0sec-cli 0.23.0 → 0.24.0

package/chunks/{chunk-T7ZEVY5G.js → chunk-RCHAFSWS.js}

@@ -2,10 +2,13 @@
 import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
+  ImpactAssessmentSchema,
+  compareFindingsByBusinessPriority,
+  getFindingPriority,
   homeStateDir,
   parseSecurityWorkflowInput,
   runStateDir
-} from "./chunk-LTEE2JWK.js";
+} from "./chunk-RZR2XXAK.js";
 import {
   __export
 } from "./chunk-VCSFCHAJ.js";
@@ -153,24 +156,55 @@ function createWasmEngine(path) {
   const sqliteWasm = createRequire(import.meta.url)("node-sqlite3-wasm");
   const { Database: WasmDatabaseCtor } = sqliteWasm;
   const wasm = new WasmDatabaseCtor(path);
-  const wrapStatement = (stmt) => ({
-    run: (bind) => stmt.run(bind),
-    get: (bind) => {
-      const row = stmt.get(bind);
-      return row == null ? void 0 : row;
-    },
-    all: (bind) => stmt.all(bind),
-    values: (bind) => {
-      const rows = stmt.all(bind);
-      return rows.map((r) => Object.values(r));
-    }
-  });
+  const prepared = /* @__PURE__ */ new Set();
+  const wrapStatement = (sql) => {
+    let initial = wasm.prepare(sql);
+    prepared.add(initial);
+    const execute = (operation) => {
+      if (!wasm.isOpen)
+        throw new Error("Database already closed");
+      const statement = initial ?? wasm.prepare(sql);
+      initial = void 0;
+      prepared.add(statement);
+      let succeeded = false;
+      try {
+        const result = operation(statement);
+        succeeded = true;
+        return result;
+      } finally {
+        prepared.delete(statement);
+        try {
+          statement.finalize();
+        } catch (error) {
+          if (succeeded)
+            throw error;
+        }
+      }
+    };
+    return {
+      run: (bind) => execute((statement) => statement.run(bind)),
+      get: (bind) => execute((statement) => {
+        const row = statement.get(bind);
+        return row == null ? void 0 : row;
+      }),
+      all: (bind) => execute((statement) => statement.all(bind)),
+      values: (bind) => execute((statement) => {
+        const rows = statement.all(bind);
+        return rows.map((row) => Object.values(row));
+      })
+    };
+  };
   return {
-    prepare: (sql) => wrapStatement(wasm.prepare(sql)),
+    prepare: (sql) => wrapStatement(sql),
     exec: (sql) => {
       wasm.exec(sql);
     },
-    close: () => wasm.close(),
+    close: () => {
+      for (const statement of prepared)
+        statement.finalize();
+      prepared.clear();
+      wasm.close();
+    },
     get inTransaction() {
       return wasm.inTransaction;
     },
@@ -625,6 +659,144 @@ var trustGraphEdges = sqliteTable("trust_graph_edges", {
   index("idx_tge_relation").on(table.relation)
 ]);
 
+// packages/db/dist/finding-priority.js
+function* iterateLatestFindingMetadata(sqlite, opts = {}) {
+  let afterId = null;
+  while (true) {
+    const page = sqlite.prepare(`SELECT f.id,COALESCE(f.fingerprint,f.id) AS familyKey,f.timestamp,f.severity,f.category,f.status,f.triageStatus,f.cvssScore,
+      CASE WHEN length(CAST(f.impactAssessment AS BLOB)) <= ${MAX_ASSESSMENT_BYTES} THEN f.impactAssessment ELSE NULL END AS impactAssessment
+      FROM findings f WHERE (@afterId IS NULL OR f.id>@afterId) AND (@scanId IS NULL OR f.scanId=@scanId)
+      AND NOT EXISTS (SELECT 1 FROM findings newer WHERE COALESCE(newer.fingerprint,newer.id)=COALESCE(f.fingerprint,f.id)
+        AND (@scanId IS NULL OR newer.scanId=@scanId) AND (newer.timestamp>f.timestamp OR (newer.timestamp=f.timestamp AND newer.id>f.id)))
