0sec-cli 0.22.1 → 0.22.4

package/chunks/{chunk-VWITLWXB.js → chunk-L2CCO4KE.js}

@@ -3,8 +3,9 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   homeStateDir,
+  parseSecurityWorkflowInput,
   runStateDir
-} from "./chunk-KAU6NLGP.js";
+} from "./chunk-6KFB6AYN.js";
 import {
   __export
 } from "./chunk-VCSFCHAJ.js";
@@ -229,11 +230,22 @@ function createDrizzleFromShim(client, config = {}) {
   return db;
 }
 
+// packages/db/dist/db-directory.js
+import { existsSync, mkdirSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+function ensureDatabaseDirectory(path) {
+  if (path === ":memory:")
+    return;
+  const directory = dirname(resolve(path));
+  if (!existsSync(directory))
+    mkdirSync(directory, { recursive: true, mode: 448 });
+}
+
 // packages/db/dist/database.js
 import { asc, eq, desc, and, gt, inArray, or } from "drizzle-orm";
 import { createHash, randomUUID } from "node:crypto";
-import { dirname, join } from "node:path";
-import { closeSync, existsSync, mkdirSync, openSync, readSync, renameSync, rmSync, statSync, writeSync } from "node:fs";
+import { join } from "node:path";
+import { closeSync, existsSync as existsSync2, openSync, readSync, renameSync, rmSync, statSync, writeSync } from "node:fs";
 
 // packages/db/dist/schema.js
 var schema_exports = {};
@@ -622,12 +634,10 @@ function resolveOsecDbPath(dbPath) {
 }
 function resetOsecDatabase(dbPath) {
   const path = resolveOsecDbPath(dbPath);
-  if (path !== ":memory:") {
-    mkdirSync(dirname(path), { recursive: true, mode: 448 });
-  }
+  ensureDatabaseDirectory(path);
   for (const suffix of ["", "-wal", "-shm"]) {
     const candidate = `${path}${suffix}`;
-    if (existsSync(candidate)) {
+    if (existsSync2(candidate)) {
       rmSync(candidate, { force: true });
     }
   }
@@ -635,9 +645,7 @@ function resetOsecDatabase(dbPath) {
 }
 function repairOsecDatabase(dbPath) {
   const path = resolveOsecDbPath(dbPath);
-  if (path !== ":memory:") {
-    mkdirSync(dirname(path), { recursive: true, mode: 448 });
-  }
+  ensureDatabaseDirectory(path);
   clearStaleLockIfAny(path);
   const backupPath = backupCorruptDatabase(path) ?? void 0;
   resetOsecDatabase(path);
@@ -653,13 +661,13 @@ function timestampTag() {
   return (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
 }
 function backupCorruptDatabase(path) {
-  if (!existsSync(path))
+  if (!existsSync2(path))
     return null;
   const backupPath = `${path}.corrupt-${timestampTag()}`;
   renameSync(path, backupPath);
   for (const suffix of ["-wal", "-shm", ".lock"]) {
     const candidate = `${path}${suffix}`;
-    if (!existsSync(candidate))
+    if (!existsSync2(candidate))
       continue;
     try {
       renameSync(candidate, `${backupPath}${suffix}`);
@@ -679,7 +687,7 @@ function ensureDatabaseHealthy(sqlite) {
   }
 }
 function migrateWalHeaderIfNeeded(path) {
-  if (!existsSync(path))
+  if (!existsSync2(path))
     return;
   let size;
   try {
@@ -708,7 +716,7 @@ function migrateWalHeaderIfNeeded(path) {
   const shmPath = `${path}-shm`;
   let hadWalData = false;
   try {
-    if (existsSync(walPath) && statSync(walPath).size > 0)
+    if (existsSync2(walPath) && statSync(walPath).size > 0)
       hadWalData = true;
   } catch {
   }
@@ -723,7 +731,7 @@ function migrateWalHeaderIfNeeded(path) {
     return;
   }
   for (const sidecar of [walPath, shmPath]) {
-    if (existsSync(sidecar)) {
+    if (existsSync2(sidecar)) {
       try {
         rmSync(sidecar, { force: true });
       } catch {
@@ -760,15 +768,13 @@ var osecDB = class {
   constructor(dbPath, options = {}) {
     const path = resolveOsecDbPath(dbPath);
     if (options.readOnly) {
-      if (path !== ":memory:" && !existsSync(path)) {
+      if (path !== ":memory:" && !existsSync2(path)) {
         throw new Error(`Database does not exist: ${path}`);
