0sec-cli 0.15.0 → 0.17.0

package/chunks/chunk-HT6P7RY3.js

@@ -0,0 +1,2597 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  homeStateDir,
+  runStateDir
+} from "./chunk-KKGE5RQE.js";
+import {
+  __export
+} from "./chunk-IR537GON.js";
+
+// packages/db/dist/wasm-shim.js
+import { BetterSQLiteSession } from "drizzle-orm/better-sqlite3/session";
+import { BaseSQLiteDatabase } from "drizzle-orm/sqlite-core/db";
+import { SQLiteSyncDialect } from "drizzle-orm/sqlite-core/dialect";
+import { createTableRelationsHelpers, extractTablesRelationalConfig } from "drizzle-orm/relations";
+import { createRequire } from "node:module";
+function isBunRuntime() {
+  const g = globalThis;
+  if (typeof g.Bun !== "undefined")
+    return true;
+  const versions = typeof process !== "undefined" && process.versions;
+  return !!(versions && versions.bun);
+}
+function normalizeBindArgs(args) {
+  if (args.length === 0)
+    return void 0;
+  if (args.length === 1) {
+    const a = args[0];
+    if (a !== null && typeof a === "object" && !Array.isArray(a) && !(a instanceof Uint8Array)) {
+      const out = {};
+      for (const [k, v] of Object.entries(a)) {
+        out[/^[:@$]/.test(k) ? k : `@${k}`] = v;
+      }
+      return out;
+    }
+    return [a];
+  }
+  return args;
+}
+var StatementShim = class _StatementShim {
+  stmt;
+  rawMode;
+  constructor(stmt, rawMode = false) {
+    this.stmt = stmt;
+    this.rawMode = rawMode;
+  }
+  run(...args) {
+    const bind = normalizeBindArgs(args);
+    return this.stmt.run(bind);
+  }
+  get(...args) {
+    const bind = normalizeBindArgs(args);
+    if (this.rawMode) {
+      const rows = this.stmt.values(bind);
+      return rows[0];
+    }
+    const row = this.stmt.get(bind);
+    if (row == null)
+      return void 0;
+    return row;
+  }
+  all(...args) {
+    const bind = normalizeBindArgs(args);
+    if (this.rawMode)
+      return this.stmt.values(bind);
+    return this.stmt.all(bind);
+  }
+  /** better-sqlite3 compat: return a statement that yields rows as arrays. */
+  raw() {
+    return new _StatementShim(this.stmt, true);
+  }
+  // Stubs for methods drizzle never calls but better-sqlite3 exposes.
+  // Keeps TypeScript structural typing happy if something reaches for them.
+  pluck() {
+    return this;
+  }
+  expand() {
+    return this;
+  }
+  bind() {
+    return this;
+  }
+};
+var ShimmedDatabase = class {
+  engine;
+  constructor(engine) {
+    this.engine = engine;
+  }
+  prepare(sql) {
+    return new StatementShim(this.engine.prepare(sql));
+  }
+  exec(sql) {
+    this.engine.exec(sql);
+    return this;
+  }
+  /**
+   * better-sqlite3 uses `.pragma()` both as a getter and a setter. Our code
+   * only uses it as a setter ("journal_mode = WAL", "foreign_keys = ON"), so
+   * we just `exec()` the pragma and swallow errors — some PRAGMAs (notably
+   * WAL journal mode) are not supported by node-sqlite3-wasm's VFS and error
+   * here, but losing them is acceptable for 0sec's single-process workload.
+   */
+  pragma(query, _opts) {
+    try {
+      this.engine.exec(`PRAGMA ${query}`);
+    } catch {
+    }
+    return void 0;
+  }
+  /**
+   * better-sqlite3's `db.transaction(fn)` returns a callable object with
+   * `.deferred`, `.immediate`, `.exclusive`, and `.default` methods, each
+   * running `fn` inside a BEGIN/COMMIT of the corresponding isolation level.
+   * All three variants are functionally equivalent for 0sec's single-writer
+   * workload, so we wire them to the same underlying implementation.
+   */
+  transaction(fn) {
+    const engine = this.engine;
+    const runInTx = (...args) => {
+      engine.exec("BEGIN");
+      try {
+        const result = fn(...args);
+        engine.exec("COMMIT");
+        return result;
+      } catch (err) {
+        try {
+          engine.exec("ROLLBACK");
+        } catch {
+        }
+        throw err;
+      }
+    };
+    return Object.assign(runInTx, {
+      default: runInTx,
+      deferred: runInTx,
+      immediate: runInTx,
+      exclusive: runInTx
+    });
+  }
+  close() {
+    this.engine.close();
+  }
+  get inTransaction() {
+    return this.engine.inTransaction;
+  }
+  get open() {
+    return this.engine.isOpen;
+  }
+};
+function createWasmEngine(path) {
+  const sqliteWasm = createRequire(import.meta.url)("node-sqlite3-wasm");
+  const { Database: WasmDatabaseCtor } = sqliteWasm;
+  const wasm = new WasmDatabaseCtor(path);
+  const wrapStatement = (stmt) => ({
+    run: (bind) => stmt.run(bind),
+    get: (bind) => {
+      const row = stmt.get(bind);
+      return row == null ? void 0 : row;
+    },
+    all: (bind) => stmt.all(bind),
+    values: (bind) => {
+      const rows = stmt.all(bind);
+      return rows.map((r) => Object.values(r));
+    }
+  });
+  return {
+    prepare: (sql) => wrapStatement(wasm.prepare(sql)),
+    exec: (sql) => {
+      wasm.exec(sql);
+    },
+    close: () => wasm.close(),
+    get inTransaction() {
+      return wasm.inTransaction;
+    },
+    get isOpen() {
+      return wasm.isOpen;
+    }
+  };
+}
+function createBunEngine(path) {
+  const requireFromHere = createRequire(import.meta.url);
+  const { Database: BunDatabase } = requireFromHere("bun:sqlite");
+  const db = new BunDatabase(path);
+  const wrapStatement = (stmt) => ({
+    run: (bind) => {
+      const r = bind === void 0 ? stmt.run() : stmt.run(bind);
+      return { changes: r.changes, lastInsertRowid: r.lastInsertRowid };
+    },
+    get: (bind) => {
+      const row = bind === void 0 ? stmt.get() : stmt.get(bind);
+      return row == null ? void 0 : row;
+    },
+    all: (bind) => bind === void 0 ? stmt.all() : stmt.all(bind),
+    values: (bind) => bind === void 0 ? stmt.values() : stmt.values(bind)
+  });
+  return {
+    prepare: (sql) => wrapStatement(db.prepare(sql)),
+    exec: (sql) => {
+      db.exec(sql);
+    },
+    close: () => db.close(),
+    get inTransaction() {
+      return Boolean(db.inTransaction);
+    },
+    get isOpen() {
+      return true;
+    }
+  };
+}
+function createShimmedDatabase(path) {
+  const engine = isBunRuntime() ? createBunEngine(path) : createWasmEngine(path);
+  return new ShimmedDatabase(engine);
+}
+function createDrizzleFromShim(client, config = {}) {
+  const dialect = new SQLiteSyncDialect({});
+  let schema;
+  if (config.schema) {
+    const tablesConfig = extractTablesRelationalConfig(config.schema, createTableRelationsHelpers);
+    schema = {
+      fullSchema: config.schema,
+      schema: tablesConfig.tables,
+      tableNamesMap: tablesConfig.tableNamesMap
+    };
+  }
+  const session = new BetterSQLiteSession(client, dialect, schema, {});
+  const db = new BaseSQLiteDatabase("sync", dialect, session, schema);
+  db.$client = client;
+  return db;
+}
+
+// packages/db/dist/database.js
+import { asc, eq, desc, and, gt, inArray, or } from "drizzle-orm";
+import { createHash, randomUUID } from "node:crypto";
+import { dirname, join } from "node:path";
+import { closeSync, existsSync, mkdirSync, openSync, readSync, renameSync, rmSync, statSync, writeSync } from "node:fs";
+
+// packages/db/dist/schema.js
+var schema_exports = {};
+__export(schema_exports, {
+  agentSessions: () => agentSessions,
+  artifactKinds: () => artifactKinds,
+  artifacts: () => artifacts,
+  attackResults: () => attackResults,
+  caseStatuses: () => caseStatuses,
+  cases: () => cases,
+  credentialKinds: () => credentialKinds,
+  findingStatuses: () => findingStatuses,
+  findingTriageStatuses: () => findingTriageStatuses,
+  findingWorkflowStatuses: () => findingWorkflowStatuses,
+  findings: () => findings,
+  persistentCredentials: () => persistentCredentials,
+  pipelineEvents: () => pipelineEvents,
+  scans: () => scans,
+  targets: () => targets,
+  triageMemories: () => triageMemories,
+  trustGraphEdges: () => trustGraphEdges,
+  verdicts: () => verdicts,
+  workItemKinds: () => workItemKinds,
+  workItemStatuses: () => workItemStatuses,
+  workItems: () => workItems,
+  workerStatuses: () => workerStatuses,
+  workers: () => workers
+});
+import { sqliteTable, text, integer, real, index } from "drizzle-orm/sqlite-core";
+var findingStatuses = [
+  "discovered",
+  "verified",
+  "confirmed",
+  "scored",
+  "reported",
+  "fixed",
+  "false-positive"
+];
+var findingTriageStatuses = ["new", "accepted", "suppressed"];
+var findingWorkflowStatuses = [
+  "backlog",
+  "todo",
+  "agent_review",
+  "in_progress",
+  "human_review",
+  "blocked",
+  "done",
+  "cancelled"
+];
+var caseStatuses = ["open", "in_progress", "human_review", "done", "cancelled"];
+var workItemKinds = [
+  "surface_map",
+  "hypothesis",
+  "poc_build",
+  "blind_verify",
+  "consensus",
+  "human_review"
+];
+var workItemStatuses = ["backlog", "todo", "in_progress", "blocked", "done", "cancelled"];
+var artifactKinds = ["request", "response", "analysis", "verdicts", "sessions", "events"];
+var workerStatuses = ["idle", "claiming", "running", "sleeping", "stopped", "error"];
+var credentialKinds = [
+  "credential",
+  "token",
+  "path",
+  "endpoint",
+  "hash",
+  "cookie"
+];
+var scans = sqliteTable("scans", {
+  id: text("id").primaryKey(),
+  target: text("target").notNull(),
+  depth: text("depth").notNull(),
+  runtime: text("runtime").notNull().default("api"),
+  mode: text("mode").notNull().default("probe"),
+  status: text("status").notNull().default("running"),
+  startedAt: text("startedAt").notNull(),
+  completedAt: text("completedAt"),
+  durationMs: integer("durationMs"),
+  summary: text("summary")
+  // JSON-encoded ReportSummary
+});
+var targets = sqliteTable("targets", {
+  id: text("id").primaryKey(),
+  url: text("url").notNull().unique(),
+  type: text("type").notNull().default("unknown"),
+  model: text("model"),
+  systemPrompt: text("systemPrompt"),
+  detectedFeatures: text("detectedFeatures"),
+  // JSON array
+  endpoints: text("endpoints"),
+  // JSON array
+  firstSeenAt: text("firstSeenAt").notNull(),
+  lastSeenAt: text("lastSeenAt").notNull()
+}, (table) => [index("idx_targets_url").on(table.url)]);
+var findings = sqliteTable("findings", {
+  id: text("id").primaryKey(),
+  scanId: text("scanId").notNull().references(() => scans.id),
+  templateId: text("templateId").notNull(),
+  title: text("title").notNull(),
+  description: text("description").notNull(),
+  severity: text("severity").notNull(),
+  category: text("category").notNull(),
+  status: text("status").notNull().default("discovered"),
+  fingerprint: text("fingerprint"),
+  triageStatus: text("triageStatus").notNull().default("new"),
+  triageNote: text("triageNote"),
+  triagedAt: text("triagedAt"),
+  workflowStatus: text("workflowStatus").notNull().default("backlog"),
+  workflowAssignee: text("workflowAssignee"),
+  workflowUpdatedAt: text("workflowUpdatedAt"),
+  score: integer("score"),
+  // CVSS-like 0-100 score, set during "scored" stage
+  confidence: real("confidence"),
+  // 0.0-1.0 agent-assessed confidence
+  cvssVector: text("cvssVector"),
+  // CVSS vector string
+  cvssScore: real("cvssScore"),
+  // CVSS numeric score (0-10)
+  evidenceRequest: text("evidenceRequest").notNull(),
+  evidenceResponse: text("evidenceResponse").notNull(),
+  evidenceAnalysis: text("evidenceAnalysis"),
+  /**
+   * JSON-stringified LayerVerdict[] (see @0sec/shared types). NULL until
+   * the triage stage runs. Stored as text rather than a join table because
+   * the array is read-and-write together at finding-save time and we never
+   * query individual verdict rows. See 0sec#112.
+   */
+  layerVerdicts: text("layerVerdicts"),
+  impactAssessment: text("impactAssessment"),
+  // JSON: ImpactAssessment (reachability/blast/weaponizability/business)
+  /**
+   * JSON-stringified PocStep[] (see @0sec/shared types). NULL when the
+   * agent only produced prose evidence (the legacy default). Stored as
+   * text rather than a join table because the array is read-and-write
+   * together at finding-save time and we never query individual steps.
+   * See 0sec#170.
