (
-  id           TEXT PRIMARY KEY CHECK (id = 'daemon'),
-  started_at   TEXT NOT NULL,
-  last_beat_at TEXT NOT NULL,
-  pid          INTEGER,
-  host         TEXT
-);
-
--- The standing objective an orchestrator session reads on waking, so it can
--- resume intent rather than re-derive it from a ledger full of mechanics.
---
--- Append-only, unlike liveness: changing the mission IS a decision, and the
--- previous one is worth being able to read back. Newest row is current.
-CREATE TABLE IF NOT EXISTS mission_notes (
-  id         TEXT PRIMARY KEY,
-  body       TEXT NOT NULL,
-  author     TEXT NOT NULL,
-  written_at TEXT NOT NULL
-);
-CREATE INDEX IF NOT EXISTS idx_mission_written ON mission_notes(written_at DESC);
-
-CREATE TABLE IF NOT EXISTS pr_quorum (
-  repo        TEXT NOT NULL,
-  pr_number   INTEGER NOT NULL,
-  head_sha    TEXT NOT NULL,
-  ticket_id   TEXT REFERENCES tickets(id),
-  quorum_n    INTEGER,
-  reached_at  TEXT NOT NULL,
-  PRIMARY KEY (repo, pr_number, head_sha)
-);
-`;
-//# sourceMappingURL=schema.js.map

package/dist/orchestrator/db/schema.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/orchestrator/db/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2J5B,CAAC"}

package/dist/orchestrator/db/tickets.d.ts

@@ -1,147 +0,0 @@
-/**
- * Ticket store (ORC-W1 PR-1).
- *
- * The two load-bearing operations live here, and both encode their invariant
- * in SQL rather than in a caller's discipline.
- *
- * @module orchestrator/db/tickets
- */
-import { z } from "zod";
-import { type Ledger } from "./index.js";
-export declare const TicketStatusSchema: z.ZodEnum<["open", "claimed", "in-progress", "in-review", "blocked", "ready", "closed"]>;
-export type TicketStatus = z.infer<typeof TicketStatusSchema>;
-/**
- * The statuses `setTicketStatus` is allowed to write.
- *
- * `closed` and `claimed` each carry something a bare status write cannot -- a
- * recorded reason, and a claimant set in the same statement -- so each has a
- * dedicated function here and neither is reachable through the generic setter.
- *
- * Defined in the STORE and not at the MCP boundary, because the boundary is
- * only one of the entrances. The daemon, the CLI and any consumer of the built
- * package call these functions directly, and a rule that holds at one door is
- * not an invariant, it is a convention with good manners.
- */
-export declare const SettableTicketStatusSchema: z.ZodEnum<["open", "in-progress", "in-review", "blocked", "ready"]>;
-export type SettableTicketStatus = z.infer<typeof SettableTicketStatusSchema>;
-export declare const SETTABLE_TICKET_STATUSES: ["open", "in-progress", "in-review", "blocked", "ready"];
-export declare const TicketSeveritySchema: z.ZodEnum<["blocking", "major", "minor", "nit"]>;
-export type TicketSeverity = z.infer<typeof TicketSeveritySchema>;
-export declare const TicketSourceSchema: z.ZodEnum<["linear", "log_scan", "review_finding", "manual"]>;
-export type TicketSource = z.infer<typeof TicketSourceSchema>;
-/**
- * Shape of a `tickets` row.
- *
- * Rows are parsed rather than cast. better-sqlite3's `.get()` is typed `any`,
- * so `as Ticket` would not merely be an unchecked assumption, it would switch
- * off checking for everything downstream of it — the repo bans exactly that.
- * Parsing also means a schema drift (a migration that renames a column, a
- * hand-edited ledger) fails loudly at the read instead of surfacing as
- * `undefined` three layers away.
