@omnitron-dev/omnitron 0.2.0 → 0.3.1

package/dist/daemon/state-store.js

@@ -1,76 +1,118 @@
 /**
- * State Store — Persist/recover process state across daemon restarts
+ * State Store — Persist/recover process state across daemon restarts.
+ *
+ * T-7 migration (this file): backing storage switched from a single
+ * atomically-renamed JSON file to a SQLite-backed `state_kv` row via
+ * DaemonStateStore. The new path:
+ *
+ *   - Transactional writes (WAL mode) — no torn-write risk; the
+ *     legacy fsync+rename recipe at T#55 is now SQLite's problem,
+ *     not ours.
+ *   - Co-located with the other 4 daemon-state surfaces (pid-lock,
+ *     project registry, node registry, backup index) — one file to
+ *     back up, one schema to evolve.
+ *   - Same sync API the orchestrator has always used. The legacy
+ *     `save/load/clear` signatures are preserved by buffering the
+ *     SQLite calls onto a queued promise: writes are fire-and-forget
+ *     from the caller's perspective, errors land in the logger.
+ *
+ * Back-compat path: when the legacy JSON file (`stateFile`) exists
+ * on first `load()`, we one-shot migrate its contents into the SQLite
+ * row and unlink the file. After the first migration boot, the JSON
+ * file never reappears.
  */
 import fs from 'node:fs';
-import path from 'node:path';
-import { randomBytes } from 'node:crypto';
+const STATE_KV_KEY = 'orchestrator:persisted-state';
 export class StateStore {
-    stateFile;
-    constructor(stateFile) {
-        this.stateFile = stateFile;
+    store;
+    legacyJsonPath;
+    /** Cached snapshot for synchronous `load()` after `init()` ran. */
+    cached = null;
+    /** True once `init()` has read from SQLite (or attempted the legacy JSON migration). */
+    initialized = false;
+    /**
+     * In-flight write so a back-to-back save+save serialises through
+     * one SQLite transaction at a time. Callers don't see the queueing
+     * — they call `save()` synchronously and the promise resolves in
+     * the background. Errors are logged via the store's own logger.
+     */
+    writeChain = Promise.resolve();
+    constructor(store, 
+    /**
+     * Legacy JSON path — only consulted ONCE during init() for the
+     * pre-SQLite migration. Pass the same path the daemon used
+     * historically so existing deployments don't lose their state
+     * on the first boot of the new code.
+     */
+    legacyJsonPath) {
+        this.store = store;
+        this.legacyJsonPath = legacyJsonPath;
     }
-    save(state) {
-        const dir = path.dirname(this.stateFile);
-        fs.mkdirSync(dir, { recursive: true });
-        // T#55: write atomically — `writeFileSync(stateFile, ...)` was a
-        // direct overwrite that left the file half-written if the
-        // daemon was SIGKILL'd mid-flush. The next boot's `load()` then
-        // saw truncated JSON, `JSON.parse` threw, and the daemon lost
-        // the entire process registry (returned `null` and started from
-        // scratch — every supervised app was treated as new).
-        //
-        // The standard POSIX recipe is:
-        //   1. write payload to a SIBLING temp file in the same dir;
-        //   2. fsync(tmp) so the bytes reach disk, not just page cache;
-        //   3. rename(tmp, stateFile) — POSIX-atomic on one filesystem.
-        //
-        // Pick a unique temp suffix per call so concurrent calls (and
-        // stale temp files from a crashed earlier write) don't collide.
-        const payload = JSON.stringify(state, null, 2);
-        const tmp = `${this.stateFile}.tmp.${process.pid}.${randomBytes(4).toString('hex')}`;
-        let fd;
+    /**
+     * Read the persisted snapshot from SQLite. If the legacy JSON file
+     * exists and the SQLite row doesn't, migrate it in-place and
+     * unlink. Must be awaited at least once before the synchronous
+     * `load()` returns useful data.
+     */
+    async init() {
+        if (this.initialized)
+            return this.cached;
+        this.initialized = true;
         try {
-            fd = fs.openSync(tmp, 'w');
-            fs.writeFileSync(fd, payload, 'utf-8');
-            // Force the data + metadata to disk before the rename so the
-            // post-crash visible state is "either old contents or new
-            // contents", never "renamed link to half-written bytes".
-            fs.fsyncSync(fd);
-            fs.closeSync(fd);
-            fd = undefined;
-            fs.renameSync(tmp, this.stateFile);
-        }
-        catch (err) {
-            // Best-effort cleanup of the temp file if anything went wrong;
-            // we already failed the save, no point hiding the failure.
-            if (fd !== undefined)
+            const fromSqlite = await this.store.kvGet(STATE_KV_KEY);
+            if (fromSqlite) {
+                this.cached = fromSqlite;
+                return this.cached;
+            }
+            if (this.legacyJsonPath && fs.existsSync(this.legacyJsonPath)) {
                 try {
-                    fs.closeSync(fd);
+                    const raw = fs.readFileSync(this.legacyJsonPath, 'utf-8');
+                    const parsed = JSON.parse(raw);
+                    await this.store.kvSet(STATE_KV_KEY, parsed);
+                    // Best-effort unlink — keep going even if it fails (perms,
+                    // file already gone). The kvSet is what matters.
+                    try {
+                        fs.unlinkSync(this.legacyJsonPath);
+                    }
+                    catch { /* */ }
+                    this.cached = parsed;
+                    return this.cached;
+                }
+                catch {
+                    /* legacy file unreadable / corrupt — caller starts from scratch */
                 }
-                catch { /* */ }
-            try {
-                fs.unlinkSync(tmp);
             }
-            catch { /* already gone */ }
-            throw err;
-        }
-    }
-    load() {
-        try {
-            const data = fs.readFileSync(this.stateFile, 'utf-8');
-            return JSON.parse(data);
+            return null;
         }
         catch {
             return null;
         }
     }
+    /**
+     * Persist a snapshot. Synchronous API for back-compat with callers
+     * that don't await; the actual SQLite write is awaited on the
+     * internal `writeChain` so back-to-back saves never interleave.
+     */
+    save(state) {
+        this.cached = state;
+        this.writeChain = this.writeChain
+            .catch(() => undefined)
+            .then(() => this.store.kvSet(STATE_KV_KEY, state));
+    }
+    /** Synchronous read of the snapshot loaded by the most recent `init()` / `save()`. */
+    load() {
+        return this.cached;
+    }
+    /** Drop the persisted snapshot. Used by crash-recovery acknowledgement. */
     clear() {
-        try {
-            fs.unlinkSync(this.stateFile);
-        }
-        catch {
-            // File may not exist
-        }
+        this.cached = null;
+        this.writeChain = this.writeChain
+            .catch(() => undefined)
+            .then(() => this.store.kvDelete(STATE_KV_KEY));
+    }
+    /** Block until every queued write has reached disk. Called on shutdown. */
+    async flush() {
+        await this.writeChain.catch(() => undefined);
     }
 }
 //# sourceMappingURL=state-store.js.map