+   */
+  pocSteps: text("pocSteps"),
+  /**
+   * JSON-stringified VerificationSpec (see @0sec/shared types). NULL
+   * when the agent produced a finding without a deterministic re-check
+   * contract — every reader must continue to work in that case. Stored
+   * as text because the spec is an opaque blob that the verifier reads
+   * whole; we never query individual predicates. See 0sec#193 /
+   * 0sec-cloud#111.
+   */
+  verificationSpec: text("verificationSpec"),
+  /**
+   * JSON-stringified semantic-dedupe mapping assigned by the post-process
+   * pass. NULL until that opt-in pass runs. Keeping this with the finding
+   * preserves canonical anchors across later scans.
+   */
+  semanticDedupe: text("semanticDedupe"),
+  /**
+   * Per-scan post-process rank. NULL when incremental ranking did not run.
+   */
+  findingRank: integer("findingRank"),
+  /**
+   * JSON-stringified PocExecutionReport written when `disclose --target-url`
+   * runs the step graph against a live target. NULL until that runs. See
+   * 0sec#171.
+   */
+  pocExecution: text("pocExecution"),
+  /**
+   * JSON-stringified VerificationResult (see @0sec/shared
+   * `VerificationResultSchema`) — the last deterministic-replay result
+   * attached to the finding. NULL when the finding was never verified;
+   * readers MUST treat NULL / malformed / statusless payloads as
+   * *absent* rather than as an empty result, because downstream gates
+   * (the TUI `f` source-fix action, disclosure promotion) key off
+   * `status === "reproduced"`. Stored as text for the same reason as
+   * `verificationSpec`: the blob is read and written whole.
+   */
+  verificationResult: text("verificationResult"),
+  /**
+   * JSON-stringified Finding["reviewAnnotation"] — the scoped source
+   * reference (`path` + line range, optional suggestion / knownMarker)
+   * the agent cited at save_finding time. NULL when the finding carries
+   * no workspace-contained source location. Additive: every reader must
+   * keep working when it is absent.
+   */
+  reviewAnnotation: text("reviewAnnotation"),
+  timestamp: integer("timestamp").notNull()
+}, (table) => [
+  index("idx_findings_scanId").on(table.scanId),
+  index("idx_findings_severity").on(table.severity),
+  index("idx_findings_category").on(table.category),
+  index("idx_findings_status").on(table.status),
+  index("idx_findings_fingerprint").on(table.fingerprint),
+  index("idx_findings_triageStatus").on(table.triageStatus),
+  index("idx_findings_workflowStatus").on(table.workflowStatus)
+]);
+var attackResults = sqliteTable("attack_results", {
+  id: text("id").primaryKey(),
+  scanId: text("scanId").notNull().references(() => scans.id),
+  templateId: text("templateId").notNull(),
+  payloadId: text("payloadId").notNull(),
+  outcome: text("outcome").notNull(),
+  request: text("request").notNull(),
+  response: text("response").notNull(),
+  latencyMs: integer("latencyMs").notNull(),
+  timestamp: integer("timestamp").notNull(),
+  error: text("error")
+}, (table) => [index("idx_attack_results_scanId").on(table.scanId)]);
+var verdicts = sqliteTable("verdicts", {
+  id: text("id").primaryKey(),
+  findingId: text("findingId").notNull().references(() => findings.id),
+  agentRole: text("agentRole").notNull(),
+  model: text("model").notNull().default(""),
+  verdict: text("verdict").notNull(),
+  // TRUE_POSITIVE | FALSE_POSITIVE | UNSURE
+  confidence: real("confidence").notNull().default(0),
+  reasoning: text("reasoning").notNull().default(""),
+  timestamp: integer("timestamp").notNull()
+}, (table) => [index("idx_verdicts_findingId").on(table.findingId)]);
+var pipelineEvents = sqliteTable("pipeline_events", {
+  id: text("id").primaryKey(),
+  scanId: text("scanId").notNull().references(() => scans.id),
+  stage: text("stage").notNull(),
+  eventType: text("eventType").notNull(),
+  findingId: text("findingId"),
+  agentRole: text("agentRole"),
+  source: text("source").notNull().default("core"),
+  payload: text("payload").notNull().default("{}"),
+  // JSON
+  timestamp: integer("timestamp").notNull()
+}, (table) => [
+  index("idx_events_scanId").on(table.scanId),
+  index("idx_events_stage").on(table.stage),
+  index("idx_events_findingId").on(table.findingId)
+]);
+var agentSessions = sqliteTable("agent_sessions", {
+  id: text("id").primaryKey(),
+  scanId: text("scanId").notNull().references(() => scans.id),
+  agentRole: text("agentRole").notNull(),
+  turnCount: integer("turnCount").notNull().default(0),
+  messages: text("messages").notNull().default("[]"),
+  // JSON serialized conversation
+  toolContext: text("toolContext").notNull().default("{}"),
+  // JSON serialized context
+  status: text("status").notNull().default("running"),
+  // running | paused | completed | failed
+  createdAt: text("createdAt").notNull(),
+  updatedAt: text("updatedAt").notNull()
+}, (table) => [
+  index("idx_sessions_scanId").on(table.scanId),
+  index("idx_sessions_role").on(table.agentRole)
+]);
+var cases = sqliteTable("cases", {
+  id: text("id").primaryKey(),
+  target: text("target").notNull().unique(),
+  targetType: text("targetType").notNull().default("unknown"),
+  latestScanId: text("latestScanId"),
+  status: text("status").notNull().default("open"),
+  createdAt: text("createdAt").notNull(),
+  updatedAt: text("updatedAt").notNull()
+}, (table) => [
+  index("idx_cases_target").on(table.target),
+  index("idx_cases_status").on(table.status)
+]);
+var workItems = sqliteTable("work_items", {
+  id: text("id").primaryKey(),
+  caseId: text("caseId").notNull().references(() => cases.id),
+  findingFingerprint: text("findingFingerprint"),
+  kind: text("kind").notNull(),
+  title: text("title").notNull(),
+  owner: text("owner"),
+  status: text("status").notNull().default("backlog"),
+  summary: text("summary"),
+  dependsOn: text("dependsOn"),
+  createdAt: text("createdAt").notNull(),
+  updatedAt: text("updatedAt").notNull()
+}, (table) => [
+  index("idx_work_items_caseId").on(table.caseId),
+  index("idx_work_items_fingerprint").on(table.findingFingerprint),
+  index("idx_work_items_status").on(table.status)
+]);
+var artifacts = sqliteTable("artifacts", {
+  id: text("id").primaryKey(),
+  caseId: text("caseId").notNull().references(() => cases.id),
+  findingFingerprint: text("findingFingerprint"),
+  workItemId: text("workItemId"),
+  kind: text("kind").notNull(),
+  label: text("label").notNull(),
+  content: text("content"),
+  metadata: text("metadata"),
+  createdAt: text("createdAt").notNull(),
+  updatedAt: text("updatedAt").notNull()
+}, (table) => [
+  index("idx_artifacts_caseId").on(table.caseId),
+  index("idx_artifacts_fingerprint").on(table.findingFingerprint),
+  index("idx_artifacts_workItemId").on(table.workItemId)
+]);
+var triageMemories = sqliteTable("triage_memories", {
+  id: text("id").primaryKey(),
+  scope: text("scope").notNull(),
+  // global | target | package
+  scopeValue: text("scope_value"),
+  category: text("category").notNull(),
+  pattern: text("pattern").notNull(),
+  reasoning: text("reasoning").notNull(),
+  createdAt: integer("created_at").notNull(),
+  appliedCount: integer("applied_count").notNull().default(0)
+}, (table) => [
+  index("idx_memories_category").on(table.category, table.scope),
+  index("idx_memories_scope").on(table.scope, table.scopeValue)
+]);
+var workers = sqliteTable("workers", {
+  id: text("id").primaryKey(),
+  role: text("role").notNull().default("orchestrator"),
+  status: text("status").notNull().default("idle"),
+  label: text("label").notNull(),
+  currentCaseId: text("currentCaseId"),
+  currentWorkItemId: text("currentWorkItemId"),
+  currentScanId: text("currentScanId"),
+  pid: integer("pid"),
+  host: text("host"),
+  lastError: text("lastError"),
+  heartbeatAt: text("heartbeatAt").notNull(),
+  startedAt: text("startedAt").notNull(),
+  updatedAt: text("updatedAt").notNull()
+}, (table) => [
+  index("idx_workers_status").on(table.status),
+  index("idx_workers_heartbeat").on(table.heartbeatAt)
+]);
+var persistentCredentials = sqliteTable("persistent_credentials", {
+  id: text("id").primaryKey(),
+  credentialKind: text("credentialKind").notNull(),
+  /** SHA-256 hex of the normalized value. Half of the natural key. */
+  valueHash: text("valueHash").notNull(),
+  /** Short, redacted preview for recognition (e.g. `admin:hun…`). Not a secret. */
+  valuePreview: text("valuePreview").notNull(),
+  /** Optional short label the value sat behind (e.g. `password`, `jwt`). */
+  context: text("context"),
+  /** Target the value was first discovered against. */
+  target: text("target"),
+  /** Discovery attribution — first sighting. */
+  firstScanId: text("firstScanId"),
+  firstFindingId: text("firstFindingId"),
+  firstSource: text("firstSource"),
+  firstTurn: integer("firstTurn"),
+  /** Most-recent sighting attribution. */
+  lastScanId: text("lastScanId"),
+  timesSeen: integer("timesSeen").notNull().default(1),
+  firstSeenAt: text("firstSeenAt").notNull(),
+  lastSeenAt: text("lastSeenAt").notNull()
+}, (table) => [
+  index("idx_pcred_kind_hash").on(table.credentialKind, table.valueHash),
+  index("idx_pcred_target").on(table.target),
+  index("idx_pcred_kind").on(table.credentialKind)
+]);
+var trustGraphEdges = sqliteTable("trust_graph_edges", {
+  id: text("id").primaryKey(),
+  srcKind: text("srcKind").notNull(),
+  srcId: text("srcId").notNull(),
+  dstKind: text("dstKind").notNull(),
+  dstId: text("dstId").notNull(),
+  relation: text("relation").notNull(),
+  /** Optional attribution for when/where this edge was observed. */
+  scanId: text("scanId"),
+  findingId: text("findingId"),
+  /** 0.0-1.0 confidence the edge is real. */
+  confidence: real("confidence"),
+  note: text("note"),
+  createdAt: text("createdAt").notNull(),
+  updatedAt: text("updatedAt").notNull()
+}, (table) => [
+  index("idx_tge_src").on(table.srcKind, table.srcId),
+  index("idx_tge_dst").on(table.dstKind, table.dstId),
+  index("idx_tge_relation").on(table.relation)
+]);
+
+// packages/db/dist/database.js
+var DEFAULT_DB_DIR = homeStateDir();
+var DEFAULT_DB_PATH = join(DEFAULT_DB_DIR, "0sec.db");
+function resolveOsecDbPath(dbPath) {
+  const configuredPath = process.env["0SEC_DB_PATH"]?.trim();
+  return dbPath ?? (configuredPath ? configuredPath : DEFAULT_DB_PATH);
+}
+function resetOsecDatabase(dbPath) {
+  const path = resolveOsecDbPath(dbPath);
+  if (path !== ":memory:") {
+    mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  }
+  for (const suffix of ["", "-wal", "-shm"]) {
+    const candidate = `${path}${suffix}`;
+    if (existsSync(candidate)) {
+      rmSync(candidate, { force: true });
+    }
+  }
+  return path;
+}
+function repairOsecDatabase(dbPath) {
+  const path = resolveOsecDbPath(dbPath);
+  if (path !== ":memory:") {
+    mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  }
+  clearStaleLockIfAny(path);
+  const backupPath = backupCorruptDatabase(path) ?? void 0;
+  resetOsecDatabase(path);
+  const db = new osecDB(path);
+  db.close();
+  return { path, backupPath };
+}
+function isRecoverableDatabaseError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return /database disk image is malformed|file is not a database|malformed|invalid page number|database main|btree|b-tree|database corrupt/i.test(message);
+}
+function timestampTag() {
+  return (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+}
+function backupCorruptDatabase(path) {
+  if (!existsSync(path))
+    return null;
+  const backupPath = `${path}.corrupt-${timestampTag()}`;
+  renameSync(path, backupPath);
+  for (const suffix of ["-wal", "-shm", ".lock"]) {
+    const candidate = `${path}${suffix}`;
+    if (!existsSync(candidate))
+      continue;
+    try {
+      renameSync(candidate, `${backupPath}${suffix}`);
+    } catch {
+      if (suffix === ".lock") {
+        rmSync(candidate, { recursive: true, force: true });
+      }
+    }
+  }
+  return backupPath;
+}
+function ensureDatabaseHealthy(sqlite) {
+  const rows = sqlite.prepare("PRAGMA quick_check(1)").all();
+  const first = rows[0] ? Object.values(rows[0])[0] : "ok";
+  if (typeof first === "string" && first.toLowerCase() !== "ok") {
+    throw new Error(first);
+  }
+}
+function migrateWalHeaderIfNeeded(path) {
+  if (!existsSync(path))
+    return;
+  let size;
+  try {
+    size = statSync(path).size;
+  } catch {
+    return;
+  }
+  if (size < 20)
+    return;
+  const header = Buffer.alloc(100);
+  try {
+    const fd = openSync(path, "r");
+    try {
+      readSync(fd, header, 0, 100, 0);
+    } finally {
+      closeSync(fd);
+    }
+  } catch {
+    return;
+  }
+  if (header.subarray(0, 15).toString("ascii") !== "SQLite format 3")
+    return;
+  if (header[18] !== 2 && header[19] !== 2)
+    return;
+  const walPath = `${path}-wal`;
+  const shmPath = `${path}-shm`;
+  let hadWalData = false;
+  try {
+    if (existsSync(walPath) && statSync(walPath).size > 0)
+      hadWalData = true;
+  } catch {
+  }
+  try {
+    const fd = openSync(path, "r+");
+    try {
+      writeSync(fd, Buffer.from([1, 1]), 0, 2, 18);
+    } finally {
+      closeSync(fd);
+    }
+  } catch (err) {
+    return;
+  }
+  for (const sidecar of [walPath, shmPath]) {
+    if (existsSync(sidecar)) {
+      try {
+        rmSync(sidecar, { force: true });
+      } catch {
+      }
+    }
+  }
+  if (hadWalData) {
+    console.warn(`[0sec] Migrated ${path} from WAL mode to rollback mode for WASM engine compatibility. A non-empty WAL sidecar was present and has been removed; any uncommitted transactions from a prior crashed run were discarded.`);
+  }
+}
+function clearStaleLockIfAny(path) {
+  const lockPath = `${path}.lock`;
+  let stat;
+  try {
+    stat = statSync(lockPath);
+  } catch {
+    return;
+  }
+  if (!stat.isDirectory())
+    return;
+  const ageMs = Date.now() - stat.mtimeMs;
+  const STALE_THRESHOLD_MS = 1e4;
+  if (ageMs < STALE_THRESHOLD_MS)
+    return;
+  try {
+    rmSync(lockPath, { recursive: true, force: true });
+    console.warn(`[0sec] Removed stale database lock at ${lockPath} (age ${Math.floor(ageMs / 1e3)}s \u2014 previous holder likely crashed).`);
+  } catch {
+  }
+}
+var osecDB = class {
+  sqlite;
+  db;
+  constructor(dbPath, options = {}) {
+    const path = resolveOsecDbPath(dbPath);
+    if (options.readOnly) {
+      if (path !== ":memory:" && !existsSync(path)) {
+        throw new Error(`Database does not exist: ${path}`);
+      }
+      this.initializeReadOnlyDatabase(path);
+      return;
+    }
+    if (path !== ":memory:") {
+      mkdirSync(dirname(path), { recursive: true, mode: 448 });
+    }
+    this.openWithRecovery(path);
+  }
+  openWithRecovery(path) {
+    migrateWalHeaderIfNeeded(path);
+    clearStaleLockIfAny(path);
+    try {
+      this.initializeDatabase(path);
+    } catch (error) {
+      try {
+        this.sqlite?.close();
+      } catch {
+      }
+      if (!isRecoverableDatabaseError(error))
+        throw error;
+      const backupPath = backupCorruptDatabase(path);
+      this.initializeDatabase(path);
+      console.warn(backupPath ? `[0sec] Recovered malformed database at ${path}. Backup saved to ${backupPath}.` : `[0sec] Recovered malformed database state at ${path} by recreating a fresh database.`);
+    }
+  }
+  initializeDatabase(path) {
+    this.sqlite = createShimmedDatabase(path);
+    this.sqlite.pragma("foreign_keys = ON");
+    ensureDatabaseHealthy(this.sqlite);
+    this.db = createDrizzleFromShim(this.sqlite, { schema: schema_exports });
+    this.sqlite.exec(SCHEMA_TABLES_SQL);
+    this.migrate();
+    this.sqlite.exec(SCHEMA_INDEXES_SQL);
+  }
+  initializeReadOnlyDatabase(path) {
+    this.sqlite = createShimmedDatabase(path);
+    this.sqlite.pragma("foreign_keys = ON");
+    this.db = createDrizzleFromShim(this.sqlite, { schema: schema_exports });
+  }
+  /**
+   * Upgrade databases created by older 0sec versions.