+      AND (@severity IS NULL OR f.severity=@severity) AND (@category IS NULL OR f.category=@category)
+      AND (@status IS NULL OR f.status=@status) AND (@triageStatus IS NULL OR f.triageStatus=@triageStatus)
+      ORDER BY f.id LIMIT ${PAGE_SIZE}`).all({
+      afterId,
+      scanId: opts.scanId ?? null,
+      severity: opts.severity ?? null,
+      category: opts.category ?? null,
+      status: opts.status ?? null,
+      triageStatus: opts.triageStatus ?? null
+    });
+    yield* page;
+    if (page.length < PAGE_SIZE)
+      return;
+    afterId = page[page.length - 1].id;
+  }
+}
+function getFindingFamilyMetadata(sqlite, key, opts = {}) {
+  const rows = sqlite.prepare(`SELECT scanId,COUNT(*) AS count FROM findings WHERE COALESCE(fingerprint,id)=@key
+    AND (@scanId IS NULL OR scanId=@scanId) GROUP BY scanId ORDER BY scanId`).all({ key, scanId: opts.scanId ?? null });
+  return { count: rows.reduce((sum, row) => sum + row.count, 0), scanIds: rows.map((row) => row.scanId) };
+}
+function compare(a, b) {
+  return b.businessPriorityRank - a.businessPriorityRank || compareFindingsByBusinessPriority(a, b) || b.timestamp - a.timestamp || b.id.localeCompare(a.id);
+}
+function retain(heap, item, limit2) {
+  if (heap.length < limit2) {
+    heap.push(item);
+    let index3 = heap.length - 1;
+    while (index3 > 0) {
+      const parent = Math.floor((index3 - 1) / 2);
+      if (compare(heap[index3], heap[parent]) <= 0)
+        break;
+      [heap[index3], heap[parent]] = [heap[parent], heap[index3]];
+      index3 = parent;
+    }
+    return;
+  }
+  if (compare(item, heap[0]) >= 0)
+    return;
+  heap[0] = item;
+  let index2 = 0;
+  while (true) {
+    let worst = index2;
+    for (const child of [index2 * 2 + 1, index2 * 2 + 2])
+      if (child < heap.length && compare(heap[child], heap[worst]) > 0)
+        worst = child;
+    if (worst === index2)
+      break;
+    [heap[index2], heap[worst]] = [heap[worst], heap[index2]];
+    index2 = worst;
+  }
+}
+var PAGE_SIZE = 500;
+var MAX_ASSESSMENT_BYTES = 80 * 1024;
+function rankedFindingRows(sqlite, opts, latestOnly) {
+  const limit2 = opts.limit ?? 100;
+  if (!Number.isSafeInteger(limit2) || limit2 < 0 || limit2 > 5e3)
+    throw new Error("Business-priority finding limit must be an integer between 0 and 5000.");
+  if (limit2 === 0)
+    return [];
+  const heap = [];
+  let afterId = null;
+  const statement = sqlite.prepare(`
+      SELECT f.id, COALESCE(f.fingerprint, f.id) AS familyKey, f.timestamp, f.severity, f.cvssScore,
+        CASE WHEN length(CAST(f.impactAssessment AS BLOB)) <= ${MAX_ASSESSMENT_BYTES} THEN f.impactAssessment ELSE NULL END AS impactAssessment
+      FROM findings f
+      WHERE (@afterId IS NULL OR f.id > @afterId)
+        AND (@scanId IS NULL OR f.scanId = @scanId)
+        AND (@latestOnly = 0 OR NOT EXISTS (SELECT 1 FROM findings newer
+          WHERE COALESCE(newer.fingerprint, newer.id) = COALESCE(f.fingerprint, f.id)
+            AND (@scanId IS NULL OR newer.scanId = @scanId)
+            AND (newer.timestamp > f.timestamp OR (newer.timestamp = f.timestamp AND newer.id > f.id))))
+        AND (@severity IS NULL OR f.severity = @severity)
+        AND (@category IS NULL OR f.category = @category)
+        AND (@status IS NULL OR f.status = @status)
+        AND (@triageStatus IS NULL OR f.triageStatus = @triageStatus)
+      ORDER BY f.id LIMIT ${PAGE_SIZE}`);
+  while (true) {