       }
       this.initializeReadOnlyDatabase(path);
       return;
     }
-    if (path !== ":memory:") {
-      mkdirSync(dirname(path), { recursive: true, mode: 448 });
-    }
+    ensureDatabaseDirectory(path);
     this.openWithRecovery(path);
   }
   openWithRecovery(path) {
@@ -1954,8 +1960,8 @@ var osecDB = class {
     });
     return result.changes;
   }
-  deleteWorkersByStatus(statuses) {
-    const values = Array.isArray(statuses) ? statuses : [statuses];
+  deleteWorkersByStatus(statuses2) {
+    const values = Array.isArray(statuses2) ? statuses2 : [statuses2];
     if (values.length === 0)
       return 0;
     const placeholders = values.map(() => "?").join(",");
@@ -2526,8 +2532,8 @@ function normalizeWorkflowStatus(value, fallback) {
 
 // packages/db/dist/run-storage.js
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync, renameSync as renameSync2, rmSync as rmSync2, writeFileSync } from "node:fs";
-import { dirname as dirname2, isAbsolute, join as join2, resolve } from "node:path";
+import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync, renameSync as renameSync2, rmSync as rmSync2, writeFileSync } from "node:fs";
+import { dirname as dirname2, isAbsolute, join as join2, resolve as resolve2 } from "node:path";
 var STATE_DB_FILE = "state.db";
 var REPORT_FILE = "report.json";
 function normalizeRunId(value) {
@@ -2543,10 +2549,10 @@ function resolveOsecRunStorage(options = {}) {
   const stateDir = homeStateDir(options.homeDir);
   const configuredRunDir = env["ZERO_RUN_DIR"]?.trim() || void 0;
   const configuredDbPath = options.dbPath ?? (env["ZERO_DB_PATH"]?.trim() || void 0);
-  let runDir = configuredRunDir ? resolve(configuredRunDir) : runStateDir(runId, options.homeDir);
-  if (options.resume && !configuredRunDir && !configuredDbPath && !existsSync2(runDir)) {
+  let runDir = configuredRunDir ? resolve2(configuredRunDir) : runStateDir(runId, options.homeDir);
+  if (options.resume && !configuredRunDir && !configuredDbPath && !existsSync3(runDir)) {
     const runsDir = join2(stateDir, "runs");
-    if (existsSync2(runsDir)) {
+    if (existsSync3(runsDir)) {
       const matches = readdirSync(runsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && entry.name.startsWith(runId));
       if (matches.length > 1) {
         throw new Error(`0 run id prefix '${runId}' is ambiguous.`);
@@ -2561,12 +2567,12 @@ function resolveOsecRunStorage(options = {}) {
   if (!isAbsolute(runDir)) {
     throw new Error(`0 run directory must be absolute: ${JSON.stringify(runDir)}.`);
   }
-  let dbPath = configuredDbPath ? configuredDbPath === ":memory:" ? configuredDbPath : resolve(configuredDbPath) : join2(runDir, STATE_DB_FILE);
+  let dbPath = configuredDbPath ? configuredDbPath === ":memory:" ? configuredDbPath : resolve2(configuredDbPath) : join2(runDir, STATE_DB_FILE);
   const configuredReportPath = env["ZERO_REPORT_PATH"]?.trim() || void 0;
-  const reportPath = configuredReportPath ? resolve(configuredReportPath) : !configuredDbPath || configuredRunDir ? join2(runDir, REPORT_FILE) : void 0;
-  if (options.resume && !configuredDbPath && !existsSync2(dbPath)) {
+  const reportPath = configuredReportPath ? resolve2(configuredReportPath) : !configuredDbPath || configuredRunDir ? join2(runDir, REPORT_FILE) : void 0;
+  if (options.resume && !configuredDbPath && !existsSync3(dbPath)) {
     const legacyDbPath = join2(stateDir, "0.db");
-    if (existsSync2(legacyDbPath))
+    if (existsSync3(legacyDbPath))
       dbPath = legacyDbPath;
   }
   if (!configuredDbPath || configuredRunDir || reportPath) {
@@ -2587,9 +2593,9 @@ function resolveOsecRunStorage(options = {}) {
 }
 function listOsecRunDatabasePaths(homeDir) {
   const runsDir = join2(homeStateDir(homeDir), "runs");
-  if (!existsSync2(runsDir))