+   *
+   * SCHEMA_TABLES_SQL (above) now contains every table and every column from
+   * the drizzle schema, so fresh installs need no patching. This method only
+   * runs idempotent ALTER TABLEs for databases that were created before the
+   * corresponding columns/tables existed. Each guard is cheap (PRAGMA
+   * table_info is cached by SQLite) and the ALTERs are no-ops when the
+   * column is already present, so running on a fresh DB is harmless.
+   *
+   * See: https://github.com/0sec-labs/0sec/issues/420
+   */
+  migrate() {
+    const cols = this.sqlite.prepare("PRAGMA table_info(findings)").all();
+    const colNames = new Set(cols.map((c) => c.name));
+    if (!colNames.has("score")) {
+      this.sqlite.exec("ALTER TABLE findings ADD COLUMN score INTEGER");
+    }
+    if (!colNames.has("confidence")) {
+      this.sqlite.exec("ALTER TABLE findings ADD COLUMN confidence REAL");
+    }
+    if (!colNames.has("cvssVector")) {
+      this.sqlite.exec("ALTER TABLE findings ADD COLUMN cvssVector TEXT");
+    }
+    if (!colNames.has("cvssScore")) {
+      this.sqlite.exec("ALTER TABLE findings ADD COLUMN cvssScore REAL");
+    }
+    if (!colNames.has("fingerprint")) {
+      this.sqlite.exec("ALTER TABLE findings ADD COLUMN fingerprint TEXT");
+    }
+    if (!colNames.has("triageStatus")) {
+      this.sqlite.exec("ALTER TABLE findings ADD COLUMN triageStatus TEXT NOT NULL DEFAULT 'new'");
+    }
+    if (!colNames.has("triageNote")) {
+      this.sqlite.exec("ALTER TABLE findings ADD COLUMN triageNote TEXT");
+    }
+    if (!colNames.has("triagedAt")) {
+      this.sqlite.exec("ALTER TABLE findings ADD COLUMN triagedAt TEXT");
+    }
+    if (!colNames.has("workflowStatus")) {
+      this.sqlite.exec("ALTER TABLE findings ADD COLUMN workflowStatus TEXT NOT NULL DEFAULT 'backlog'");
+    }
+    if (!colNames.has("workflowAssignee")) {
+      this.sqlite.exec("ALTER TABLE findings ADD COLUMN workflowAssignee TEXT");
+    }
+    if (!colNames.has("workflowUpdatedAt")) {
+      this.sqlite.exec("ALTER TABLE findings ADD COLUMN workflowUpdatedAt TEXT");
+    }
+    if (!colNames.has("layerVerdicts")) {
+      this.sqlite.exec("ALTER TABLE findings ADD COLUMN layerVerdicts TEXT");
+    }
+    if (!colNames.has("impactAssessment")) {
+      this.sqlite.exec("ALTER TABLE findings ADD COLUMN impactAssessment TEXT");
+    }
+    if (!colNames.has("pocSteps")) {
+      this.sqlite.exec("ALTER TABLE findings ADD COLUMN pocSteps TEXT");
+    }
+    if (!colNames.has("verificationSpec")) {
+      this.sqlite.exec("ALTER TABLE findings ADD COLUMN verificationSpec TEXT");
+    }
+    if (!colNames.has("pocExecution")) {
+      this.sqlite.exec("ALTER TABLE findings ADD COLUMN pocExecution TEXT");
+    }
+    if (!colNames.has("semanticDedupe")) {
+      this.sqlite.exec("ALTER TABLE findings ADD COLUMN semanticDedupe TEXT");
+    }
+    if (!colNames.has("findingRank")) {
+      this.sqlite.exec("ALTER TABLE findings ADD COLUMN findingRank INTEGER");
+    }
+    if (!colNames.has("verificationResult")) {
+      this.sqlite.exec("ALTER TABLE findings ADD COLUMN verificationResult TEXT");
+    }
+    if (!colNames.has("reviewAnnotation")) {
+      this.sqlite.exec("ALTER TABLE findings ADD COLUMN reviewAnnotation TEXT");
+    }
+    this.sqlite.exec("UPDATE findings SET fingerprint = id WHERE fingerprint IS NULL OR fingerprint = ''");
+    this.sqlite.exec("UPDATE findings SET triageStatus = 'new' WHERE triageStatus IS NULL OR triageStatus = ''");
+    this.sqlite.exec(`
+      UPDATE findings
+      SET workflowStatus = CASE
+        WHEN workflowStatus IS NOT NULL AND workflowStatus != '' THEN workflowStatus
+        WHEN triageStatus = 'accepted' OR status = 'reported' THEN 'done'
+        WHEN triageStatus = 'suppressed' OR status = 'false-positive' THEN 'cancelled'
+        WHEN status IN ('verified', 'confirmed', 'scored') THEN 'human_review'
+        ELSE 'backlog'
+      END
+    `);
+    const eventCols = this.sqlite.prepare("PRAGMA table_info(pipeline_events)").all();
+    if (!new Set(eventCols.map((column) => column.name)).has("source")) {
+      this.sqlite.exec("ALTER TABLE pipeline_events ADD COLUMN source TEXT NOT NULL DEFAULT 'core'");
+    }
+  }
+  // ── Triage Memories (Semgrep-style per-target FP learning) ──
+  insertTriageMemory(row) {
+    this.sqlite.prepare(`INSERT INTO triage_memories (id, scope, scope_value, category, pattern, reasoning, created_at, applied_count)
+         VALUES (@id, @scope, @scopeValue, @category, @pattern, @reasoning, @createdAt, @appliedCount)`).run({
+      id: row.id,
+      scope: row.scope,
+      scopeValue: row.scopeValue ?? null,
+      category: row.category,
+      pattern: row.pattern,
+      reasoning: row.reasoning,
+      createdAt: row.createdAt,
+      appliedCount: row.appliedCount ?? 0
+    });
+  }
+  listTriageMemories(opts) {
+    const where = [];
+    const params = {};
+    if (opts?.scope) {
+      where.push("scope = @scope");
+      params.scope = opts.scope;
+    }
+    if (opts?.scopeValue) {
+      where.push("scope_value = @scopeValue");
+      params.scopeValue = opts.scopeValue;
+    }
+    if (opts?.category) {
+      where.push("category = @category");
+      params.category = opts.category;
+    }
+    const whereSql = where.length > 0 ? `WHERE ${where.join(" AND ")}` : "";
+    const limit = opts?.limit ?? 500;
+    const rows = this.sqlite.prepare(`SELECT id, scope, scope_value as scopeValue, category, pattern, reasoning,
+                created_at as createdAt, applied_count as appliedCount
+         FROM triage_memories
+         ${whereSql}
+         ORDER BY applied_count DESC, created_at DESC
+         LIMIT ${limit}`).all(params);
+    return rows;
+  }
+  deleteTriageMemory(id) {
+    const result = this.sqlite.prepare("DELETE FROM triage_memories WHERE id = ?").run(id);
+    return result.changes > 0;
+  }
+  incrementMemoryAppliedCount(id) {
+    this.sqlite.prepare("UPDATE triage_memories SET applied_count = applied_count + 1 WHERE id = ?").run(id);
+  }
+  buildCaseId(target) {
+    return `case:${encodeURIComponent(target.trim().toLowerCase())}`;
+  }
+  inferCaseTargetType(scan) {
+    if (scan.mode === "web")
+      return "web-app";
+    if (scan.mode === "probe" || scan.mode === "mcp")
+      return "ai-app";
+    if (scan.target.startsWith("http://") || scan.target.startsWith("https://"))
+      return "ai-app";
+    if (scan.target.startsWith("/") || scan.target.startsWith(".") || scan.target.includes("/"))
+      return "repository";
+    if (!scan.target.includes(" "))
+      return "package";
+    return "unknown";
+  }
+  syncCaseForScan(scanId) {
+    const scan = this.getScan(scanId);
+    if (!scan)
+      return null;
+    const caseId = this.buildCaseId(scan.target);
+    const status = scan.status === "running" ? "in_progress" : scan.status === "failed" ? "open" : "open";
+    this.upsertCase({
+      id: caseId,
+      target: scan.target,
+      targetType: this.inferCaseTargetType(scan),
+      latestScanId: scan.id,
+      status
+    });
+    return caseId;
+  }
+  syncFindingGraph(scanId, fingerprint) {
+    const scan = this.getScan(scanId);
+    if (!scan)
+      return;
+    const caseId = this.syncCaseForScan(scanId);
+    if (!caseId)
+      return;
+    const rows = this.getRelatedFindings(fingerprint);
+    if (rows.length === 0)
+      return;
+    const latest = rows[0];
+    const scanIds = [...new Set(rows.map((row) => row.scanId))];
+    const verdicts2 = this.listVerdicts(rows.map((row) => row.id));
+    const sessions = this.listSessions({ scanIds });
+    const runningRoles = new Set(sessions.filter((session) => session.status === "running").map((session) => session.agentRole));
+    const completedRoles = new Set(sessions.filter((session) => session.status === "completed").map((session) => session.agentRole));
+    const failedRoles = new Set(sessions.filter((session) => session.status === "failed").map((session) => session.agentRole));
+    const hasAnalysis = Boolean(latest.evidenceAnalysis?.trim());
+    const hasExploitArtifacts = Boolean(latest.evidenceRequest?.trim() || latest.evidenceResponse?.trim());
+    const hasVerifierVotes = verdicts2.length > 0;
+    const workflowStatus = normalizeWorkflowStatus(latest.workflowStatus, latest);
+    const phase = workflowStatus === "done" || workflowStatus === "cancelled" || workflowStatus === "blocked" ? workflowStatus : workflowStatus === "in_progress" ? "in_progress" : workflowStatus === "todo" ? "todo" : "backlog";
+    const reviewGate = workflowStatus === "agent_review" || workflowStatus === "human_review" ? workflowStatus : latest.status === "verified" || latest.status === "confirmed" || latest.status === "scored" || latest.status === "reported" || latest.status === "fixed" || latest.status === "false-positive" ? "human_review" : "none";
+    const surfaceMapStatus = failedRoles.has("discovery") ? "blocked" : runningRoles.has("discovery") ? "in_progress" : completedRoles.has("discovery") || scan.status !== "running" || rows.length > 0 ? "done" : "todo";
+    const hypothesisStatus = failedRoles.has("review") || failedRoles.has("audit") ? "blocked" : runningRoles.has("review") || runningRoles.has("audit") ? "in_progress" : hasAnalysis || completedRoles.has("review") || completedRoles.has("audit") ? "done" : surfaceMapStatus === "done" ? "todo" : "backlog";
+    const pocBuildStatus = failedRoles.has("attack") ? "blocked" : runningRoles.has("attack") ? "in_progress" : hasExploitArtifacts || completedRoles.has("attack") ? "done" : hypothesisStatus === "done" ? "todo" : "backlog";
+    const blindVerifyStatus = failedRoles.has("verify") ? "blocked" : runningRoles.has("verify") ? "in_progress" : hasVerifierVotes || ["verified", "confirmed", "scored", "reported", "fixed", "false-positive"].includes(latest.status) ? "done" : pocBuildStatus === "done" ? "todo" : "backlog";
+    const consensusStatus = workflowStatus === "done" || workflowStatus === "cancelled" || ["verified", "confirmed", "scored", "reported", "fixed", "false-positive"].includes(latest.status) ? "done" : reviewGate === "agent_review" ? hasVerifierVotes ? "todo" : blindVerifyStatus === "in_progress" ? "backlog" : "todo" : blindVerifyStatus === "done" ? "todo" : "backlog";
+    const humanReviewStatus = phase === "done" || phase === "cancelled" ? "done" : reviewGate === "human_review" ? "todo" : reviewGate === "agent_review" ? "blocked" : consensusStatus === "done" ? "todo" : "backlog";
+    const items = [
+      {
+        kind: "surface_map",
+        title: "Attack surface mapping",
+        owner: "attack-surface-agent",
+        status: surfaceMapStatus,
+        summary: "Initial target surface and candidate family context captured.",
+        dependsOn: null
+      },
+      {
+        kind: "hypothesis",
+        title: "Exploit hypothesis",
+        owner: "research-agent",
+        status: hypothesisStatus,
+        summary: "Research context and exploit framing for this family.",
+        dependsOn: `${fingerprint}:surface_map`
+      },
+      {
+        kind: "poc_build",
+        title: "PoC build",
+        owner: latest.workflowAssignee ?? null,
+        status: pocBuildStatus,
+        summary: "Exploit request/response artifacts and reproduction chain.",
+        dependsOn: `${fingerprint}:hypothesis`
+      },
+      {
+        kind: "blind_verify",
+        title: "Blind verify",
+        owner: null,
+        status: blindVerifyStatus,
+        summary: "Independent verification pass without research reasoning.",
+        dependsOn: `${fingerprint}:poc_build`
+      },
+      {
+        kind: "consensus",
+        title: "Consensus",
+        owner: "consensus-agent",
+        status: consensusStatus,
+        summary: "Resolve verifier evidence into a concrete next step.",
+        dependsOn: `${fingerprint}:blind_verify`
+      },
+      {
+        kind: "human_review",
+        title: "Human review",
+        owner: "operator",
+        status: humanReviewStatus,
+        summary: "Final operator sign-off before closure, suppression, or reporting.",
+        dependsOn: `${fingerprint}:consensus`
+      }
+    ];
+    for (const item of items) {
+      this.upsertWorkItem({
+        id: `${fingerprint}:${item.kind}`,
+        caseId,
+        findingFingerprint: fingerprint,
+        kind: item.kind,
+        title: item.title,
+        owner: item.owner,
+        status: item.status,
+        summary: item.summary,
+        dependsOn: item.dependsOn ?? null
+      });
+    }
+    this.upsertArtifact({
+      id: `${fingerprint}:request`,
+      caseId,
+      findingFingerprint: fingerprint,
+      kind: "request",
+      label: "Exploit request",
+      content: latest.evidenceRequest,