- */
-export declare const TicketRowSchema: z.ZodObject<{
-    id: z.ZodString;
-    linear_id: z.ZodNullable<z.ZodString>;
-    title: z.ZodString;
-    body: z.ZodNullable<z.ZodString>;
-    status: z.ZodEnum<["open", "claimed", "in-progress", "in-review", "blocked", "ready", "closed"]>;
-    severity: z.ZodNullable<z.ZodEnum<["blocking", "major", "minor", "nit"]>>;
-    source: z.ZodEnum<["linear", "log_scan", "review_finding", "manual"]>;
-    claimed_by: z.ZodNullable<z.ZodString>;
-    claimed_at: z.ZodNullable<z.ZodString>;
-    closed_reason: z.ZodNullable<z.ZodString>;
-    superseded_by: z.ZodNullable<z.ZodString>;
-    created_at: z.ZodString;
-    updated_at: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    id: string;
-    status: "open" | "closed" | "ready" | "claimed" | "in-progress" | "in-review" | "blocked";
-    body: string | null;
-    source: "linear" | "log_scan" | "review_finding" | "manual";
-    linear_id: string | null;
-    title: string;
-    severity: "blocking" | "major" | "minor" | "nit" | null;
-    claimed_by: string | null;
-    claimed_at: string | null;
-    closed_reason: string | null;
-    superseded_by: string | null;
-    created_at: string;
-    updated_at: string;
-}, {
-    id: string;
-    status: "open" | "closed" | "ready" | "claimed" | "in-progress" | "in-review" | "blocked";
-    body: string | null;
-    source: "linear" | "log_scan" | "review_finding" | "manual";
-    linear_id: string | null;
-    title: string;
-    severity: "blocking" | "major" | "minor" | "nit" | null;
-    claimed_by: string | null;
-    claimed_at: string | null;
-    closed_reason: string | null;
-    superseded_by: string | null;
-    created_at: string;
-    updated_at: string;
-}>;
-export type Ticket = z.infer<typeof TicketRowSchema>;
-export interface CreateTicketInput {
-    title: string;
-    source: TicketSource;
-    body?: string;
-    severity?: TicketSeverity;
-    linearId?: string;
-    id?: string;
-}
-/** Insert a ticket in the `open` state. */
-export declare function createTicket(db: Ledger, input: CreateTicketInput): Ticket;
-export declare function getTicket(db: Ledger, id: string): Ticket | undefined;
-/**
- * Claim the oldest open ticket, atomically.
- *
- * The claim and the mark are ONE statement. A read-then-write pair here is a
- * review-blocking defect, not a style preference: two orchestrator ticks, or
- * two orchestrators pointed at one ledger, would both read the same open
- * ticket and both staff it, producing two workers on one ticket in two
- * checkouts. With a single UPDATE the losing caller changes zero rows and
- * moves on.
- *
- * Returns null when nothing was claimable, which is an ordinary outcome and
- * never an error.
- */
-export declare function claimNextTicket(db: Ledger, workerDid: string): Ticket | null;
-/**
- * Close a ticket by marking it, never by deleting it.
- *
- * There is deliberately no delete path anywhere in this package. Once a row is
- * gone, a bad autonomous close and a clean backlog look identical, and the
- * evidence needed to tell them apart went with it.
- */
-export declare function closeTicket(db: Ledger, id: string, reason: string, supersededBy?: string): Ticket;
-/**
- * Move a ticket to one of the statuses a plain status write can express.
- *
- * `closed` and `claimed` are refused: see `SettableTicketStatusSchema`. The
- * check is made at RUNTIME and not left to the parameter type, because the
- * callers it guards are the ones TypeScript never sees -- JavaScript consumers
- * of the built package, and anything arriving through an `unknown`. A type
- * cannot stop a caller that was never type-checked.
- */
-export declare function setTicketStatus(db: Ledger, id: string, status: SettableTicketStatus): Ticket;
-/**
- * Read tickets, optionally filtered, optionally capped.