+  if (!existsSync3(runsDir))
     return [];
-  return readdirSync(runsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join2(runsDir, entry.name, STATE_DB_FILE)).filter((path) => existsSync2(path));
+  return readdirSync(runsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join2(runsDir, entry.name, STATE_DB_FILE)).filter((path) => existsSync3(path));
 }
 function writeOsecRunReport(storage, report) {
   const reportPath = storage.reportPath;
@@ -2603,12 +2609,249 @@ function writeOsecRunReport(storage, report) {
     renameSync2(temporaryPath, reportPath);
     chmodSync(reportPath, 384);
   } finally {
-    if (existsSync2(temporaryPath)) {
+    if (existsSync3(temporaryPath)) {
       rmSync2(temporaryPath, { force: true });
     }
   }
 }
 
+// packages/db/dist/security-workflows.js
+import { randomUUID as randomUUID3 } from "node:crypto";
+var SecurityWorkflowStoreError = class extends Error {
+  statusCode;
+  constructor(message, statusCode) {
+    super(message);
+    this.statusCode = statusCode;
+    this.name = "SecurityWorkflowStoreError";
+  }
+};
+var activeStatuses = { queued: true, running: true };
+var statuses = { queued: true, running: true, completed: true, failed: true, cancelled: true, interrupted: true };
+var SecurityWorkflowStore = class {
+  #db;
+  #runnerInstanceId = randomUUID3();
+  constructor(dbPath) {
+    const path = resolveOsecDbPath(dbPath);
+    ensureDatabaseDirectory(path);
+    this.#db = createShimmedDatabase(path);
+    this.#db.pragma("busy_timeout = 5000");
+    this.#db.exec(`CREATE TABLE IF NOT EXISTS workflow_definitions (id TEXT PRIMARY KEY, revision INTEGER NOT NULL, definition_json TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS workflow_executions (id TEXT PRIMARY KEY, workflow_id TEXT NOT NULL, workflow_revision INTEGER NOT NULL, session_id TEXT NOT NULL, status TEXT NOT NULL, execution_json TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL);
+      CREATE INDEX IF NOT EXISTS workflow_executions_workflow ON workflow_executions(workflow_id, created_at);
+      CREATE INDEX IF NOT EXISTS workflow_executions_session ON workflow_executions(session_id, created_at);`);
+  }
+  list() {
+    return this.#db.prepare("SELECT definition_json FROM workflow_definitions ORDER BY updated_at DESC, id").all().map((row) => JSON.parse(String(row.definition_json)));
+  }
+  get(id) {
+    const row = this.#db.prepare("SELECT definition_json FROM workflow_definitions WHERE id = ?").all(id)[0];
+    return row ? JSON.parse(String(row.definition_json)) : null;
+  }
+  save(value) {
+    let input;
+    try {
+      input = parseSecurityWorkflowInput(value);
+    } catch (error) {
+      throw new SecurityWorkflowStoreError(error instanceof Error ? error.message : "Invalid workflow.", 400);
+    }
+    return this.#db.transaction(() => {
+      const existing = input.id ? this.get(input.id) : null;
+      if (input.id && !existing && input.revision !== void 0)
+        throw new SecurityWorkflowStoreError("Workflow not found.", 404);
+      if (existing && input.revision !== existing.revision)
+        throw new SecurityWorkflowStoreError("Workflow changed. Reload before saving.", 409);
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const workflow = { ...input, id: input.id ?? randomUUID3(), revision: (existing?.revision ?? 0) + 1, createdAt: existing?.createdAt ?? now, updatedAt: now };
+      if (existing)
+        this.#db.prepare("UPDATE workflow_definitions SET revision = ?, definition_json = ?, updated_at = ? WHERE id = ?").run(workflow.revision, JSON.stringify(workflow), now, workflow.id);
+      else
+        this.#db.prepare("INSERT INTO workflow_definitions (id, revision, definition_json, created_at, updated_at) VALUES (?, ?, ?, ?, ?)").run(workflow.id, workflow.revision, JSON.stringify(workflow), now, now);