+      metadata: { findingId: latest.id, scanId: latest.scanId }
+    });
+    this.upsertArtifact({
+      id: `${fingerprint}:response`,
+      caseId,
+      findingFingerprint: fingerprint,
+      kind: "response",
+      label: "Exploit response",
+      content: latest.evidenceResponse,
+      metadata: { findingId: latest.id, scanId: latest.scanId }
+    });
+    this.upsertArtifact({
+      id: `${fingerprint}:analysis`,
+      caseId,
+      findingFingerprint: fingerprint,
+      kind: "analysis",
+      label: "Research analysis",
+      content: latest.evidenceAnalysis ?? null,
+      metadata: { findingId: latest.id, scanId: latest.scanId }
+    });
+  }
+  roleToWorkItemKind(role) {
+    if (role === "discovery")
+      return "surface_map";
+    if (role === "attack")
+      return "poc_build";
+    if (role === "verify")
+      return "blind_verify";
+    if (role === "review" || role === "audit")
+      return "hypothesis";
+    if (role === "report")
+      return "human_review";
+    return null;
+  }
+  workItemTemplate(kind) {
+    switch (kind) {
+      case "surface_map":
+        return {
+          title: "Attack surface mapping",
+          owner: "attack-surface-agent",
+          summary: "Map the target and establish the initial attack surface context.",
+          dependsOn: null
+        };
+      case "hypothesis":
+        return {
+          title: "Exploit hypothesis",
+          owner: "research-agent",
+          summary: "Turn the surface signal into a concrete exploit theory.",
+          dependsOn: "surface_map"
+        };
+      case "poc_build":
+        return {
+          title: "PoC build",
+          owner: "research-agent",
+          summary: "Create the exploit artifact chain and reproduction path.",
+          dependsOn: "hypothesis"
+        };
+      case "blind_verify":
+        return {
+          title: "Blind verify",
+          owner: "verify-agent",
+          summary: "Reproduce the issue independently without research reasoning.",
+          dependsOn: "poc_build"
+        };
+      case "consensus":
+        return {
+          title: "Consensus",
+          owner: "consensus-agent",
+          summary: "Resolve verifier evidence into the next decision.",
+          dependsOn: "blind_verify"
+        };
+      case "human_review":
+        return {
+          title: "Human review",
+          owner: "operator",
+          summary: "Final sign-off before report, suppression, or closure.",
+          dependsOn: "consensus"
+        };
+    }
+  }
+  ensureCaseWorkPlan(scanId) {
+    const caseId = this.syncCaseForScan(scanId);
+    if (!caseId)
+      return null;
+    for (const kind of ["surface_map", "hypothesis", "poc_build", "blind_verify", "consensus", "human_review"]) {
+      const template = this.workItemTemplate(kind);
+      this.upsertWorkItem({
+        id: `${caseId}:${kind}`,
+        caseId,
+        kind,
+        title: template.title,
+        owner: template.owner,
+        status: "backlog",
+        summary: template.summary,
+        dependsOn: template.dependsOn ? `${caseId}:${template.dependsOn}` : null
+      });
+    }
+    return caseId;
+  }
+  transitionCaseWorkItem(scanId, kind, status, opts) {
+    this.transaction(() => {
+      const caseId = this.ensureCaseWorkPlan(scanId);
+      if (!caseId)
+        return;
+      const template = this.workItemTemplate(kind);
+      const finding = this.getLatestFindingForScan(scanId);
+      this.upsertWorkItem({
+        id: `${caseId}:${kind}`,
+        caseId,
+        kind,
+        title: template.title,
+        owner: opts?.owner ?? template.owner,
+        status,
+        summary: opts?.summary ?? template.summary,
+        dependsOn: template.dependsOn ? `${caseId}:${template.dependsOn}` : null
+      });
+      this.logEvent({
+        scanId,
+        stage: kind,
+        eventType: "work_item_transition",
+        findingId: finding?.id ?? void 0,
+        agentRole: opts?.owner ?? template.owner ?? void 0,
+        payload: {
+          kind,
+          status,
+          owner: opts?.owner ?? template.owner ?? null,
+          summary: opts?.summary ?? template.summary,
+          caseId
+        },
+        timestamp: Date.now()
+      });
+    });
+  }
+  syncSessionGraph(session) {
+    const caseId = this.syncCaseForScan(session.scanId);
+    if (!caseId)
+      return;
+    this.upsertArtifact({
+      id: `session:${session.id}`,
+      caseId,
+      kind: "sessions",
+      label: `${session.agentRole} session`,
+      content: JSON.stringify(session.toolContext),
+      metadata: { scanId: session.scanId, agentRole: session.agentRole, status: session.status }
+    });
+  }
+  syncEventGraph(event, eventId) {
+    const caseId = this.syncCaseForScan(event.scanId);
+    if (!caseId)
+      return;
+    const finding = event.findingId ? this.getFinding(event.findingId) : null;
+    this.upsertArtifact({
+      id: `event:${eventId}`,
+      caseId,
+      findingFingerprint: finding?.fingerprint ?? null,
+      kind: "events",
+      label: `${event.stage}:${event.eventType}`,
+      content: JSON.stringify(event.payload),
+      metadata: {
+        scanId: event.scanId,
+        agentRole: event.agentRole ?? null,
+        findingId: event.findingId ?? null,
+        timestamp: event.timestamp
+      }
+    });
+  }
+  // ── Scans ──
+  createScan(config, id = randomUUID()) {
+    const sqliteId = id;
+    this.db.insert(scans).values({
+      id: sqliteId,
+      target: config.target,
+      depth: config.depth,
+      runtime: config.runtime ?? "api",
+      mode: config.mode ?? "probe",
+      status: "running",
+      startedAt: (/* @__PURE__ */ new Date()).toISOString()
+    }).run();
+    this.syncCaseForScan(id);
+    return id;
+  }
+  deleteScan(scanId) {
+    const scan = this.getScan(scanId);
+    if (!scan)
+      return false;
+    const findingIds = this.db.select({ id: findings.id, fingerprint: findings.fingerprint }).from(findings).where(eq(findings.scanId, scanId)).all();
+    this.transaction(() => {
+      if (findingIds.length > 0) {
+        const ids = findingIds.map((finding) => finding.id);
+        this.db.delete(verdicts).where(inArray(verdicts.findingId, ids)).run();
+      }
+      this.db.delete(agentSessions).where(eq(agentSessions.scanId, scanId)).run();
+      this.db.delete(pipelineEvents).where(eq(pipelineEvents.scanId, scanId)).run();
+      this.db.delete(attackResults).where(eq(attackResults.scanId, scanId)).run();
+      this.db.delete(findings).where(eq(findings.scanId, scanId)).run();
+      this.db.delete(scans).where(eq(scans.id, scanId)).run();
+      const remainingTargetScans = this.db.select({ id: scans.id, startedAt: scans.startedAt }).from(scans).where(eq(scans.target, scan.target)).orderBy(desc(scans.startedAt)).all();
+      const caseId = this.buildCaseId(scan.target);
+      if (remainingTargetScans.length === 0) {
+        this.db.delete(cases).where(eq(cases.id, caseId)).run();
+      } else {
+        this.db.update(cases).set({
+          latestScanId: remainingTargetScans[0].id,
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+        }).where(eq(cases.id, caseId)).run();
+      }
+    });
+    return true;
+  }
+  completeScan(scanId, summary) {
+    const scan = this.db.select({ startedAt: scans.startedAt }).from(scans).where(eq(scans.id, scanId)).get();
+    const durationMs = scan ? Date.now() - new Date(scan.startedAt).getTime() : 0;
+    this.db.update(scans).set({
+      status: "completed",
+      completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      durationMs,
+      summary: JSON.stringify(summary)
+    }).where(eq(scans.id, scanId)).run();
+    this.syncCaseForScan(scanId);
+  }
+  reopenScan(scanId) {
+    this.db.update(scans).set({
+      status: "running",
+      completedAt: null,
+      durationMs: null
+    }).where(eq(scans.id, scanId)).run();
+    this.syncCaseForScan(scanId);
+  }
+  failScan(scanId, error) {
+    this.db.update(scans).set({
+      status: "failed",
+      completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      summary: JSON.stringify({ error })
+    }).where(eq(scans.id, scanId)).run();
+    this.syncCaseForScan(scanId);
+  }
+  getScan(scanId) {
+    return this.db.select().from(scans).where(eq(scans.id, scanId)).get();
+  }
+  listScans(limit = 20) {
+    return this.db.select().from(scans).orderBy(desc(scans.startedAt)).limit(limit).all();
+  }
+  listScansByTarget(target, opts) {
+    const query = this.db.select().from(scans).where(eq(scans.target, target)).orderBy(desc(scans.startedAt));
+    if (opts?.limit !== void 0)
+      query.limit(opts.limit);
+    return query.all();
+  }
+  // ── Targets ──
+  upsertTarget(info) {
+    const existing = this.db.select({ id: targets.id }).from(targets).where(eq(targets.url, info.url)).get();
+    if (existing) {
+      this.db.update(targets).set({
+        type: info.type,
+        model: info.model ?? null,
+        systemPrompt: info.systemPrompt ?? null,
+        detectedFeatures: info.detectedFeatures ? JSON.stringify(info.detectedFeatures) : null,
+        endpoints: info.endpoints ? JSON.stringify(info.endpoints) : null,
+        lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
+      }).where(eq(targets.id, existing.id)).run();
+      return existing.id;
+    }
+    const id = randomUUID();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    this.db.insert(targets).values({
+      id,
+      url: info.url,
+      type: info.type,
+      model: info.model ?? null,
+      systemPrompt: info.systemPrompt ?? null,
+      detectedFeatures: info.detectedFeatures ? JSON.stringify(info.detectedFeatures) : null,
+      endpoints: info.endpoints ? JSON.stringify(info.endpoints) : null,
+      firstSeenAt: now,
+      lastSeenAt: now
+    }).run();
+    return id;
+  }
+  getTarget(url) {
+    return this.db.select().from(targets).where(eq(targets.url, url)).get();
+  }
+  // ── Findings ──
+  saveFinding(scanId, finding) {
+    const workflowFinding = finding;
+    const scan = this.getScan(scanId);
+    const fingerprint = finding.fingerprint ?? buildFindingFingerprint(scan?.target ?? scanId, finding);
+    const inheritedTriage = this.getLatestFindingByFingerprint(fingerprint);
+    const inheritedWorkflowStatus = normalizeWorkflowStatus(workflowFinding.workflowStatus ?? inheritedTriage?.workflowStatus, {
+      status: finding.status,
+      triageStatus: finding.triageStatus ?? inheritedTriage?.triageStatus ?? "new"
+    });
+    const inheritedWorkflowAssignee = workflowFinding.workflowAssignee ?? inheritedTriage?.workflowAssignee ?? null;
+    const impactAssessmentJson = finding.impactAssessment ? JSON.stringify(finding.impactAssessment) : null;
+    const layerVerdictsJson = finding.layerVerdicts && finding.layerVerdicts.length > 0 ? JSON.stringify(finding.layerVerdicts) : null;
+    const pocStepsJson = finding.pocSteps && finding.pocSteps.length > 0 ? JSON.stringify(finding.pocSteps) : null;
+    const verificationSpecJson = finding.verificationSpec ? JSON.stringify(finding.verificationSpec) : null;
+    const semanticDedupeJson = finding.semanticDedupe ? JSON.stringify(finding.semanticDedupe) : null;
+    const verificationResultJson = serializeFindingVerificationResult(finding.verification_result);
+    const reviewAnnotationJson = serializeFindingReviewAnnotation(finding.reviewAnnotation);
+    const candidateFindingRank = finding.findingRank;
+    const findingRank = typeof candidateFindingRank === "number" && Number.isSafeInteger(candidateFindingRank) && candidateFindingRank > 0 ? candidateFindingRank : null;
+    const derivedEvidence = deriveEvidenceFromPocSteps(finding);
+    const evidenceRequest = finding.evidence.request || derivedEvidence.request;
+    const evidenceResponse = finding.evidence.response || derivedEvidence.response;
+    const evidenceAnalysis = finding.evidence.analysis ?? derivedEvidence.analysis ?? null;
+    this.db.insert(findings).values({
+      id: finding.id,
+      scanId,
+      templateId: finding.templateId,
+      title: finding.title,
+      description: finding.description,
+      severity: finding.severity,
+      category: finding.category,
+      status: finding.status,
+      fingerprint,
+      triageStatus: finding.triageStatus ?? inheritedTriage?.triageStatus ?? "new",
+      triageNote: finding.triageNote ?? inheritedTriage?.triageNote ?? null,
+      triagedAt: finding.triageStatus || inheritedTriage?.triageStatus ? (/* @__PURE__ */ new Date()).toISOString() : null,
+      workflowStatus: inheritedWorkflowStatus,
+      workflowAssignee: inheritedWorkflowAssignee,
+      workflowUpdatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      confidence: finding.confidence ?? null,