package/dist/daemon/state-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"state-store.js","sourceRoot":"","sources":["../../src/daemon/state-store.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAmB1C,MAAM,OAAO,UAAU;IACQ;IAA7B,YAA6B,SAAiB;QAAjB,cAAS,GAAT,SAAS,CAAQ;IAAG,CAAC;IAElD,IAAI,CAAC,KAAqB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvC,iEAAiE;QACjE,0DAA0D;QAC1D,gEAAgE;QAChE,8DAA8D;QAC9D,gEAAgE;QAChE,sDAAsD;QACtD,EAAE;QACF,gCAAgC;QAChC,6DAA6D;QAC7D,gEAAgE;QAChE,gEAAgE;QAChE,EAAE;QACF,8DAA8D;QAC9D,gEAAgE;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,QAAQ,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrF,IAAI,EAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC3B,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACvC,6DAA6D;YAC7D,0DAA0D;YAC1D,yDAAyD;YACzD,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACjB,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACjB,EAAE,GAAG,SAAS,CAAC;YACf,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+DAA+D;YAC/D,2DAA2D;YAC3D,IAAI,EAAE,KAAK,SAAS;gBAAE,IAAI,CAAC;oBAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;YAC/D,IAAI,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACxD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI;QACF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACtD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"state-store.js","sourceRoot":"","sources":["../../src/daemon/state-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AAoBzB,MAAM,YAAY,GAAG,8BAA8B,CAAC;AAEpD,MAAM,OAAO,UAAU;IAcF,KAAK;IAOL,cAAc;IApBjC,mEAAmE;IAC3D,MAAM,GAA0B,IAAI,CAAC;IAC7C,wFAAwF;IAChF,WAAW,GAAG,KAAK,CAAC;IAC5B;;;;;OAKG;IACK,UAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEtD,YACmB,KAAuB;IACxC;;;;;OAKG;IACc,cAAuB;qBAPvB,KAAK;8BAOL,cAAc;IAC9B,CAAC;IAEJ;;;;;OAKG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QACzC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAiB,YAAY,CAAC,CAAC;YACxE,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;gBACzB,OAAO,IAAI,CAAC,MAAM,CAAC;YACrB,CAAC;YACD,IAAI,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC9D,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;oBAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;oBACjD,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;oBAC7C,2DAA2D;oBAC3D,iDAAiD;oBACjD,IAAI,CAAC;wBAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;oBAC3D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;oBACrB,OAAO,IAAI,CAAC,MAAM,CAAC;gBACrB,CAAC;gBAAC,MAAM,CAAC;oBACP,mEAAmE;gBACrE,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,KAAqB;QACxB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU;aAC9B,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;aACtB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,sFAAsF;IACtF,IAAI;QACF,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,2EAA2E;IAC3E,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU;aAC9B,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;aACtB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;CACF"}