- *
- * The cap is applied HERE, to the newest rows, not by the caller slicing an
- * oldest-first list. Tickets soft-close and are never deleted, so closed
- * history accumulates at the front of `created_at` order: capping afterwards
- * meant that once the ledger outgrew the cap, an unfiltered read could be
- * entirely closed rows with every open ticket invisible behind them. The
- * journal and dispatch readers already ordered newest-first; this one was the
- * outlier.
- *
- * The window is taken newest-first and then handed back oldest-first, so the
- * result reads in the natural direction while still being the recent end of the
- * ledger. `id` breaks ties because `created_at` alone is not unique -- two
- * tickets made in the same millisecond would otherwise order arbitrarily, and
- * an arbitrary order at the cap boundary decides which row is visible at all.
- */
-export declare function listTickets(db: Ledger, status?: TicketStatus, limit?: number): Ticket[];
-//# sourceMappingURL=tickets.d.ts.map

package/dist/orchestrator/db/tickets.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"tickets.d.ts","sourceRoot":"","sources":["../../../src/orchestrator/db/tickets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAU,KAAK,MAAM,EAAE,MAAM,YAAY,CAAC;AAEjD,eAAO,MAAM,kBAAkB,0FAQ7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,qEAAoD,CAAC;AAC5F,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,eAAO,MAAM,wBAAwB,0DAAqC,CAAC;AAgB3E,eAAO,MAAM,oBAAoB,kDAAgD,CAAC;AAClF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,kBAAkB,+DAA6D,CAAC;AAC7F,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAc1B,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAQrD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,2CAA2C;AAC3C,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAiBzE;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgB5E;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,EAAE,EAAE,MAAM,EACV,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,GACpB,MAAM,CA4CR;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAqC5F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAkBvF"}

package/dist/orchestrator/db/tickets.js

@@ -1,238 +0,0 @@
-/**
- * Ticket store (ORC-W1 PR-1).
- *
- * The two load-bearing operations live here, and both encode their invariant
- * in SQL rather than in a caller's discipline.
- *
- * @module orchestrator/db/tickets
- */
-import { randomUUID } from "node:crypto";
-import { z } from "zod";
-import { rowCap } from "./index.js";
-export const TicketStatusSchema = z.enum([
-    "open",
-    "claimed",
-    "in-progress",
-    "in-review",
-    "blocked",
-    "ready",
-    "closed",
-]);
-/**
- * The statuses `setTicketStatus` is allowed to write.
- *
- * `closed` and `claimed` each carry something a bare status write cannot -- a
- * recorded reason, and a claimant set in the same statement -- so each has a
- * dedicated function here and neither is reachable through the generic setter.
- *
- * Defined in the STORE and not at the MCP boundary, because the boundary is
- * only one of the entrances. The daemon, the CLI and any consumer of the built
- * package call these functions directly, and a rule that holds at one door is
- * not an invariant, it is a convention with good manners.
- */
-export const SettableTicketStatusSchema = TicketStatusSchema.exclude(["closed", "claimed"]);
-export const SETTABLE_TICKET_STATUSES = SettableTicketStatusSchema.options;
-/**
- * Why each excluded status is excluded, so a refusal names its replacement
- * rather than just saying no.
- *
- * Null-prototyped, so a lookup answers for its OWN keys only. As a plain object
- * literal every inherited name resolved -- `toString`, `constructor`,
- * `__proto__` -- and `?? fallback` never fired, so a caller could steer the
- * refusal into printing a native function body instead of the settable list.
- */
-const UNSETTABLE_STATUS_REASON = Object.assign(Object.create(null), {
-    closed: "closing must record a reason, use closeTicket",
-    claimed: "claiming must set a claimant in the same statement, use claimNextTicket",
-});
-export const TicketSeveritySchema = z.enum(["blocking", "major", "minor", "nit"]);
-export const TicketSourceSchema = z.enum(["linear", "log_scan", "review_finding", "manual"]);
-/**
- * Shape of a `tickets` row.