+      return workflow;
+    })();
+  }
+  delete(id, revision) {
+    return this.#db.transaction(() => {
+      const workflow = this.get(id);
+      if (!workflow)
+        return false;
+      if (revision !== void 0 && revision !== workflow.revision)
+        throw new SecurityWorkflowStoreError("Workflow changed. Reload before deleting.", 409);
+      this.#db.prepare("DELETE FROM workflow_definitions WHERE id = ?").run(id);
+      return true;
+    })();
+  }
+  createExecution(workflowId, sessionId, revision) {
+    if (!sessionId || sessionId.length > 128)
+      throw new SecurityWorkflowStoreError("Invalid execution session.", 400);
+    return this.#db.transaction(() => {
+      const workflow = this.get(workflowId);
+      if (!workflow)
+        throw new SecurityWorkflowStoreError("Workflow not found.", 404);
+      if (revision !== void 0 && revision !== workflow.revision)
+        throw new SecurityWorkflowStoreError("Workflow changed. Review it before running.", 409);
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const execution = { id: randomUUID3(), workflowId, workflowRevision: workflow.revision, workflow, sessionId, ownerPid: process.pid, runnerInstanceId: this.#runnerInstanceId, status: "queued", nodeResults: {}, createdAt: now, updatedAt: now };
+      this.#db.prepare("INSERT INTO workflow_executions (id, workflow_id, workflow_revision, session_id, status, execution_json, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)").run(execution.id, workflowId, workflow.revision, sessionId, execution.status, JSON.stringify(execution), now, now);
+      return execution;
+    })();
+  }
+  getExecution(id) {
+    const row = this.#db.prepare("SELECT execution_json FROM workflow_executions WHERE id = ?").all(id)[0];
+    return row ? JSON.parse(String(row.execution_json)) : null;
+  }
+  listExecutions(workflowId, sessionId) {
+    return this.#db.prepare("SELECT execution_json FROM workflow_executions WHERE (? IS NULL OR workflow_id = ?) AND (? IS NULL OR session_id = ?) ORDER BY created_at DESC, id LIMIT 200").all(workflowId ?? null, workflowId ?? null, sessionId ?? null, sessionId ?? null).map((row) => JSON.parse(String(row.execution_json)));
+  }
+  updateExecution(id, update) {
+    return this.#db.transaction(() => {
+      const current = this.getExecution(id);
+      if (!current)
+        throw new SecurityWorkflowStoreError("Execution not found.", 404);
+      if (!activeStatuses[current.status])
+        throw new SecurityWorkflowStoreError("Execution is already finished.", 409);
+      if (update.status !== void 0 && (!Object.hasOwn(statuses, update.status) || current.status === "running" && update.status === "queued"))
+        throw new SecurityWorkflowStoreError("Invalid execution status transition.", 400);
+      if (update.jobId !== void 0 && (typeof update.jobId !== "string" || update.jobId.length > 128))
+        throw new SecurityWorkflowStoreError("Invalid execution job ID.", 400);
+      if (update.error !== void 0 && (typeof update.error !== "string" || update.error.length > 16e3))
+        throw new SecurityWorkflowStoreError("Invalid execution error.", 400);
+      if (update.nodeResults !== void 0) {
+        const nodeIds = new Set(current.workflow.nodes.map((node) => node.id));
+        if (!update.nodeResults || typeof update.nodeResults !== "object" || Array.isArray(update.nodeResults) || JSON.stringify(update.nodeResults).length > 1e5 || Object.entries(update.nodeResults).some(([key, result]) => {
+          if (!nodeIds.has(key) || !result || typeof result !== "object" || Array.isArray(result) || !Object.hasOwn(result, "status") || typeof result.status !== "string" || !result.status.length || result.status.length > 64)
+            return true;