package/dist/database/connection.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Omnitron Internal Database — Connection Resolution
+ *
+ * Single source of truth for how anything in this process reaches
+ * omnitron-pg (the daemon's own PostgreSQL, port 5480 by default).
+ *
+ * Before this module five call sites built their own `pg.Pool`:
+ *   - `daemon.module.ts`   (DI token, hard-coded literals)
+ *   - `daemon.ts`          (boot migrations, hard-coded literals)
+ *   - `infrastructure.service.ts` (provisioning + migrations, module consts)
+ *   - `database/migrate.ts` (CLI, OMNITRON_DATABASE_URL)
+ *   - `workers/health-monitor.service.ts` (connectionString passed in)
+ *
+ * Three of them ignored `OMNITRON_DATABASE_URL` entirely, so pointing the
+ * daemon at a non-default Postgres moved *some* connections and silently
+ * left the rest on `localhost:5480`. The container spec used yet another
+ * copy of the same literals, so credentials could drift from the clients
+ * that were supposed to use them.
+ *
+ * Everything now derives from `resolveOmnitronPgConfig()`, which the
+ * container spec also consumes — client and container cannot disagree.
+ */
+import type { Pool, PoolConfig } from 'pg';
+import type { Kysely } from 'kysely';
+import type { OmnitronDatabase } from './schema.js';
+/** Host port the omnitron-pg container publishes. */
+export declare const OMNITRON_PG_PORT = 5480;
+export declare const OMNITRON_PG_USER = "omnitron";
+export declare const OMNITRON_PG_PASSWORD = "omnitron";
+export declare const OMNITRON_PG_DATABASE = "omnitron";
+export declare const OMNITRON_PG_HOST = "localhost";
+export interface OmnitronPgConfig {
+    host: string;
+    port: number;
+    database: string;
+    user: string;
+    password: string;
+}
+/**
+ * Resolve the omnitron-pg connection parameters.
+ *
+ * `OMNITRON_DATABASE_URL` wins when set; otherwise the local-container
+ * defaults apply. Parsing is total: a malformed URL falls back to the
+ * defaults rather than throwing at module-load time in the daemon.
+ */
+export declare function resolveOmnitronPgConfig(): OmnitronPgConfig;
+/** Render the resolved config back as a `postgresql://` URL (for workers spawned with a connection string). */
+export declare function omnitronPgConnectionString(config?: OmnitronPgConfig): string;
+/**
+ * Create a pg Pool for omnitron-pg.
+ *
+ * `pg` and `@omnitron-dev/titan-database` are imported dynamically so CLI
+ * commands that never touch the database keep their fast start-up path.
+ *
+ * Every client is a `ResilientPgClient`: it attaches its `'error'` listener
+ * at construction instead of after `connect()` resolves, closing the
+ * mid-handshake window where a connection error escapes to
+ * `uncaughtException`. A pool-level listener catches the re-emitted rest.
+ */
+export declare function createOmnitronPool(overrides?: Partial<PoolConfig>, onPoolError?: (err: Error) => void): Promise<Pool>;
+/**
+ * Create a Kysely instance bound to omnitron-pg. Caller owns `destroy()`.
+ *
+ * Defaults to the typed `OmnitronDatabase` schema. Migration code asks for
+ * `createOmnitronDb<unknown>()` instead: migrations run raw SQL and schema
+ * builders against tables that do not exist yet, and `Kysely<DB>` is
+ * invariant in `DB`, so a typed handle cannot be passed to a runner that
+ * expects `Kysely<unknown>`.
+ */
+export declare function createOmnitronDb<DB = OmnitronDatabase>(overrides?: Partial<PoolConfig>, onPoolError?: (err: Error) => void): Promise<Kysely<DB>>;
+//# sourceMappingURL=connection.d.ts.map