- *
- * Rows are parsed rather than cast. better-sqlite3's `.get()` is typed `any`,
- * so `as Ticket` would not merely be an unchecked assumption, it would switch
- * off checking for everything downstream of it — the repo bans exactly that.
- * Parsing also means a schema drift (a migration that renames a column, a
- * hand-edited ledger) fails loudly at the read instead of surfacing as
- * `undefined` three layers away.
- */
-export const TicketRowSchema = z.object({
-    id: z.string(),
-    linear_id: z.string().nullable(),
-    title: z.string(),
-    body: z.string().nullable(),
-    status: TicketStatusSchema,
-    severity: TicketSeveritySchema.nullable(),
-    source: TicketSourceSchema,
-    claimed_by: z.string().nullable(),
-    claimed_at: z.string().nullable(),
-    closed_reason: z.string().nullable(),
-    superseded_by: z.string().nullable(),
-    created_at: z.string(),
-    updated_at: z.string(),
-});
-/** Parse one row, or undefined when the query matched nothing. */
-function parseRow(row) {
-    if (row === undefined || row === null)
-        return undefined;
-    return TicketRowSchema.parse(row);
-}
-/** Insert a ticket in the `open` state. */
-export function createTicket(db, input) {
-    const now = new Date().toISOString();
-    const id = input.id ?? randomUUID();
-    db.prepare(`INSERT INTO tickets (id, linear_id, title, body, status, severity, source, created_at, updated_at)
-     VALUES (?, ?, ?, ?, 'open', ?, ?, ?, ?)`).run(id, input.linearId ?? null, input.title, input.body ?? null, input.severity ?? null, input.source, now, now);
-    return getTicket(db, id);
-}
-export function getTicket(db, id) {
-    return parseRow(db.prepare(`SELECT * FROM tickets WHERE id = ?`).get(id));
-}
-/**
- * Claim the oldest open ticket, atomically.
- *
- * The claim and the mark are ONE statement. A read-then-write pair here is a
- * review-blocking defect, not a style preference: two orchestrator ticks, or
- * two orchestrators pointed at one ledger, would both read the same open
- * ticket and both staff it, producing two workers on one ticket in two
- * checkouts. With a single UPDATE the losing caller changes zero rows and
- * moves on.
- *
- * Returns null when nothing was claimable, which is an ordinary outcome and
- * never an error.
- */
-export function claimNextTicket(db, workerDid) {
-    const now = new Date().toISOString();
-    const row = db
-        .prepare(`UPDATE tickets
-          SET status = 'claimed', claimed_by = ?, claimed_at = ?, updated_at = ?
-        WHERE id = (
-                SELECT id FROM tickets
-                 WHERE status = 'open'
-                 ORDER BY created_at, id
-                 LIMIT 1
-              )
-    RETURNING *`)
-        .get(workerDid, now, now);
-    return parseRow(row) ?? null;
-}
-/**
- * Close a ticket by marking it, never by deleting it.
- *
- * There is deliberately no delete path anywhere in this package. Once a row is
- * gone, a bad autonomous close and a clean backlog look identical, and the
- * evidence needed to tell them apart went with it.
- */
-export function closeTicket(db, id, reason, supersededBy) {
-    // Enforced here and not only at the tool, for the reason the whole module
-    // exists: "nothing is ever deleted" buys an audit trail only if the surviving
-    // row says WHY it closed, and a blank reason produces the unexplained closed
-    // row permanently, since a second close is refused.
-    if (reason.trim() === "") {
-        throw new Error(`orchestrator: closing ticket ${id} needs a non-empty reason`);
-    }
-    const info = db
-        .prepare(`UPDATE tickets
-          SET status        = 'closed',
-              closed_reason = ?,
-              superseded_by = ?,
-              updated_at    = ?,
-              -- Closing LEAVES claimed, so it releases the claim too. The rule
-              -- lived only in setTicketStatus, so a closed row kept naming a
-              -- live worker and answered "who holds this" in flat contradiction
-              -- of its own status. In the same statement, so the release cannot
-              -- be separated from the close by a failure between them.