+          if (Object.keys(result).some((field) => !["status", "jobId", "scanId", "scanIds", "dbPaths", "error"].includes(field)))
+            return true;
+          if ([result.jobId, result.scanId].some((value) => value !== void 0 && (typeof value !== "string" || value.length > 128)))
+            return true;
+          if (result.error !== void 0 && (typeof result.error !== "string" || result.error.length > 16e3))
+            return true;
+          return [result.scanIds, result.dbPaths].some((values) => values !== void 0 && (!Array.isArray(values) || values.length > 64 || values.some((value) => typeof value !== "string" || value.length > 4096)));
+        }))
+          throw new SecurityWorkflowStoreError("Invalid execution node results.", 400);
+      }
+      const execution = { ...current, status: update.status ?? current.status, jobId: update.jobId ?? current.jobId, nodeResults: update.nodeResults ?? current.nodeResults, error: update.error ?? current.error, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+      this.#db.prepare("UPDATE workflow_executions SET status = ?, execution_json = ?, updated_at = ? WHERE id = ?").run(execution.status, JSON.stringify(execution), execution.updatedAt, id);
+      return execution;
+    })();
+  }
+  interruptActiveExecutions(isOwnerAlive = processAlive) {
+    const rows = this.#db.prepare("SELECT execution_json FROM workflow_executions WHERE status IN ('queued', 'running')").all();
+    let interrupted = 0;
+    for (const row of rows) {
+      const execution = JSON.parse(String(row.execution_json));
+      if (!Number.isInteger(execution.ownerPid) || execution.ownerPid <= 0 || isOwnerAlive(execution.ownerPid))
+        continue;
+      try {
+        this.updateExecution(execution.id, { status: "interrupted", error: "The local engine stopped. Run this workflow again to continue." });
+        interrupted++;
+      } catch (error) {
+        if (!(error instanceof SecurityWorkflowStoreError && error.statusCode === 409))
+          throw error;
+      }
+    }
+    return interrupted;
+  }
+  close() {
+    this.#db.close();
+  }
+};
+function processAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return !(error && typeof error === "object" && "code" in error && error.code === "ESRCH");
+  }
+}
+
+// packages/db/dist/workflow-triggers.js
+import { randomUUID as randomUUID4 } from "node:crypto";
+var TRIGGER_INTERVAL_MS = { hourly: 36e5, daily: 864e5, weekly: 6048e5 };
+function nextWorkflowTriggerFire(startAt, cadence, now) {
+  const anchor = Date.parse(startAt);
+  const interval = TRIGGER_INTERVAL_MS[cadence];
+  if (!Number.isFinite(anchor) || !interval || !Number.isFinite(now))
+    throw new Error("Invalid schedule.");
+  return new Date(anchor > now ? anchor : anchor + (Math.floor((now - anchor) / interval) + 1) * interval).toISOString();
+}
+var WorkflowTriggerStore = class {
+  #db;
+  constructor(dbPath) {
+    const path = resolveOsecDbPath(dbPath);
+    ensureDatabaseDirectory(path);
+    this.#db = createShimmedDatabase(path);
+    this.#db.pragma("busy_timeout = 5000");
+    this.#db.exec("CREATE TABLE IF NOT EXISTS workflow_triggers (id TEXT PRIMARY KEY, workflow_id TEXT NOT NULL, enabled INTEGER NOT NULL, next_fire_at TEXT NOT NULL, active_claim TEXT, trigger_json TEXT NOT NULL)");
+    this.#db.exec("CREATE INDEX IF NOT EXISTS workflow_triggers_due ON workflow_triggers(enabled, next_fire_at)");
+  }
+  get(id) {
+    const row = this.#db.prepare("SELECT trigger_json FROM workflow_triggers WHERE id = ?").all(id)[0];
+    return row ? JSON.parse(String(row.trigger_json)) : null;
+  }
+  list(workflowId) {
+    return this.#db.prepare("SELECT trigger_json FROM workflow_triggers WHERE (? IS NULL OR workflow_id = ?) ORDER BY next_fire_at, id LIMIT 200").all(workflowId ?? null, workflowId ?? null).map((row) => JSON.parse(String(row.trigger_json)));