package/dist/database/connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../src/database/connection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAMpD,qDAAqD;AACrD,eAAO,MAAM,gBAAgB,OAAO,CAAC;AACrC,eAAO,MAAM,gBAAgB,aAAa,CAAC;AAC3C,eAAO,MAAM,oBAAoB,aAAa,CAAC;AAC/C,eAAO,MAAM,oBAAoB,aAAa,CAAC;AAC/C,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAE5C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAAI,gBAAgB,CAgB1D;AAYD,+GAA+G;AAC/G,wBAAgB,0BAA0B,CAAC,MAAM,GAAE,gBAA4C,GAAG,MAAM,CAKvG;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,GAAE,OAAO,CAAC,UAAU,CAAM,EACnC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,GACjC,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,GAAG,gBAAgB,EAC1D,SAAS,GAAE,OAAO,CAAC,UAAU,CAAM,EACnC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,GACjC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAIrB"}

package/dist/database/connection.js

@@ -0,0 +1,129 @@
+/**
+ * Omnitron Internal Database — Connection Resolution
+ *
+ * Single source of truth for how anything in this process reaches
+ * omnitron-pg (the daemon's own PostgreSQL, port 5480 by default).
+ *
+ * Before this module five call sites built their own `pg.Pool`:
+ *   - `daemon.module.ts`   (DI token, hard-coded literals)
+ *   - `daemon.ts`          (boot migrations, hard-coded literals)
+ *   - `infrastructure.service.ts` (provisioning + migrations, module consts)
+ *   - `database/migrate.ts` (CLI, OMNITRON_DATABASE_URL)
+ *   - `workers/health-monitor.service.ts` (connectionString passed in)
+ *
+ * Three of them ignored `OMNITRON_DATABASE_URL` entirely, so pointing the
+ * daemon at a non-default Postgres moved *some* connections and silently
+ * left the rest on `localhost:5480`. The container spec used yet another
+ * copy of the same literals, so credentials could drift from the clients
+ * that were supposed to use them.
+ *
+ * Everything now derives from `resolveOmnitronPgConfig()`, which the
+ * container spec also consumes — client and container cannot disagree.
+ */
+import { getEnv } from '../shared/env-config.js';
+// ---------------------------------------------------------------------------
+// Defaults — also used to provision the omnitron-pg container itself.
+// ---------------------------------------------------------------------------
+/** Host port the omnitron-pg container publishes. */
+export const OMNITRON_PG_PORT = 5480;
+export const OMNITRON_PG_USER = 'omnitron';
+export const OMNITRON_PG_PASSWORD = 'omnitron';
+export const OMNITRON_PG_DATABASE = 'omnitron';
+export const OMNITRON_PG_HOST = 'localhost';
+/**
+ * Resolve the omnitron-pg connection parameters.
+ *
+ * `OMNITRON_DATABASE_URL` wins when set; otherwise the local-container
+ * defaults apply. Parsing is total: a malformed URL falls back to the
+ * defaults rather than throwing at module-load time in the daemon.
+ */
+export function resolveOmnitronPgConfig() {
+    const url = getEnv().OMNITRON_DATABASE_URL;
+    if (!url)
+        return defaultOmnitronPgConfig();
+    try {
+        const parsed = new URL(url);
+        return {
+            host: parsed.hostname || OMNITRON_PG_HOST,
+            port: parsed.port ? Number(parsed.port) : OMNITRON_PG_PORT,
+            database: decodeURIComponent(parsed.pathname.replace(/^\//, '')) || OMNITRON_PG_DATABASE,
+            user: decodeURIComponent(parsed.username) || OMNITRON_PG_USER,
+            password: decodeURIComponent(parsed.password) || OMNITRON_PG_PASSWORD,
+        };
+    }
+    catch {
+        return defaultOmnitronPgConfig();
+    }
+}
+function defaultOmnitronPgConfig() {
+    return {
+        host: OMNITRON_PG_HOST,
+        port: OMNITRON_PG_PORT,
+        database: OMNITRON_PG_DATABASE,
+        user: OMNITRON_PG_USER,
+        password: OMNITRON_PG_PASSWORD,
+    };
+}
+/** Render the resolved config back as a `postgresql://` URL (for workers spawned with a connection string). */
+export function omnitronPgConnectionString(config = resolveOmnitronPgConfig()) {
+    const user = encodeURIComponent(config.user);
+    const password = encodeURIComponent(config.password);
+    const database = encodeURIComponent(config.database);
+    return `postgresql://${user}:${password}@${config.host}:${config.port}/${database}`;
+}
+// ---------------------------------------------------------------------------
+// Pool / Kysely factories
+// ---------------------------------------------------------------------------
+/**
+ * Create a pg Pool for omnitron-pg.
+ *