+    const page = statement.all({ latestOnly: latestOnly ? 1 : 0, afterId, scanId: opts.scanId ?? null, severity: opts.severity ?? null, category: opts.category ?? null, status: opts.status ?? null, triageStatus: opts.triageStatus ?? null });
+    for (const row of page) {
+      let impactAssessment;
+      try {
+        impactAssessment = row.impactAssessment ? JSON.parse(row.impactAssessment) : void 0;
+      } catch {
+      }
+      const { impactAssessment: _serialized, ...metadata } = row;
+      retain(heap, { ...metadata, businessPriorityRank: getFindingPriority({ impactAssessment }).rank }, limit2);
+    }
+    if (page.length < PAGE_SIZE)
+      break;
+    afterId = page[page.length - 1].id;
+  }
+  const selected = heap.sort(compare);
+  const rows = /* @__PURE__ */ new Map();
+  for (let offset = 0; offset < selected.length; offset += 300) {
+    const ids = selected.slice(offset, offset + 300).map((item) => item.id);
+    for (const row of sqlite.prepare(`SELECT * FROM findings WHERE id IN (${ids.map(() => "?").join(",")})`).all(...ids))
+      rows.set(row.id, row);
+  }
+  return selected.map((item) => rows.get(item.id));
+}
+function selectFindingsByBusinessPriority(sqlite, opts = {}) {
+  return sqlite.transaction(() => rankedFindingRows(sqlite, opts, false))();
+}
+function selectFindingFamiliesByBusinessPriority(sqlite, opts = {}) {
+  return sqlite.transaction(() => {
+    return rankedFindingRows(sqlite, opts, true).map((item) => {
+      const params = { key: item.fingerprint ?? item.id, scanId: opts.scanId ?? null };
+      const counts = sqlite.prepare(`SELECT COUNT(*) AS count, COUNT(DISTINCT scanId) AS scanCount FROM findings
+        WHERE COALESCE(fingerprint,id)=@key AND (@scanId IS NULL OR scanId=@scanId)`).get(params);
+      const verdictCounts = sqlite.prepare(`SELECT COUNT(*) AS total,
+        COALESCE(SUM(CASE WHEN v.verdict='TRUE_POSITIVE' THEN 1 ELSE 0 END),0) AS truePositive,
+        COALESCE(SUM(CASE WHEN v.verdict='FALSE_POSITIVE' THEN 1 ELSE 0 END),0) AS falsePositive,
+        COALESCE(SUM(CASE WHEN v.verdict NOT IN ('TRUE_POSITIVE','FALSE_POSITIVE') THEN 1 ELSE 0 END),0) AS unsure
+        FROM verdicts v JOIN findings f ON f.id=v.findingId
+        WHERE COALESCE(f.fingerprint,f.id)=@key AND (@scanId IS NULL OR f.scanId=@scanId)`).get(params);
+      const activeSessions = sqlite.prepare(`SELECT s.id,s.scanId,s.status,s.agentRole,s.createdAt,s.updatedAt FROM agent_sessions s
+        WHERE s.status='running' AND EXISTS (SELECT 1 FROM findings f WHERE f.scanId=s.scanId
+          AND COALESCE(f.fingerprint,f.id)=@key AND (@scanId IS NULL OR f.scanId=@scanId))
+        AND NOT EXISTS (SELECT 1 FROM agent_sessions newer WHERE newer.status='running' AND newer.agentRole=s.agentRole
+          AND (newer.updatedAt>s.updatedAt OR (newer.updatedAt=s.updatedAt AND newer.id>s.id))
+          AND EXISTS (SELECT 1 FROM findings f WHERE f.scanId=newer.scanId
+            AND COALESCE(f.fingerprint,f.id)=@key AND (@scanId IS NULL OR f.scanId=@scanId)))
+        ORDER BY s.agentRole`).all(params);
+      return { key: item.fingerprint ?? item.id, latest: item, ...counts, verdictCounts, activeSessions };
+    });
+  })();
+}
+
 // packages/db/dist/database.js
 var DEFAULT_DB_DIR = homeStateDir();
 var DEFAULT_DB_PATH = join(DEFAULT_DB_DIR, "0.db");
@@ -763,10 +935,13 @@ function clearStaleLockIfAny(path) {
   }
 }
 var osecDB = class {
+  /** Resolved storage identity for scoped stores sharing this database. */
+  databasePath;
   sqlite;
   db;
   constructor(dbPath, options = {}) {
     const path = resolveOsecDbPath(dbPath);
+    this.databasePath = path;