+  }
+  create(input, now = Date.now()) {
+    const stamp = new Date(now).toISOString();
+    const trigger = { ...input, kind: "schedule", id: randomUUID4(), version: 1, nextFireAt: nextWorkflowTriggerFire(input.startAt, input.cadence, now), createdAt: stamp, updatedAt: stamp };
+    this.#db.prepare("INSERT INTO workflow_triggers(id,workflow_id,enabled,next_fire_at,active_claim,trigger_json) VALUES(?,?,?,?,NULL,?)").run(trigger.id, trigger.workflowId, trigger.enabled ? 1 : 0, trigger.nextFireAt, JSON.stringify(trigger));
+    return trigger;
+  }
+  update(id, update, expectedVersion) {
+    return this.#db.transaction(() => {
+      const current = this.get(id);
+      if (!current)
+        return null;
+      if (expectedVersion !== void 0 && (current.version ?? 1) !== expectedVersion)
+        throw new Error("Schedule changed. Review it again before enabling.");
+      const next = { ...current, ...update, version: (current.version ?? 1) + 1, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+      if (!next.enabled && update.lastStatus === "running")
+        next.lastStatus = "paused";
+      this.#write(next);
+      return next;
+    })();
+  }
+  delete(id) {
+    return this.#db.prepare("DELETE FROM workflow_triggers WHERE id = ? AND active_claim IS NULL").run(id).changes > 0;
+  }
+  /** CAS claims the occurrence across engines; advancing from now skips missed intervals. */
+  claim(id, now = Date.now()) {
+    const current = this.get(id);
+    if (!current?.enabled || current.activeClaim || Date.parse(current.nextFireAt) > now)
+      return null;
+    const claim = randomUUID4();
+    const next = { ...current, version: (current.version ?? 1) + 1, activeClaim: claim, ownerPid: process.pid, nextFireAt: nextWorkflowTriggerFire(current.startAt, current.cadence, now), lastStatus: "starting", lastExecutionId: void 0, lastError: void 0, updatedAt: new Date(now).toISOString() };
+    this.#db.prepare("UPDATE workflow_triggers SET active_claim=?, next_fire_at=?, trigger_json=? WHERE id=? AND enabled=1 AND active_claim IS NULL AND next_fire_at=? AND trigger_json=?").run(claim, next.nextFireAt, JSON.stringify(next), id, current.nextFireAt, JSON.stringify(current));
+    return this.get(id)?.activeClaim === claim ? next : null;
+  }
+  release(id, claim, update) {
+    this.#db.exec("BEGIN IMMEDIATE");
+    try {
+      const current = this.get(id);
+      if (!current || current.activeClaim !== claim) {
+        this.#db.exec("COMMIT");
+        return null;
+      }
+      const next = { ...current, ...update, version: (current.version ?? 1) + 1, enabled: current.enabled && update.enabled !== false, activeClaim: void 0, ownerPid: void 0, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+      if (!current.enabled && update.enabled !== false)
+        next.lastStatus = "paused";
+      this.#db.prepare("UPDATE workflow_triggers SET active_claim=NULL,enabled=?,trigger_json=? WHERE id=? AND active_claim=?").run(next.enabled ? 1 : 0, JSON.stringify(next), id, claim);
+      this.#db.exec("COMMIT");
+      return next;
+    } catch (error) {
+      this.#db.exec("ROLLBACK");
+      throw error;
+    }
+  }
+  #write(trigger) {
+    this.#db.prepare("UPDATE workflow_triggers SET enabled=?,next_fire_at=?,trigger_json=? WHERE id=?").run(trigger.enabled ? 1 : 0, trigger.nextFireAt, JSON.stringify(trigger), trigger.id);
+  }
+  close() {
+    this.#db.close();
+  }
+};
+
 export {
   findingStatuses,
   findingTriageStatuses,
@@ -2641,5 +2884,10 @@ export {
   restoreFindingReviewFields,
   resolveOsecRunStorage,
   listOsecRunDatabasePaths,
-  writeOsecRunReport
+  writeOsecRunReport,
+  SecurityWorkflowStoreError,
+  SecurityWorkflowStore,
+  TRIGGER_INTERVAL_MS,
+  nextWorkflowTriggerFire,
+  WorkflowTriggerStore
 };