+ * `pg` and `@omnitron-dev/titan-database` are imported dynamically so CLI
+ * commands that never touch the database keep their fast start-up path.
+ *
+ * Every client is a `ResilientPgClient`: it attaches its `'error'` listener
+ * at construction instead of after `connect()` resolves, closing the
+ * mid-handshake window where a connection error escapes to
+ * `uncaughtException`. A pool-level listener catches the re-emitted rest.
+ */
+export async function createOmnitronPool(overrides = {}, onPoolError) {
+    const config = resolveOmnitronPgConfig();
+    const pg = await import('pg');
+    // A function now, not a class: `titan-database` declares pg, mysql2 and
+    // better-sqlite3 as OPTIONAL peer dependencies and used to import all three
+    // at module load, so importing it at all required every one of them — which
+    // is how two apps on the test node died on a missing `mysql2` they have no
+    // use for. Building the subclass needs pg, so it is built on request.
+    const { resilientPgClient } = await import('@omnitron-dev/titan-database');
+    const ResilientPgClient = await resilientPgClient();
+    const pool = new pg.default.Pool({
+        host: config.host,
+        port: config.port,
+        database: config.database,
+        user: config.user,
+        password: config.password,
+        Client: ResilientPgClient,
+        ...overrides,
+    });
+    pool.on('error', (err) => {
+        if (onPoolError)
+            onPoolError(err);
+        else
+            console.error('[omnitron-pg pool error]', err.code, err.message);
+    });
+    return pool;
+}
+/**
+ * Create a Kysely instance bound to omnitron-pg. Caller owns `destroy()`.
+ *
+ * Defaults to the typed `OmnitronDatabase` schema. Migration code asks for
+ * `createOmnitronDb<unknown>()` instead: migrations run raw SQL and schema
+ * builders against tables that do not exist yet, and `Kysely<DB>` is
+ * invariant in `DB`, so a typed handle cannot be passed to a runner that
+ * expects `Kysely<unknown>`.
+ */
+export async function createOmnitronDb(overrides = {}, onPoolError) {
+    const { Kysely, PostgresDialect } = await import('kysely');
+    const pool = await createOmnitronPool(overrides, onPoolError);
+    return new Kysely({ dialect: new PostgresDialect({ pool }) });
+}
+//# sourceMappingURL=connection.js.map

package/dist/database/connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../src/database/connection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGjD,8EAA8E;AAC9E,sEAAsE;AACtE,8EAA8E;AAE9E,qDAAqD;AACrD,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAC3C,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAC/C,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAC/C,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAU5C;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,qBAAqB,CAAC;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,uBAAuB,EAAE,CAAC;IAE3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,QAAQ,IAAI,gBAAgB;YACzC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB;YAC1D,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,oBAAoB;YACxF,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,gBAAgB;YAC7D,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,oBAAoB;SACtE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,uBAAuB,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,oBAAoB;QAC9B,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,oBAAoB;KAC/B,CAAC;AACJ,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,0BAA0B,CAAC,MAAM,GAAqB,uBAAuB,EAAE;IAC7F,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrD,OAAO,gBAAgB,IAAI,IAAI,QAAQ,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;AACtF,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAS,GAAwB,EAAE,EACnC,WAAkC;IAElC,MAAM,MAAM,GAAG,uBAAuB,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9B,wEAAwE;IACxE,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IAC3E,MAAM,iBAAiB,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAEpD,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,iBAAiB;QACzB,GAAG,SAAS;KACb,CAAC,CAAC;IAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACvB,IAAI,WAAW;YAAE,WAAW,CAAC,GAAY,CAAC,CAAC;;YAEtC,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAG,GAAyB,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAS,GAAwB,EAAE,EACnC,WAAkC;IAElC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC9D,OAAO,IAAI,MAAM,CAAK,EAAE,OAAO,EAAE,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;AACpE,CAAC"}