+      cvssVector: finding.cvssVector ?? null,
+      cvssScore: finding.cvssScore ?? null,
+      evidenceRequest,
+      evidenceResponse,
+      evidenceAnalysis,
+      layerVerdicts: layerVerdictsJson,
+      impactAssessment: impactAssessmentJson,
+      pocSteps: pocStepsJson,
+      verificationSpec: verificationSpecJson,
+      semanticDedupe: semanticDedupeJson,
+      findingRank,
+      verificationResult: verificationResultJson,
+      reviewAnnotation: reviewAnnotationJson,
+      timestamp: finding.timestamp
+    }).onConflictDoUpdate({
+      target: findings.id,
+      set: {
+        templateId: finding.templateId,
+        title: finding.title,
+        description: finding.description,
+        severity: finding.severity,
+        category: finding.category,
+        status: finding.status,
+        fingerprint,
+        triageStatus: finding.triageStatus ?? inheritedTriage?.triageStatus ?? "new",
+        triageNote: finding.triageNote ?? inheritedTriage?.triageNote ?? null,
+        triagedAt: finding.triageStatus || inheritedTriage?.triageStatus ? (/* @__PURE__ */ new Date()).toISOString() : null,
+        workflowStatus: inheritedWorkflowStatus,
+        workflowAssignee: inheritedWorkflowAssignee,
+        workflowUpdatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        confidence: finding.confidence ?? null,
+        cvssVector: finding.cvssVector ?? null,
+        cvssScore: finding.cvssScore ?? null,
+        evidenceRequest,
+        evidenceResponse,
+        evidenceAnalysis,
+        layerVerdicts: layerVerdictsJson,
+        impactAssessment: impactAssessmentJson,
+        pocSteps: pocStepsJson,
+        verificationSpec: verificationSpecJson,
+        semanticDedupe: semanticDedupeJson,
+        findingRank,
+        verificationResult: verificationResultJson,
+        reviewAnnotation: reviewAnnotationJson,
+        timestamp: finding.timestamp
+      }
+    }).run();
+    this.syncFindingGraph(scanId, fingerprint);
+  }
+  getFinding(findingId) {
+    return this.db.select().from(findings).where(eq(findings.id, findingId)).get();
+  }
+  /**
+   * Read path for the two source-fix gate fields. Returns the hydrated
+   * `verification_result` / `reviewAnnotation` for a finding, with each key
+   * omitted when the finding has none (including rows written before the
+   * columns existed). Callers building a `Finding` spread this over the row:
+   * `{ ...mapped, ...db.getFindingReviewFields(id) }`.
+   */
+  getFindingReviewFields(findingId) {
+    return restoreFindingReviewFields(this.getFinding(findingId));
+  }
+  getFindings(scanId) {
+    return this.db.select().from(findings).where(eq(findings.scanId, scanId)).orderBy(findings.severity, findings.timestamp).all();
+  }
+  getScanFindings(scanId) {
+    return this.getFindings(scanId);
+  }
+  getLatestFindingForScan(scanId) {
+    return this.db.select().from(findings).where(eq(findings.scanId, scanId)).orderBy(desc(findings.timestamp)).get();
+  }
+  listFindings(opts) {
+    const conditions = [];
+    if (opts?.scanId)
+      conditions.push(eq(findings.scanId, opts.scanId));
+    if (opts?.severity)
+      conditions.push(eq(findings.severity, opts.severity));
+    if (opts?.category)
+      conditions.push(eq(findings.category, opts.category));
+    if (opts?.status)
+      conditions.push(eq(findings.status, opts.status));
+    if (opts?.triageStatus)
+      conditions.push(eq(findings.triageStatus, opts.triageStatus));
+    const query = this.db.select().from(findings).orderBy(desc(findings.timestamp)).limit(opts?.limit ?? 100);
+    if (conditions.length > 0) {
+      return query.where(and(...conditions)).all();
+    }
+    return query.all();
+  }
+  /** Alias for listFindings — backward compat with core agent tools */
+  queryFindings(opts) {
+    return this.listFindings(opts);
+  }
+  updateFindingStatus(findingId, status) {
+    const finding = this.getFinding(findingId);
+    this.db.update(findings).set({ status }).where(eq(findings.id, findingId)).run();
+    if (finding?.fingerprint)
+      this.syncFindingGraph(finding.scanId, finding.fingerprint);
+  }
+  saveFindingPocExecution(findingId, execution) {
+    const serialized = JSON.stringify(execution);
+    this.db.update(findings).set({ pocExecution: serialized }).where(eq(findings.id, findingId)).run();
+  }
+  updateFindingTriageByFingerprint(fingerprint, triageStatus, triageNote) {
+    const latestFinding = this.getLatestFindingByFingerprint(fingerprint);
+    const workflowStatus = triageStatus === "accepted" ? "done" : triageStatus === "suppressed" ? "cancelled" : null;
+    this.db.update(findings).set({
+      triageStatus,
+      triageNote: triageNote ?? null,
+      triagedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...workflowStatus ? {
+        workflowStatus,
+        workflowUpdatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      } : {}
+    }).where(eq(findings.fingerprint, fingerprint)).run();
+    const refreshedFinding = this.getLatestFindingByFingerprint(fingerprint) ?? latestFinding;
+    if (refreshedFinding) {
+      this.logEvent({
+        scanId: refreshedFinding.scanId,
+        stage: "triage",
+        eventType: "triage_updated",
+        findingId: refreshedFinding.id,
+        payload: {
+          fingerprint,
+          triageStatus,
+          workflowStatus: workflowStatus ?? "backlog",
+          triageNote: triageNote ?? null
+        },
+        timestamp: Date.now()
+      });
+      this.syncFindingGraph(refreshedFinding.scanId, fingerprint);
+      return;
+    }
+    this.syncFindingGraph("", fingerprint);
+  }
+  updateFindingWorkflowByFingerprint(fingerprint, workflowStatus, workflowAssignee) {
+    const latestFinding = this.getLatestFindingByFingerprint(fingerprint);
+    const normalizedWorkflowStatus = normalizeWorkflowStatus(workflowStatus);
+    const triageStatus = normalizedWorkflowStatus === "done" ? "accepted" : normalizedWorkflowStatus === "cancelled" ? "suppressed" : "new";
+    this.db.update(findings).set({
+      workflowStatus: normalizedWorkflowStatus,
+      workflowAssignee: workflowAssignee ?? null,
+      workflowUpdatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      triageStatus,
+      triagedAt: triageStatus === "new" ? null : (/* @__PURE__ */ new Date()).toISOString()
+    }).where(eq(findings.fingerprint, fingerprint)).run();
+    const refreshedFinding = this.getLatestFindingByFingerprint(fingerprint) ?? latestFinding;
+    if (refreshedFinding) {
+      this.logEvent({
+        scanId: refreshedFinding.scanId,
+        stage: "workflow",
+        eventType: "workflow_status_changed",
+        findingId: refreshedFinding.id,
+        payload: {
+          fingerprint,
+          workflowStatus: normalizedWorkflowStatus,
+          workflowAssignee: workflowAssignee ?? null,
+          triageStatus
+        },
+        timestamp: Date.now()
+      });
+      this.syncFindingGraph(refreshedFinding.scanId, fingerprint);
+      return;
+    }
+    this.syncFindingGraph("", fingerprint);
+  }
+  updateFindingTriage(findingId, triageStatus, triageNote) {
+    const finding = this.getFinding(findingId);
+    if (!finding)
+      throw new Error(`Finding ${findingId} not found`);
+    if (!finding.fingerprint)
+      throw new Error(`Finding ${findingId} has no fingerprint`);
+    this.updateFindingTriageByFingerprint(finding.fingerprint, triageStatus, triageNote);
+  }
+  getLatestFindingByFingerprint(fingerprint) {
+    return this.db.select().from(findings).where(eq(findings.fingerprint, fingerprint)).orderBy(desc(findings.timestamp)).get();
+  }
+  getRelatedFindings(fingerprint) {
+    return this.db.select().from(findings).where(eq(findings.fingerprint, fingerprint)).orderBy(desc(findings.timestamp)).all();
+  }
+  // ── Status Pipeline: discovered → verified → confirmed → scored → reported → fixed ──
+  transitionFindingStatus(findingId, newStatus) {
+    const finding = this.getFinding(findingId);
+    if (!finding)
+      throw new Error(`Finding ${findingId} not found`);
+    const currentIdx = findingStatuses.indexOf(finding.status);
+    const newIdx = findingStatuses.indexOf(newStatus);
+    if (newStatus !== "false-positive" && newIdx <= currentIdx) {
+      throw new Error(`Cannot transition from '${finding.status}' to '${newStatus}'. Pipeline: ${findingStatuses.join(" \u2192 ")}`);
+    }
+    this.db.update(findings).set({ status: newStatus }).where(eq(findings.id, findingId)).run();
+    if (finding.fingerprint)
+      this.syncFindingGraph(finding.scanId, finding.fingerprint);
+  }
+  scoreFinding(findingId, score) {
+    const finding = this.getFinding(findingId);
+    if (score < 0 || score > 100)
+      throw new Error("Score must be 0-100");
+    this.db.update(findings).set({ score, status: "scored" }).where(eq(findings.id, findingId)).run();
+    if (finding?.fingerprint)
+      this.syncFindingGraph(finding.scanId, finding.fingerprint);
+  }
+  // ── Attack Results ──
+  saveAttackResult(scanId, result) {
+    const id = randomUUID();
+    this.db.insert(attackResults).values({
+      id,
+      scanId,
+      templateId: result.templateId,
+      payloadId: result.payloadId,
+      outcome: result.outcome,
+      request: result.request,
+      response: result.response,
+      latencyMs: result.latencyMs,
+      timestamp: result.timestamp,
+      error: result.error ?? null
+    }).run();
+  }
+  getAttackResults(scanId) {
+    return this.db.select().from(attackResults).where(eq(attackResults.scanId, scanId)).orderBy(attackResults.timestamp).all();
+  }
+  // ── Verdicts (multi-agent consensus) ──
+  addVerdict(verdict) {
+    this.db.insert(verdicts).values({
+      id: verdict.id,
+      findingId: verdict.findingId,
+      agentRole: verdict.agentRole,
+      model: verdict.model,
+      verdict: verdict.verdict,
+      confidence: verdict.confidence,
+      reasoning: verdict.reasoning,
+      timestamp: verdict.timestamp
+    }).run();
+    const finding = this.getFinding(verdict.findingId);
+    if (finding?.fingerprint)
+      this.syncFindingGraph(finding.scanId, finding.fingerprint);
+  }
+  getVerdicts(findingId) {
+    return this.db.select().from(verdicts).where(eq(verdicts.findingId, findingId)).orderBy(desc(verdicts.timestamp)).all();
+  }
+  listVerdicts(findingIds) {
+    if (!findingIds || findingIds.length === 0)
+      return [];
+    const placeholders = findingIds.map(() => "?").join(",");
+    return this.sqlite.prepare(`SELECT * FROM verdicts WHERE findingId IN (${placeholders}) ORDER BY timestamp DESC`).all(...findingIds);
+  }
+  /** Compute consensus: all agree TRUE_POSITIVE → verified, all FALSE_POSITIVE → false-positive */
+  computeConsensus(findingId) {
+    const vds = this.getVerdicts(findingId);
+    if (vds.length === 0)
+      return "pending";
+    const types = new Set(vds.map((v) => v.verdict));
+    if (types.size === 1 && types.has("TRUE_POSITIVE"))
+      return "verified";
+    if (types.size === 1 && types.has("FALSE_POSITIVE"))
+      return "false-positive";
+    return "disputed";
+  }
+  // ── Pipeline Events (audit trail) ──
+  logEvent(event) {
+    const id = randomUUID();
+    this.db.insert(pipelineEvents).values({
+      id,
+      scanId: event.scanId,
+      stage: event.stage,
+      eventType: event.eventType,
+      findingId: event.findingId ?? null,
+      agentRole: event.agentRole ?? null,
+      source: event.source ?? "core",
+      payload: JSON.stringify(event.payload),
+      timestamp: event.timestamp
+    }).run();
+    this.syncEventGraph(event, id);
+    return id;
+  }
+  getEvents(scanId, opts) {
+    const conditions = [eq(pipelineEvents.scanId, scanId)];
+    if (opts?.stage)
+      conditions.push(eq(pipelineEvents.stage, opts.stage));
+    if (opts?.eventType)
+      conditions.push(eq(pipelineEvents.eventType, opts.eventType));
+    return this.db.select().from(pipelineEvents).where(and(...conditions)).orderBy(pipelineEvents.timestamp).all();
+  }
+  listRecentEvents(limit = 50) {
+    return this.db.select({
+      id: pipelineEvents.id,
+      scanId: pipelineEvents.scanId,
+      scanTarget: scans.target,
+      stage: pipelineEvents.stage,
+      eventType: pipelineEvents.eventType,
+      findingId: pipelineEvents.findingId,
+      findingFingerprint: findings.fingerprint,
+      agentRole: pipelineEvents.agentRole,
+      source: pipelineEvents.source,
+      payload: pipelineEvents.payload,
+      timestamp: pipelineEvents.timestamp
+    }).from(pipelineEvents).innerJoin(scans, eq(pipelineEvents.scanId, scans.id)).leftJoin(findings, eq(pipelineEvents.findingId, findings.id)).orderBy(desc(pipelineEvents.timestamp)).limit(limit).all();
+  }
+  /**
+   * Read persisted events strictly after a durable `(timestamp, id)` cursor.