     if (options.readOnly) {
       if (path !== ":memory:" && !existsSync2(path)) {
         throw new Error(`Database does not exist: ${path}`);
@@ -935,13 +1110,13 @@ var osecDB = class {
       params.category = opts.category;
     }
     const whereSql = where.length > 0 ? `WHERE ${where.join(" AND ")}` : "";
-    const limit = opts?.limit ?? 500;
+    const limit2 = opts?.limit ?? 500;
     const rows = this.sqlite.prepare(`SELECT id, scope, scope_value as scopeValue, category, pattern, reasoning,
                 created_at as createdAt, applied_count as appliedCount
          FROM triage_memories
          ${whereSql}
          ORDER BY applied_count DESC, created_at DESC
-         LIMIT ${limit}`).all(params);
+         LIMIT ${limit2}`).all(params);
     return rows;
   }
   deleteTriageMemory(id) {
@@ -1320,8 +1495,8 @@ var osecDB = class {
   getScan(scanId) {
     return this.db.select().from(scans).where(eq(scans.id, scanId)).get();
   }
-  listScans(limit = 20) {
-    return this.db.select().from(scans).orderBy(desc(scans.startedAt)).limit(limit).all();
+  listScans(limit2 = 20) {
+    return this.db.select().from(scans).orderBy(desc(scans.startedAt)).limit(limit2).all();
   }
   listScansByTarget(target, opts) {
     const query = this.db.select().from(scans).where(eq(scans.target, target)).orderBy(desc(scans.startedAt));
@@ -1475,6 +1650,24 @@ var osecDB = class {
   getLatestFindingForScan(scanId) {
     return this.db.select().from(findings).where(eq(findings.scanId, scanId)).orderBy(desc(findings.timestamp)).get();
   }
+  /** Stable bounded keyset projection for read-only external findings APIs. */
+  listFindingsApiPage(options) {
+    if (!Number.isSafeInteger(options.limit) || options.limit < 1 || options.limit > 101)
+      throw new Error("Finding API page limit must be between 1 and 101.");
+    return this.sqlite.prepare(`SELECT id, scanId, timestamp FROM findings
+      WHERE (@scanId IS NULL OR scanId = @scanId) AND (@severity IS NULL OR severity = @severity)
+      AND (@status IS NULL OR status = @status) AND (@includeSuppressed = 1 OR COALESCE(triageStatus, 'new') != 'suppressed')
+      AND (@beforeTimestamp IS NULL OR timestamp < @beforeTimestamp OR (timestamp = @beforeTimestamp AND id < @beforeId))
+      ORDER BY timestamp DESC, id DESC LIMIT @limit`).all({
+      limit: options.limit,
+      scanId: options.scanId ?? null,
+      severity: options.severity ?? null,
+      status: options.status ?? null,
+      includeSuppressed: options.includeSuppressed ? 1 : 0,
+      beforeTimestamp: options.before?.timestamp ?? null,
+      beforeId: options.before?.id ?? null
+    });
+  }
   listFindings(opts) {
     const conditions = [];
     if (opts?.scanId)
@@ -1493,6 +1686,21 @@ var osecDB = class {
     }
     return query.all();
   }
+  /** Globally rank current family assessments before the body/row limit. Historical review counts remain intact. */
+  listFindingFamiliesByBusinessPriority(opts) {
+    return selectFindingFamiliesByBusinessPriority(this.sqlite, opts);
+  }
+  /** Bounded row-level native --all list; historical rows are independently ranked. */
+  listFindingsByBusinessPriority(opts) {
+    return selectFindingsByBusinessPriority(this.sqlite, opts);
+  }
+  /** Uncapped paged metadata for exact cross-database latest-family merging; no evidence bodies. */
+  iterateLatestFindingMetadata(opts) {
+    return iterateLatestFindingMetadata(this.sqlite, opts);
+  }
+  getFindingFamilyMetadata(key, opts) {
+    return getFindingFamilyMetadata(this.sqlite, key, opts);