-              -- If a third writer ever leaves claimed, move this to a trigger
-              -- rather than writing the rule a third time.
-              claimed_by    = NULL,
-              claimed_at    = NULL
-        WHERE id = ?
-          AND status <> 'closed'`)
-        .run(reason, supersededBy ?? null, new Date().toISOString(), id);
-    if (info.changes === 0) {
-        const existing = getTicket(db, id);
-        if (existing === undefined) {
-            throw new Error(`orchestrator: cannot close unknown ticket ${id}`);
-        }
-        // Closing twice used to overwrite the original reason and NULL out
-        // superseded_by, which reduces "soft, auditable close" to one mutable
-        // column: the record of WHY something closed is the point of not deleting
-        // it, and a second close silently replaces that record.
-        throw new Error(`orchestrator: ticket ${id} is already closed (${existing.closed_reason ?? "no reason recorded"})`);
-    }
-    return getTicket(db, id);
-}
-/**
- * Move a ticket to one of the statuses a plain status write can express.
- *
- * `closed` and `claimed` are refused: see `SettableTicketStatusSchema`. The
- * check is made at RUNTIME and not left to the parameter type, because the
- * callers it guards are the ones TypeScript never sees -- JavaScript consumers
- * of the built package, and anything arriving through an `unknown`. A type
- * cannot stop a caller that was never type-checked.
- */
-export function setTicketStatus(db, id, status) {
-    if (!SettableTicketStatusSchema.safeParse(status).success) {
-        const because = UNSETTABLE_STATUS_REASON[status] ??
-            `settable statuses are ${SETTABLE_TICKET_STATUSES.join(", ")}`;
-        throw new Error(`orchestrator: setTicketStatus cannot set '${status}'; ${because}`);
-    }
-    const info = db
-        .prepare(`UPDATE tickets
-          SET status     = ?,
-              updated_at = ?,
-              -- Any transition AWAY from claimed releases the claim, in the same
-              -- statement so the release cannot be separated from the status
-              -- change by a failure between them. Unconditional because the
-              -- guard above makes 'claimed' unreachable here: every status this
-              -- statement can write is a status that leaves it.
-              claimed_by = NULL,
-              claimed_at = NULL
-        WHERE id = ?
-          AND status <> 'closed'`)
-        .run(status, new Date().toISOString(), id);
-    if (info.changes === 0) {
-        // Distinguish the two ways to change nothing, because they mean opposite
-        // things to a caller: one is a bad id, the other is a refused transition.
-        const existing = getTicket(db, id);
-        if (existing === undefined) {
-            throw new Error(`orchestrator: cannot update unknown ticket ${id}`);
-        }
-        throw new Error(`orchestrator: ticket ${id} is closed; reopening is a human decision, not a status write`);
-    }
-    return getTicket(db, id);
-}
-/**
- * Read tickets, optionally filtered, optionally capped.
- *
- * The cap is applied HERE, to the newest rows, not by the caller slicing an
- * oldest-first list. Tickets soft-close and are never deleted, so closed
- * history accumulates at the front of `created_at` order: capping afterwards
- * meant that once the ledger outgrew the cap, an unfiltered read could be
- * entirely closed rows with every open ticket invisible behind them. The
- * journal and dispatch readers already ordered newest-first; this one was the
- * outlier.
- *
- * The window is taken newest-first and then handed back oldest-first, so the
- * result reads in the natural direction while still being the recent end of the
- * ledger. `id` breaks ties because `created_at` alone is not unique -- two
- * tickets made in the same millisecond would otherwise order arbitrarily, and
- * an arbitrary order at the cap boundary decides which row is visible at all.
- */
-export function listTickets(db, status, limit) {
-    const cap = rowCap(limit);
-    const rows = status
-        ? db
-            .prepare(`SELECT * FROM (
-             SELECT * FROM tickets WHERE status = ? ORDER BY created_at DESC, id DESC LIMIT ?