+   * The UUID tie-breaker makes same-millisecond multi-process writes stable.
+   */
+  listEventsAfter(cursor, limit = 250) {
+    const selectEvents = () => this.db.select({
+      id: pipelineEvents.id,
+      scanId: pipelineEvents.scanId,
+      scanTarget: scans.target,
+      stage: pipelineEvents.stage,
+      eventType: pipelineEvents.eventType,
+      findingId: pipelineEvents.findingId,
+      findingFingerprint: findings.fingerprint,
+      agentRole: pipelineEvents.agentRole,
+      source: pipelineEvents.source,
+      payload: pipelineEvents.payload,
+      timestamp: pipelineEvents.timestamp
+    }).from(pipelineEvents).innerJoin(scans, eq(pipelineEvents.scanId, scans.id)).leftJoin(findings, eq(pipelineEvents.findingId, findings.id));
+    if (!cursor) {
+      return selectEvents().orderBy(asc(pipelineEvents.timestamp), asc(pipelineEvents.id)).limit(limit).all();
+    }
+    return selectEvents().where(or(gt(pipelineEvents.timestamp, cursor.timestamp), and(eq(pipelineEvents.timestamp, cursor.timestamp), gt(pipelineEvents.id, cursor.id)))).orderBy(asc(pipelineEvents.timestamp), asc(pipelineEvents.id)).limit(limit).all();
+  }
+  // ── Agent Sessions (resumable state) ──
+  saveSession(session) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    this.db.insert(agentSessions).values({
+      id: session.id,
+      scanId: session.scanId,
+      agentRole: session.agentRole,
+      turnCount: session.turnCount,
+      messages: JSON.stringify(session.messages),
+      toolContext: JSON.stringify(session.toolContext),
+      status: session.status,
+      createdAt: now,
+      updatedAt: now
+    }).onConflictDoUpdate({
+      target: agentSessions.id,
+      set: {
+        turnCount: session.turnCount,
+        messages: JSON.stringify(session.messages),
+        toolContext: JSON.stringify(session.toolContext),
+        status: session.status,
+        updatedAt: now
+      }
+    }).run();
+    this.syncSessionGraph(session);
+  }
+  getSession(scanId, agentRole) {
+    return this.db.select().from(agentSessions).where(and(eq(agentSessions.scanId, scanId), eq(agentSessions.agentRole, agentRole))).get();
+  }
+  getSessionById(sessionId) {
+    return this.db.select().from(agentSessions).where(eq(agentSessions.id, sessionId)).get();
+  }
+  listSessions(opts) {
+    const conditions = [];
+    const params = [];
+    if (opts?.scanIds?.length) {
+      conditions.push(`scanId IN (${opts.scanIds.map(() => "?").join(",")})`);
+      params.push(...opts.scanIds);
+    }
+    if (opts?.status) {
+      conditions.push("status = ?");
+      params.push(opts.status);
+    }
+    const where = conditions.length ? `WHERE ${conditions.join(" AND ")}` : "";
+    return this.sqlite.prepare(`SELECT * FROM agent_sessions ${where} ORDER BY updatedAt DESC`).all(...params);
+  }
+  // ── Cases / Work Items / Artifacts ──
+  upsertCase(record) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    this.db.insert(cases).values({
+      id: record.id,
+      target: record.target,
+      targetType: record.targetType,
+      latestScanId: record.latestScanId ?? null,
+      status: record.status,
+      createdAt: record.createdAt ?? now,
+      updatedAt: record.updatedAt ?? now
+    }).onConflictDoUpdate({
+      target: cases.id,
+      set: {
+        target: record.target,
+        targetType: record.targetType,
+        latestScanId: record.latestScanId ?? null,
+        status: record.status,
+        updatedAt: record.updatedAt ?? now
+      }
+    }).run();
+  }
+  getCase(caseId) {
+    return this.db.select().from(cases).where(eq(cases.id, caseId)).get();
+  }
+  listCases(limit = 100) {
+    return this.db.select().from(cases).orderBy(desc(cases.updatedAt)).limit(limit).all();
+  }
+  upsertWorkItem(record) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    this.db.insert(workItems).values({
+      id: record.id,
+      caseId: record.caseId,
+      findingFingerprint: record.findingFingerprint ?? null,
+      kind: record.kind,
+      title: record.title,
+      owner: record.owner ?? null,
+      status: record.status,
+      summary: record.summary ?? null,
+      dependsOn: record.dependsOn ?? null,
+      createdAt: record.createdAt ?? now,
+      updatedAt: record.updatedAt ?? now
+    }).onConflictDoUpdate({
+      target: workItems.id,
+      set: {
+        caseId: record.caseId,
+        findingFingerprint: record.findingFingerprint ?? null,
+        kind: record.kind,
+        title: record.title,
+        owner: record.owner ?? null,
+        status: record.status,
+        summary: record.summary ?? null,
+        dependsOn: record.dependsOn ?? null,
+        updatedAt: record.updatedAt ?? now
+      }
+    }).run();
+  }
+  listWorkItems(opts) {
+    const conditions = [];
+    if (opts?.caseId)
+      conditions.push(eq(workItems.caseId, opts.caseId));
+    if (opts?.findingFingerprint)
+      conditions.push(eq(workItems.findingFingerprint, opts.findingFingerprint));
+    if (opts?.status)
+      conditions.push(eq(workItems.status, opts.status));
+    const query = this.db.select().from(workItems).orderBy(desc(workItems.updatedAt)).limit(opts?.limit ?? 200);
+    if (conditions.length > 0)
+      return query.where(and(...conditions)).all();
+    return query.all();
+  }
+  claimWorkItem(workItemId, workerId, opts) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const result = this.sqlite.prepare(`
+        UPDATE work_items
+        SET status = 'in_progress',
+            owner = @owner,
+            summary = COALESCE(@summary, summary),
+            updatedAt = @updatedAt
+        WHERE id = @id
+          AND status = @expectedStatus
+      `).run({
+      id: workItemId,
+      owner: opts?.owner ?? workerId,
+      summary: opts?.summary ?? null,
+      updatedAt: now,
+      expectedStatus: opts?.expectedStatus ?? "todo"
+    });
+    return result.changes > 0;
+  }
+  upsertArtifact(record) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    this.db.insert(artifacts).values({
+      id: record.id,
+      caseId: record.caseId,
+      findingFingerprint: record.findingFingerprint ?? null,
+      workItemId: record.workItemId ?? null,
+      kind: record.kind,
+      label: record.label,
+      content: record.content ?? null,
+      metadata: record.metadata ? JSON.stringify(record.metadata) : null,
+      createdAt: record.createdAt ?? now,
+      updatedAt: record.updatedAt ?? now
+    }).onConflictDoUpdate({
+      target: artifacts.id,
+      set: {
+        caseId: record.caseId,
+        findingFingerprint: record.findingFingerprint ?? null,
+        workItemId: record.workItemId ?? null,
+        kind: record.kind,
+        label: record.label,
+        content: record.content ?? null,
+        metadata: record.metadata ? JSON.stringify(record.metadata) : null,
+        updatedAt: record.updatedAt ?? now
+      }
+    }).run();
+  }
+  listArtifacts(opts) {
+    const conditions = [];
+    if (opts?.caseId)
+      conditions.push(eq(artifacts.caseId, opts.caseId));
+    if (opts?.findingFingerprint)
+      conditions.push(eq(artifacts.findingFingerprint, opts.findingFingerprint));
+    if (opts?.workItemId)
+      conditions.push(eq(artifacts.workItemId, opts.workItemId));
+    const query = this.db.select().from(artifacts).orderBy(desc(artifacts.updatedAt)).limit(opts?.limit ?? 200);
+    if (conditions.length > 0)
+      return query.where(and(...conditions)).all();
+    return query.all();
+  }
+  upsertWorker(record) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    this.db.insert(workers).values({
+      id: record.id,
+      role: record.role,
+      status: record.status,
+      label: record.label,
+      currentCaseId: record.currentCaseId ?? null,
+      currentWorkItemId: record.currentWorkItemId ?? null,
+      currentScanId: record.currentScanId ?? null,
+      pid: record.pid ?? null,
+      host: record.host ?? null,
+      lastError: record.lastError ?? null,
+      heartbeatAt: record.heartbeatAt ?? now,
+      startedAt: record.startedAt ?? now,
+      updatedAt: record.updatedAt ?? now
+    }).onConflictDoUpdate({
+      target: workers.id,
+      set: {
+        role: record.role,
+        status: record.status,
+        label: record.label,
+        currentCaseId: record.currentCaseId ?? null,
+        currentWorkItemId: record.currentWorkItemId ?? null,
+        currentScanId: record.currentScanId ?? null,
+        pid: record.pid ?? null,
+        host: record.host ?? null,
+        lastError: record.lastError ?? null,
+        heartbeatAt: record.heartbeatAt ?? now,
+        updatedAt: record.updatedAt ?? now
+      }
+    }).run();
+  }
+  listWorkers(limit = 50) {
+    return this.db.select().from(workers).orderBy(desc(workers.heartbeatAt)).limit(limit).all();
+  }
+  stopWorkersByLabel(label, exceptId) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const result = this.sqlite.prepare(`
+        UPDATE workers
+        SET status = 'stopped',
+            currentCaseId = NULL,
+            currentWorkItemId = NULL,
+            currentScanId = NULL,
+            updatedAt = @updatedAt,
+            heartbeatAt = @heartbeatAt,
+            lastError = CASE
+              WHEN lastError IS NULL OR lastError = '' THEN 'Superseded by a newer worker with the same label.'