package/dist/database/dialect.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Which engine a Kysely instance is talking to, and the queries that have to
+ * ask differently.
+ *
+ * The daemon runs the SAME services against two databases — a master on
+ * Postgres, a slave on SQLite — while the schema types describe the master
+ * only. Every query written without that in mind works on one and fails on
+ * the other, and it fails where nobody is looking: on a remote node, in a
+ * pass whose failure is a log line.
+ *
+ * Found this way, in one week, all on paths that had just become reachable:
+ *
+ *   - a `Date` binding better-sqlite3 refuses    → `sqlite-date-binding.ts`
+ *   - `pg_total_relation_size` on a slave's WAL  → `sync.service.ts`
+ *   - `labels @> ?::jsonb` on a slave's logs     → here
+ *
+ * The last one is not a wrong answer but a syntax error — SQLite reads `@`
+ * as an unrecognized token and refuses the whole statement, so a log query
+ * with any label filter throws on every slave. Measured against the live
+ * node's own database file.
+ *
+ * Most portability questions are answered by writing the query in terms both
+ * engines share, and that is always the first choice. This module exists for
+ * the rest: where the dialects differ in what they can make FAST, and the
+ * portable form would give up an index on the side that has the volume.
+ */
+import { type Kysely } from 'kysely';
+export type SqlDialect = 'postgres' | 'sqlite' | 'unknown';
+/**
+ * Ask the database object, rather than track what we built.
+ *
+ * A registry of "this connection is SQLite" is one more thing to keep in
+ * step with reality, and it goes stale silently — a Kysely built somewhere
+ * new is simply absent from it, and absence reads as a default. The adapter
+ * is the engine's own answer, and it cannot disagree with itself.
+ */
+export declare function dialectOf(db: Kysely<any>): SqlDialect;
+/**
+ * "This JSON column contains every one of these key/value pairs."
+ *
+ * Postgres gets `@>`, which is the operator its GIN index answers — the
+ * master's `logs` table reached 13 GB on a development host, so giving up
+ * that index is not a portability tax worth paying.
+ *
+ * Everything else — SQLite, and any engine this cannot identify — gets one
+ * `->>` comparison per key, AND-ed. `->>` is understood by both (Postgres
+ * since 14, SQLite since 3.38), so the fallback is correct on the master
+ * too; it is only slower there, which is the right way round for a branch
+ * that might one day be taken by mistake.
+ *
+ * Equivalent for the flat `Record<string, string>` these filters carry: `@>`
+ * is structural containment, and for one level of string values that is what
+ * the AND-ed comparisons compute.
+ *
+ * An empty set of pairs constrains nothing, and the caller is expected to
+ * have decided that already — a filter that silently matches everything is
+ * worse than no filter, because the unnarrowed result reads as an answer.
+ */
+export declare function jsonContains(db: Kysely<any>, column: string, pairs: Record<string, string>): import("kysely").RawBuilder<boolean>;
+//# sourceMappingURL=dialect.d.ts.map

package/dist/database/dialect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dialect.d.ts","sourceRoot":"","sources":["../../src/database/dialect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAwB,KAAK,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE3D,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE3D;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAQrD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAC1B,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,wCAa9B"}