-           ) ORDER BY created_at, id`)
-            .all(status, cap)
-        : db
-            .prepare(`SELECT * FROM (
-             SELECT * FROM tickets ORDER BY created_at DESC, id DESC LIMIT ?
-           ) ORDER BY created_at, id`)
-            .all(cap);
-    return z.array(TicketRowSchema).parse(rows);
-}
-//# sourceMappingURL=tickets.js.map

package/dist/orchestrator/db/tickets.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tickets.js","sourceRoot":"","sources":["../../../src/orchestrator/db/tickets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,EAAe,MAAM,YAAY,CAAC;AAEjD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC;IACvC,MAAM;IACN,SAAS;IACT,aAAa;IACb,WAAW;IACX,SAAS;IACT,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAE5F,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAC,OAAO,CAAC;AAE3E;;;;;;;;GAQG;AACH,MAAM,wBAAwB,GAA2B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;IAC1F,MAAM,EAAE,+CAA+C;IACvD,OAAO,EAAE,yEAAyE;CACnF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAGlF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC;AAG7F;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,kBAAkB;IAC1B,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,kBAAkB;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAIH,kEAAkE;AAClE,SAAS,QAAQ,CAAC,GAAY;IAC5B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxD,OAAO,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAWD,2CAA2C;AAC3C,MAAM,UAAU,YAAY,CAAC,EAAU,EAAE,KAAwB;IAC/D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,UAAU,EAAE,CAAC;IACpC,EAAE,CAAC,OAAO,CACR;6CACyC,CAC1C,CAAC,GAAG,CACH,EAAE,EACF,KAAK,CAAC,QAAQ,IAAI,IAAI,EACtB,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,IAAI,IAAI,EAClB,KAAK,CAAC,QAAQ,IAAI,IAAI,EACtB,KAAK,CAAC,MAAM,EACZ,GAAG,EACH,GAAG,CACJ,CAAC;IACF,OAAO,SAAS,CAAC,EAAE,EAAE,EAAE,CAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAU,EAAE,EAAU;IAC9C,OAAO,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,EAAU,EAAE,SAAiB;IAC3D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CACN;;;;;;;;gBAQU,CACX;SACA,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5B,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,EAAU,EACV,EAAU,EACV,MAAc,EACd,YAAqB;IAErB,0EAA0E;IAC1E,8EAA8E;IAC9E,6EAA6E;IAC7E,oDAAoD;IACpD,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,gCAAgC,EAAE,2BAA2B,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CACN;;;;;;;;;;;;;;;iCAe2B,CAC5B;SACA,GAAG,CAAC,MAAM,EAAE,YAAY,IAAI,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IAEnE,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,6CAA6C,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,mEAAmE;QACnE,sEAAsE;QACtE,0EAA0E;QAC1E,wDAAwD;QACxD,MAAM,IAAI,KAAK,CACb,wBAAwB,EAAE,uBAAuB,QAAQ,CAAC,aAAa,IAAI,oBAAoB,GAAG,CACnG,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,EAAE,EAAE,EAAE,CAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,EAAU,EAAE,EAAU,EAAE,MAA4B;IAClF,IAAI,CAAC,0BAA0B,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1D,MAAM,OAAO,GACX,wBAAwB,CAAC,MAAM,CAAC;YAChC,yBAAyB,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,6CAA6C,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CACN;;;;;;;;;;;iCAW2B,CAC5B;SACA,GAAG,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IAE7C,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACvB,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,8CAA8C,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,wBAAwB,EAAE,+DAA+D,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,EAAE,EAAE,EAAE,CAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CAAC,EAAU,EAAE,MAAqB,EAAE,KAAc;IAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,MAAM;QACjB,CAAC,CAAC,EAAE;aACC,OAAO,CACN;;qCAE2B,CAC5B;aACA,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC;QACrB,CAAC,CAAC,EAAE;aACC,OAAO,CACN;;qCAE2B,CAC5B;aACA,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,OAAO,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC"}