+              ELSE lastError
+            END
+        WHERE label = @label
+          AND (@exceptId IS NULL OR id != @exceptId)
+          AND status != 'stopped'
+      `).run({
+      label,
+      exceptId: exceptId ?? null,
+      updatedAt: now,
+      heartbeatAt: now
+    });
+    return result.changes;
+  }
+  deleteWorkersByStatus(statuses) {
+    const values = Array.isArray(statuses) ? statuses : [statuses];
+    if (values.length === 0)
+      return 0;
+    const placeholders = values.map(() => "?").join(",");
+    const result = this.sqlite.prepare(`DELETE FROM workers WHERE status IN (${placeholders})`).run(...values);
+    return result.changes;
+  }
+  // ── Persistent credential store (0sec#771) ──
+  /**
+   * Upsert a discovered foothold keyed by (credentialKind, valueHash). First
+   * write records the discovery attribution (target/finding/scan/turn);
+   * subsequent sightings bump `timesSeen` and refresh `lastScanId`/`lastSeenAt`
+   * without overwriting the original discovery columns. Returns the stored row.
+   *
+   * Plaintext is never accepted here — the caller passes a precomputed
+   * `valueHash` and a redacted `valuePreview`.
+   */
+  upsertPersistentCredential(input) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const existing = this.getPersistentCredential(input.credentialKind, input.valueHash);
+    if (existing) {
+      this.sqlite.prepare(`UPDATE persistent_credentials
+             SET timesSeen = timesSeen + 1,
+                 lastScanId = @lastScanId,
+                 lastSeenAt = @lastSeenAt,
+                 context = COALESCE(context, @context)
+           WHERE id = @id`).run({
+        id: existing.id,
+        lastScanId: input.scanId ?? existing.lastScanId ?? null,
+        lastSeenAt: now,
+        context: input.context ?? null
+      });
+      return this.getPersistentCredential(input.credentialKind, input.valueHash);
+    }
+    const id = randomUUID();
+    this.sqlite.prepare(`INSERT INTO persistent_credentials
+           (id, credentialKind, valueHash, valuePreview, context, target,
+            firstScanId, firstFindingId, firstSource, firstTurn, lastScanId,
+            timesSeen, firstSeenAt, lastSeenAt)
+         VALUES
+           (@id, @credentialKind, @valueHash, @valuePreview, @context, @target,
+            @firstScanId, @firstFindingId, @firstSource, @firstTurn, @lastScanId,
+            1, @firstSeenAt, @lastSeenAt)`).run({
+      id,
+      credentialKind: input.credentialKind,
+      valueHash: input.valueHash,
+      valuePreview: input.valuePreview,
+      context: input.context ?? null,
+      target: input.target ?? null,
+      firstScanId: input.scanId ?? null,
+      firstFindingId: input.findingId ?? null,
+      firstSource: input.source ?? null,
+      firstTurn: input.turn ?? null,
+      lastScanId: input.scanId ?? null,
+      firstSeenAt: now,
+      lastSeenAt: now
+    });
+    return this.getPersistentCredential(input.credentialKind, input.valueHash);
+  }
+  getPersistentCredential(credentialKind, valueHash) {
+    return this.sqlite.prepare(`SELECT * FROM persistent_credentials WHERE credentialKind = ? AND valueHash = ?`).get(credentialKind, valueHash);
+  }
+  listPersistentCredentials(query = {}) {
+    const where = [];
+    const params = [];
+    if (query.credentialKind) {
+      where.push("credentialKind = ?");
+      params.push(query.credentialKind);
+    }
+    if (query.target) {
+      where.push("target = ?");
+      params.push(query.target);
+    }
+    const whereSql = where.length > 0 ? `WHERE ${where.join(" AND ")}` : "";
+    const limit = query.limit ?? 500;
+    return this.sqlite.prepare(`SELECT * FROM persistent_credentials ${whereSql} ORDER BY lastSeenAt DESC LIMIT ${limit}`).all(...params);
+  }
+  // ── Trust graph edges (0sec#771) ──
+  /**
+   * Upsert a directed trust edge keyed by
+   * (srcKind, srcId, dstKind, dstId, relation). Re-observing an edge refreshes
+   * `updatedAt` (and `confidence`/`note`/attribution when provided) rather than
+   * inserting a duplicate. Returns the stored row.
+   */
+  upsertTrustGraphEdge(input) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const existing = this.sqlite.prepare(`SELECT * FROM trust_graph_edges
+          WHERE srcKind = ? AND srcId = ? AND dstKind = ? AND dstId = ? AND relation = ?`).get(input.srcKind, input.srcId, input.dstKind, input.dstId, input.relation);
+    if (existing) {
+      this.sqlite.prepare(`UPDATE trust_graph_edges
+              SET scanId = COALESCE(@scanId, scanId),
+                  findingId = COALESCE(@findingId, findingId),
+                  confidence = COALESCE(@confidence, confidence),
+                  note = COALESCE(@note, note),
+                  updatedAt = @updatedAt
+            WHERE id = @id`).run({
+        id: existing.id,
+        scanId: input.scanId ?? null,
+        findingId: input.findingId ?? null,
+        confidence: input.confidence ?? null,
+        note: input.note ?? null,
+        updatedAt: now
+      });
+      return { ...existing, updatedAt: now };
+    }
+    const id = randomUUID();
+    this.sqlite.prepare(`INSERT INTO trust_graph_edges
+           (id, srcKind, srcId, dstKind, dstId, relation, scanId, findingId,
+            confidence, note, createdAt, updatedAt)
+         VALUES
+           (@id, @srcKind, @srcId, @dstKind, @dstId, @relation, @scanId,
+            @findingId, @confidence, @note, @createdAt, @updatedAt)`).run({
+      id,
+      srcKind: input.srcKind,
+      srcId: input.srcId,
+      dstKind: input.dstKind,
+      dstId: input.dstId,
+      relation: input.relation,
+      scanId: input.scanId ?? null,
+      findingId: input.findingId ?? null,
+      confidence: input.confidence ?? null,
+      note: input.note ?? null,
+      createdAt: now,
+      updatedAt: now
+    });
+    return {
+      id,
+      srcKind: input.srcKind,
+      srcId: input.srcId,
+      dstKind: input.dstKind,
+      dstId: input.dstId,
+      relation: input.relation,
+      scanId: input.scanId ?? null,
+      findingId: input.findingId ?? null,
+      confidence: input.confidence ?? null,
+      note: input.note ?? null,
+      createdAt: now,
+      updatedAt: now
+    };
+  }
+  listTrustGraphEdges(query = {}) {
+    const where = [];
+    const params = [];
+    if (query.srcKind) {
+      where.push("srcKind = ?");
+      params.push(query.srcKind);
+    }
+    if (query.srcId) {
+      where.push("srcId = ?");
+      params.push(query.srcId);
+    }
+    if (query.relation) {
+      where.push("relation = ?");
+      params.push(query.relation);
+    }
+    const whereSql = where.length > 0 ? `WHERE ${where.join(" AND ")}` : "";
+    const limit = query.limit ?? 500;
+    return this.sqlite.prepare(`SELECT * FROM trust_graph_edges ${whereSql} ORDER BY updatedAt DESC LIMIT ${limit}`).all(...params);
+  }
+  // ── Utilities ──
+  close() {
+    this.sqlite.close();
+  }
+  transaction(fn) {
+    return this.sqlite.transaction(fn)();
+  }
+  /** Get summary stats across all findings */
+  getStats() {
+    const rows = this.sqlite.prepare(`SELECT severity, COUNT(*) as count FROM findings GROUP BY severity`).all();
+    const stats = {};
+    for (const row of rows)
+      stats[row.severity] = row.count;
+    return {
+      total: rows.reduce((sum, r) => sum + r.count, 0),
+      critical: stats["critical"] ?? 0,
+      high: stats["high"] ?? 0,
+      medium: stats["medium"] ?? 0,
+      low: stats["low"] ?? 0,
+      info: stats["info"] ?? 0
+    };
+  }
+};
+function normalizeFingerprintPart(value) {
+  return value.toLowerCase().replace(/\r/g, "").replace(/:\d+(?::\d+)?/g, "").replace(/\s+/g, " ").trim();
+}
+function buildFindingFingerprint(target, finding) {
+  const key = [
+    normalizeFingerprintPart(target),
+    normalizeFingerprintPart(finding.category),
+    normalizeFingerprintPart(finding.title),
+    normalizeFingerprintPart(finding.evidence.request.split("\n")[0] ?? "")
+  ].join("::");
+  return createHash("sha256").update(key).digest("hex").slice(0, 24);
+}
+function asPlainObject(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return void 0;
+  return value;
+}
+function parseJsonObjectColumn(value) {
+  if (value == null)
+    return void 0;
+  if (typeof value === "string") {
+    if (value.length === 0)
+      return void 0;
+    try {
+      return asPlainObject(JSON.parse(value));
+    } catch {
+      return void 0;
+    }
+  }
+  return asPlainObject(value);
+}
+function parseFindingVerificationResult(value) {
+  const parsed = parseJsonObjectColumn(value);
+  if (!parsed || typeof parsed.status !== "string" || parsed.status.length === 0)
+    return void 0;
+  return parsed;
+}
+function parseFindingReviewAnnotation(value) {
+  const parsed = parseJsonObjectColumn(value);
+  if (!parsed || typeof parsed.path !== "string" || parsed.path.length === 0)
+    return void 0;
+  return parsed;
+}
+function serializeFindingVerificationResult(value) {
+  const usable = parseFindingVerificationResult(value);
+  return usable ? JSON.stringify(usable) : null;
+}
+function serializeFindingReviewAnnotation(value) {
+  const usable = parseFindingReviewAnnotation(value);
+  return usable ? JSON.stringify(usable) : null;
+}
+function restoreFindingReviewFields(row) {
+  if (!row)
+    return {};
+  const verificationResult = parseFindingVerificationResult(row.verificationResult);
+  const reviewAnnotation = parseFindingReviewAnnotation(row.reviewAnnotation);
+  return {
+    ...verificationResult ? { verification_result: verificationResult } : {},
+    ...reviewAnnotation ? { reviewAnnotation } : {}
+  };
+}
+function deriveEvidenceFromPocSteps(finding) {
+  if (!finding.pocSteps || finding.pocSteps.length === 0) {
+    return { request: "", response: "", analysis: void 0 };
+  }
+  const requestParts = [];
+  const responseParts = [];
+  const analysisParts = [];
+  for (const step of finding.pocSteps) {
+    const prefix = `[${step.kind}] ${step.summary}`;
+    if (step.action.type === "shell") {
+      requestParts.push(`${prefix}
+$ ${step.action.cmd}`);
+    } else if (step.action.type === "http") {
+      requestParts.push(`${prefix}
+${step.action.method.toUpperCase()} ${step.action.url}`);
+    } else if (step.action.type === "docker") {
+      requestParts.push(`${prefix}
+docker run ${step.action.image} ${step.action.args.join(" ")}`.trim());
+    } else {
+      responseParts.push(`${prefix}
+${step.action.text}`);
+    }
+    if (step.expect) {
+      analysisParts.push(`- ${step.id}: expect ${step.expect.type}`);
+    }
+  }
+  return {
+    request: requestParts.join("\n\n"),
+    response: responseParts.join("\n\n"),
+    analysis: analysisParts.length > 0 ? `PoC step expectations:
+${analysisParts.join("\n")}` : void 0
+  };
+}
+var SCHEMA_TABLES_SQL = `
+CREATE TABLE IF NOT EXISTS scans (
+  id TEXT PRIMARY KEY,
+  target TEXT NOT NULL,
+  depth TEXT NOT NULL,
+  runtime TEXT NOT NULL DEFAULT 'api',
+  mode TEXT NOT NULL DEFAULT 'probe',
+  status TEXT NOT NULL DEFAULT 'running',
+  startedAt TEXT NOT NULL,
+  completedAt TEXT,
+  durationMs INTEGER,
+  summary TEXT
+);
+
+CREATE TABLE IF NOT EXISTS targets (
+  id TEXT PRIMARY KEY,
+  url TEXT NOT NULL UNIQUE,
+  type TEXT NOT NULL DEFAULT 'unknown',
+  model TEXT,
+  systemPrompt TEXT,
+  detectedFeatures TEXT,
+  endpoints TEXT,
+  firstSeenAt TEXT NOT NULL,
+  lastSeenAt TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS findings (
+  id TEXT PRIMARY KEY,
+  scanId TEXT NOT NULL REFERENCES scans(id),
+  templateId TEXT NOT NULL,
+  title TEXT NOT NULL,
+  description TEXT NOT NULL,
+  severity TEXT NOT NULL,
+  category TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'discovered',
+  fingerprint TEXT,