package/dist/database/dialect.js

@@ -0,0 +1,80 @@
+/**
+ * Which engine a Kysely instance is talking to, and the queries that have to
+ * ask differently.
+ *
+ * The daemon runs the SAME services against two databases — a master on
+ * Postgres, a slave on SQLite — while the schema types describe the master
+ * only. Every query written without that in mind works on one and fails on
+ * the other, and it fails where nobody is looking: on a remote node, in a
+ * pass whose failure is a log line.
+ *
+ * Found this way, in one week, all on paths that had just become reachable:
+ *
+ *   - a `Date` binding better-sqlite3 refuses    → `sqlite-date-binding.ts`
+ *   - `pg_total_relation_size` on a slave's WAL  → `sync.service.ts`
+ *   - `labels @> ?::jsonb` on a slave's logs     → here
+ *
+ * The last one is not a wrong answer but a syntax error — SQLite reads `@`
+ * as an unrecognized token and refuses the whole statement, so a log query
+ * with any label filter throws on every slave. Measured against the live
+ * node's own database file.
+ *
+ * Most portability questions are answered by writing the query in terms both
+ * engines share, and that is always the first choice. This module exists for
+ * the rest: where the dialects differ in what they can make FAST, and the
+ * portable form would give up an index on the side that has the volume.
+ */
+import { sql, PostgresAdapter } from 'kysely';
+/**
+ * Ask the database object, rather than track what we built.
+ *
+ * A registry of "this connection is SQLite" is one more thing to keep in
+ * step with reality, and it goes stale silently — a Kysely built somewhere
+ * new is simply absent from it, and absence reads as a default. The adapter
+ * is the engine's own answer, and it cannot disagree with itself.
+ */
+export function dialectOf(db) {
+    try {
+        const adapter = db.getExecutor().adapter;
+        if (adapter instanceof PostgresAdapter)
+            return 'postgres';
+        return adapter?.constructor?.name === 'SqliteAdapter' ? 'sqlite' : 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+/**
+ * "This JSON column contains every one of these key/value pairs."
+ *
+ * Postgres gets `@>`, which is the operator its GIN index answers — the
+ * master's `logs` table reached 13 GB on a development host, so giving up
+ * that index is not a portability tax worth paying.
+ *
+ * Everything else — SQLite, and any engine this cannot identify — gets one
+ * `->>` comparison per key, AND-ed. `->>` is understood by both (Postgres
+ * since 14, SQLite since 3.38), so the fallback is correct on the master
+ * too; it is only slower there, which is the right way round for a branch
+ * that might one day be taken by mistake.
+ *
+ * Equivalent for the flat `Record<string, string>` these filters carry: `@>`
+ * is structural containment, and for one level of string values that is what
+ * the AND-ed comparisons compute.
+ *
+ * An empty set of pairs constrains nothing, and the caller is expected to
+ * have decided that already — a filter that silently matches everything is
+ * worse than no filter, because the unnarrowed result reads as an answer.
+ */
+export function jsonContains(db, column, pairs) {
+    const ref = sql.ref(column);
+    const entries = Object.entries(pairs);
+    if (entries.length === 0)
+        return sql `(1 = 1)`;
+    if (dialectOf(db) === 'postgres') {
+        return sql `(${ref} @> ${JSON.stringify(pairs)}::jsonb)`;
+    }
+    return entries
+        .map(([key, value]) => sql `(${ref} ->> ${key} = ${String(value)})`)
+        .reduce((left, right) => sql `(${left} AND ${right})`);
+}
+//# sourceMappingURL=dialect.js.map

package/dist/database/dialect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dialect.js","sourceRoot":"","sources":["../../src/database/dialect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,GAAG,EAAE,eAAe,EAAe,MAAM,QAAQ,CAAC;AAI3D;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,EAAe;IACvC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC;QACzC,IAAI,OAAO,YAAY,eAAe;YAAE,OAAO,UAAU,CAAC;QAC1D,OAAO,OAAO,EAAE,WAAW,EAAE,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,YAAY,CAC1B,EAAe,EACf,MAAc,EACd,KAA6B;IAE7B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAS,SAAS,CAAC;IAEvD,IAAI,SAAS,CAAC,EAAE,CAAC,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,GAAG,CAAS,IAAI,GAAG,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC;IACnE,CAAC;IAED,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,CAAS,IAAI,GAAG,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;SAC3E,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAS,IAAI,IAAI,QAAQ,KAAK,GAAG,CAAC,CAAC;AACnE,CAAC"}

package/dist/database/migrate.d.ts

@@ -1,7 +1,10 @@
 /**
- * Omnitron Database Migration Runner
+ * Omnitron Database Migration CLI
  *
- * Runs migrations on omnitron-pg (port 5480) using @kysera/migrations.
+ * Applies (or rolls back) the migrations in `migrations/index.ts` against
+ * omnitron-pg. The daemon's boot path runs the SAME registry through the
+ * SAME engine (`migration-runner.ts`) — this entry point only adds argv
+ * handling, console logging and the rollback direction.
  *
  * Usage:
  *   tsx src/database/migrate.ts          (apply all pending)

package/dist/database/migrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/database/migrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/database/migrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}