+  triageStatus TEXT NOT NULL DEFAULT 'new',
+  triageNote TEXT,
+  triagedAt TEXT,
+  workflowStatus TEXT NOT NULL DEFAULT 'backlog',
+  workflowAssignee TEXT,
+  workflowUpdatedAt TEXT,
+  score INTEGER,
+  confidence REAL,
+  cvssVector TEXT,
+  cvssScore REAL,
+  evidenceRequest TEXT NOT NULL,
+  evidenceResponse TEXT NOT NULL,
+  evidenceAnalysis TEXT,
+  layerVerdicts TEXT,
+  impactAssessment TEXT,
+  pocSteps TEXT,
+  verificationSpec TEXT,
+  pocExecution TEXT,
+  semanticDedupe TEXT,
+  findingRank INTEGER,
+  verificationResult TEXT,
+  reviewAnnotation TEXT,
+  timestamp INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS attack_results (
+  id TEXT PRIMARY KEY,
+  scanId TEXT NOT NULL REFERENCES scans(id),
+  templateId TEXT NOT NULL,
+  payloadId TEXT NOT NULL,
+  outcome TEXT NOT NULL,
+  request TEXT NOT NULL,
+  response TEXT NOT NULL,
+  latencyMs INTEGER NOT NULL,
+  timestamp INTEGER NOT NULL,
+  error TEXT
+);
+
+CREATE TABLE IF NOT EXISTS verdicts (
+  id TEXT PRIMARY KEY,
+  findingId TEXT NOT NULL REFERENCES findings(id),
+  agentRole TEXT NOT NULL,
+  model TEXT NOT NULL DEFAULT '',
+  verdict TEXT NOT NULL,
+  confidence REAL NOT NULL DEFAULT 0,
+  reasoning TEXT NOT NULL DEFAULT '',
+  timestamp INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS pipeline_events (
+  id TEXT PRIMARY KEY,
+  scanId TEXT NOT NULL REFERENCES scans(id),
+  source TEXT NOT NULL DEFAULT 'core',
+  stage TEXT NOT NULL,
+  eventType TEXT NOT NULL,
+  findingId TEXT,
+  agentRole TEXT,
+  payload TEXT NOT NULL DEFAULT '{}',
+  timestamp INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS agent_sessions (
+  id TEXT PRIMARY KEY,
+  scanId TEXT NOT NULL REFERENCES scans(id),
+  agentRole TEXT NOT NULL,
+  turnCount INTEGER NOT NULL DEFAULT 0,
+  messages TEXT NOT NULL DEFAULT '[]',
+  toolContext TEXT NOT NULL DEFAULT '{}',
+  status TEXT NOT NULL DEFAULT 'running',
+  createdAt TEXT NOT NULL,
+  updatedAt TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS cases (
+  id TEXT PRIMARY KEY,
+  target TEXT NOT NULL UNIQUE,
+  targetType TEXT NOT NULL DEFAULT 'unknown',
+  latestScanId TEXT,
+  status TEXT NOT NULL DEFAULT 'open',
+  createdAt TEXT NOT NULL,
+  updatedAt TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS work_items (
+  id TEXT PRIMARY KEY,
+  caseId TEXT NOT NULL REFERENCES cases(id),
+  findingFingerprint TEXT,
+  kind TEXT NOT NULL,
+  title TEXT NOT NULL,
+  owner TEXT,
+  status TEXT NOT NULL DEFAULT 'backlog',
+  summary TEXT,
+  dependsOn TEXT,
+  createdAt TEXT NOT NULL,
+  updatedAt TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS artifacts (
+  id TEXT PRIMARY KEY,
+  caseId TEXT NOT NULL REFERENCES cases(id),
+  findingFingerprint TEXT,
+  workItemId TEXT,
+  kind TEXT NOT NULL,
+  label TEXT NOT NULL,
+  content TEXT,
+  metadata TEXT,
+  createdAt TEXT NOT NULL,
+  updatedAt TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS triage_memories (
+  id TEXT PRIMARY KEY,
+  scope TEXT NOT NULL,
+  scope_value TEXT,
+  category TEXT NOT NULL,
+  pattern TEXT NOT NULL,
+  reasoning TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  applied_count INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS workers (
+  id TEXT PRIMARY KEY,
+  role TEXT NOT NULL DEFAULT 'orchestrator',
+  status TEXT NOT NULL DEFAULT 'idle',
+  label TEXT NOT NULL,
+  currentCaseId TEXT,
+  currentWorkItemId TEXT,
+  currentScanId TEXT,
+  pid INTEGER,
+  host TEXT,
+  lastError TEXT,
+  heartbeatAt TEXT NOT NULL,
+  startedAt TEXT NOT NULL,
+  updatedAt TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS persistent_credentials (
+  id TEXT PRIMARY KEY,
+  credentialKind TEXT NOT NULL,
+  valueHash TEXT NOT NULL,
+  valuePreview TEXT NOT NULL,
+  context TEXT,
+  target TEXT,
+  firstScanId TEXT,
+  firstFindingId TEXT,
+  firstSource TEXT,
+  firstTurn INTEGER,
+  lastScanId TEXT,
+  timesSeen INTEGER NOT NULL DEFAULT 1,
+  firstSeenAt TEXT NOT NULL,
+  lastSeenAt TEXT NOT NULL,
+  UNIQUE(credentialKind, valueHash)
+);
+
+CREATE TABLE IF NOT EXISTS trust_graph_edges (
+  id TEXT PRIMARY KEY,
+  srcKind TEXT NOT NULL,
+  srcId TEXT NOT NULL,
+  dstKind TEXT NOT NULL,
+  dstId TEXT NOT NULL,
+  relation TEXT NOT NULL,
+  scanId TEXT,
+  findingId TEXT,
+  confidence REAL,
+  note TEXT,
+  createdAt TEXT NOT NULL,
+  updatedAt TEXT NOT NULL,
+  UNIQUE(srcKind, srcId, dstKind, dstId, relation)
+);
+`;
+var SCHEMA_INDEXES_SQL = `
+CREATE INDEX IF NOT EXISTS idx_findings_scanId ON findings(scanId);
+CREATE INDEX IF NOT EXISTS idx_findings_severity ON findings(severity);
+CREATE INDEX IF NOT EXISTS idx_findings_category ON findings(category);
+CREATE INDEX IF NOT EXISTS idx_findings_status ON findings(status);
+CREATE INDEX IF NOT EXISTS idx_findings_fingerprint ON findings(fingerprint);
+CREATE INDEX IF NOT EXISTS idx_findings_triageStatus ON findings(triageStatus);
+CREATE INDEX IF NOT EXISTS idx_findings_workflowStatus ON findings(workflowStatus);
+CREATE INDEX IF NOT EXISTS idx_attack_results_scanId ON attack_results(scanId);
+CREATE INDEX IF NOT EXISTS idx_targets_url ON targets(url);
+CREATE INDEX IF NOT EXISTS idx_verdicts_findingId ON verdicts(findingId);
+CREATE INDEX IF NOT EXISTS idx_events_scanId ON pipeline_events(scanId);
+CREATE INDEX IF NOT EXISTS idx_events_stage ON pipeline_events(stage);
+CREATE INDEX IF NOT EXISTS idx_events_findingId ON pipeline_events(findingId);
+CREATE INDEX IF NOT EXISTS idx_sessions_scanId ON agent_sessions(scanId);
+CREATE INDEX IF NOT EXISTS idx_sessions_role ON agent_sessions(agentRole);
+CREATE INDEX IF NOT EXISTS idx_cases_target ON cases(target);
+CREATE INDEX IF NOT EXISTS idx_cases_status ON cases(status);
+CREATE INDEX IF NOT EXISTS idx_work_items_caseId ON work_items(caseId);
+CREATE INDEX IF NOT EXISTS idx_work_items_fingerprint ON work_items(findingFingerprint);
+CREATE INDEX IF NOT EXISTS idx_work_items_status ON work_items(status);
+CREATE INDEX IF NOT EXISTS idx_artifacts_caseId ON artifacts(caseId);
+CREATE INDEX IF NOT EXISTS idx_artifacts_fingerprint ON artifacts(findingFingerprint);
+CREATE INDEX IF NOT EXISTS idx_artifacts_workItemId ON artifacts(workItemId);
+CREATE INDEX IF NOT EXISTS idx_workers_status ON workers(status);
+CREATE INDEX IF NOT EXISTS idx_workers_heartbeat ON workers(heartbeatAt);
+CREATE INDEX IF NOT EXISTS idx_memories_category ON triage_memories(category, scope);
+CREATE INDEX IF NOT EXISTS idx_memories_scope ON triage_memories(scope, scope_value);
+CREATE INDEX IF NOT EXISTS idx_pcred_kind_hash ON persistent_credentials(credentialKind, valueHash);
+CREATE INDEX IF NOT EXISTS idx_pcred_target ON persistent_credentials(target);
+CREATE INDEX IF NOT EXISTS idx_pcred_kind ON persistent_credentials(credentialKind);
+CREATE INDEX IF NOT EXISTS idx_tge_src ON trust_graph_edges(srcKind, srcId);
+CREATE INDEX IF NOT EXISTS idx_tge_dst ON trust_graph_edges(dstKind, dstId);
+CREATE INDEX IF NOT EXISTS idx_tge_relation ON trust_graph_edges(relation);
+`;
+function normalizeWorkflowStatus(value, fallback) {
+  if (value && findingWorkflowStatuses.includes(value)) {
+    return value;
+  }
+  if (fallback?.triageStatus === "accepted" || fallback?.status === "reported" || fallback?.status === "fixed") {
+    return "done";
+  }
+  if (fallback?.triageStatus === "suppressed" || fallback?.status === "false-positive") {
+    return "cancelled";
+  }
+  if (fallback?.status && ["verified", "confirmed", "scored"].includes(fallback.status)) {
+    return "human_review";
+  }
+  return "backlog";
+}
+
+// packages/db/dist/run-storage.js
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync, renameSync as renameSync2, rmSync as rmSync2, writeFileSync } from "node:fs";
+import { dirname as dirname2, isAbsolute, join as join2, resolve } from "node:path";
+var STATE_DB_FILE = "state.db";
+var REPORT_FILE = "report.json";
+function normalizeRunId(value) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(value)) {
+    throw new Error(`Invalid 0sec run id ${JSON.stringify(value)}.`);
+  }
+  return value;
+}
+function resolveOsecRunStorage(options = {}) {
+  const env = options.env ?? process.env;
+  const cloudRunId = env["0SEC_CLOUD_SCAN_ID"]?.trim() || void 0;
+  let runId = normalizeRunId(options.runId ?? cloudRunId ?? randomUUID2());
+  const stateDir = homeStateDir(options.homeDir);
+  const configuredRunDir = env["0SEC_RUN_DIR"]?.trim() || void 0;
+  const configuredDbPath = options.dbPath ?? (env["0SEC_DB_PATH"]?.trim() || void 0);
+  let runDir = configuredRunDir ? resolve(configuredRunDir) : runStateDir(runId, options.homeDir);
+  if (options.resume && !configuredRunDir && !configuredDbPath && !existsSync2(runDir)) {
+    const runsDir = join2(stateDir, "runs");
+    if (existsSync2(runsDir)) {
+      const matches = readdirSync(runsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && entry.name.startsWith(runId));
+      if (matches.length > 1) {
+        throw new Error(`0sec run id prefix '${runId}' is ambiguous.`);
+      }
+      const match = matches[0];
+      if (match) {
+        runId = normalizeRunId(match.name);
+        runDir = join2(runsDir, runId);
+      }
+    }
+  }
+  if (!isAbsolute(runDir)) {
+    throw new Error(`0sec run directory must be absolute: ${JSON.stringify(runDir)}.`);
+  }
+  let dbPath = configuredDbPath ? configuredDbPath === ":memory:" ? configuredDbPath : resolve(configuredDbPath) : join2(runDir, STATE_DB_FILE);
+  const configuredReportPath = env["0SEC_REPORT_PATH"]?.trim() || void 0;
+  const reportPath = configuredReportPath ? resolve(configuredReportPath) : !configuredDbPath || configuredRunDir ? join2(runDir, REPORT_FILE) : void 0;
+  if (options.resume && !configuredDbPath && !existsSync2(dbPath)) {
+    const legacyDbPath = join2(stateDir, "0sec.db");
+    if (existsSync2(legacyDbPath))
+      dbPath = legacyDbPath;
+  }
+  if (!configuredDbPath || configuredRunDir || reportPath) {
+    mkdirSync2(runDir, { recursive: true, mode: 448 });
+  }
+  if (dbPath !== ":memory:") {
+    mkdirSync2(dirname2(dbPath), { recursive: true, mode: 448 });
+  }
+  if (reportPath) {
+    mkdirSync2(dirname2(reportPath), { recursive: true, mode: 448 });
+  }
+  return {
+    runId,
+    runDir,
+    dbPath,
+    ...reportPath ? { reportPath } : {}
+  };
+}
+function listOsecRunDatabasePaths(homeDir) {
+  const runsDir = join2(homeStateDir(homeDir), "runs");
+  if (!existsSync2(runsDir))
+    return [];
+  return readdirSync(runsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join2(runsDir, entry.name, STATE_DB_FILE)).filter((path) => existsSync2(path));
+}
+function writeOsecRunReport(storage, report) {
+  const reportPath = storage.reportPath;
+  if (!reportPath)
+    return;
+  const body = `${JSON.stringify(report)}
+`;
+  const temporaryPath = join2(dirname2(reportPath), `.${REPORT_FILE}.${process.pid}.${randomUUID2()}.tmp`);
+  try {
+    writeFileSync(temporaryPath, body, { encoding: "utf8", mode: 384 });
+    renameSync2(temporaryPath, reportPath);
+    chmodSync(reportPath, 384);
+  } finally {
+    if (existsSync2(temporaryPath)) {
+      rmSync2(temporaryPath, { force: true });
+    }
+  }
+}
+
+export {
+  findingStatuses,
+  findingTriageStatuses,
+  caseStatuses,
+  workItemKinds,
+  workItemStatuses,
+  artifactKinds,
+  workerStatuses,
+  credentialKinds,
+  scans,
+  targets,
+  findings,
+  attackResults,
+  verdicts,
+  pipelineEvents,
+  agentSessions,
+  cases,
+  workItems,
+  artifacts,
+  triageMemories,
+  workers,
+  persistentCredentials,
+  trustGraphEdges,
+  resolveOsecDbPath,
+  resetOsecDatabase,
+  repairOsecDatabase,
+  osecDB,
+  parseFindingVerificationResult,
+  parseFindingReviewAnnotation,
+  restoreFindingReviewFields,
+  resolveOsecRunStorage,
+  listOsecRunDatabasePaths,
+  writeOsecRunReport
+};