+  }
   /** Alias for listFindings — backward compat with core agent tools */
   queryFindings(opts) {
     return this.listFindings(opts);
@@ -1503,6 +1711,12 @@ var osecDB = class {
     if (finding?.fingerprint)
       this.syncFindingGraph(finding.scanId, finding.fingerprint);
   }
+  /** Operator business context is metadata; never changes verification or execution authority. */
+  updateFindingImpactAssessment(findingId, assessment) {
+    const parsed = assessment === null ? null : ImpactAssessmentSchema.parse(assessment);
+    const result = this.db.update(findings).set({ impactAssessment: parsed === null ? null : JSON.stringify(parsed) }).where(eq(findings.id, findingId)).run();
+    return result.changes > 0;
+  }
   saveFindingPocExecution(findingId, execution) {
     const serialized = JSON.stringify(execution);
     this.db.update(findings).set({ pocExecution: serialized }).where(eq(findings.id, findingId)).run();
@@ -1687,7 +1901,7 @@ var osecDB = class {
       conditions.push(eq(pipelineEvents.eventType, opts.eventType));
     return this.db.select().from(pipelineEvents).where(and(...conditions)).orderBy(pipelineEvents.timestamp).all();
   }
-  listRecentEvents(limit = 50) {
+  listRecentEvents(limit2 = 50) {
     return this.db.select({
       id: pipelineEvents.id,
       scanId: pipelineEvents.scanId,
@@ -1700,13 +1914,13 @@ var osecDB = class {
       source: pipelineEvents.source,
       payload: pipelineEvents.payload,
       timestamp: pipelineEvents.timestamp
-    }).from(pipelineEvents).innerJoin(scans, eq(pipelineEvents.scanId, scans.id)).leftJoin(findings, eq(pipelineEvents.findingId, findings.id)).orderBy(desc(pipelineEvents.timestamp)).limit(limit).all();
+    }).from(pipelineEvents).innerJoin(scans, eq(pipelineEvents.scanId, scans.id)).leftJoin(findings, eq(pipelineEvents.findingId, findings.id)).orderBy(desc(pipelineEvents.timestamp)).limit(limit2).all();
   }
   /**
    * Read persisted events strictly after a durable `(timestamp, id)` cursor.
    * The UUID tie-breaker makes same-millisecond multi-process writes stable.
    */
-  listEventsAfter(cursor, limit = 250) {
+  listEventsAfter(cursor, limit2 = 250) {
     const selectEvents = () => this.db.select({
       id: pipelineEvents.id,
       scanId: pipelineEvents.scanId,
@@ -1721,9 +1935,9 @@ var osecDB = class {
       timestamp: pipelineEvents.timestamp
     }).from(pipelineEvents).innerJoin(scans, eq(pipelineEvents.scanId, scans.id)).leftJoin(findings, eq(pipelineEvents.findingId, findings.id));
     if (!cursor) {
-      return selectEvents().orderBy(asc(pipelineEvents.timestamp), asc(pipelineEvents.id)).limit(limit).all();
+      return selectEvents().orderBy(asc(pipelineEvents.timestamp), asc(pipelineEvents.id)).limit(limit2).all();
     }
-    return selectEvents().where(or(gt(pipelineEvents.timestamp, cursor.timestamp), and(eq(pipelineEvents.timestamp, cursor.timestamp), gt(pipelineEvents.id, cursor.id)))).orderBy(asc(pipelineEvents.timestamp), asc(pipelineEvents.id)).limit(limit).all();
+    return selectEvents().where(or(gt(pipelineEvents.timestamp, cursor.timestamp), and(eq(pipelineEvents.timestamp, cursor.timestamp), gt(pipelineEvents.id, cursor.id)))).orderBy(asc(pipelineEvents.timestamp), asc(pipelineEvents.id)).limit(limit2).all();
   }
   // ── Agent Sessions (resumable state) ──
   saveSession(session) {
@@ -1795,8 +2009,8 @@ var osecDB = class {
   getCase(caseId) {
     return this.db.select().from(cases).where(eq(cases.id, caseId)).get();
   }
-  listCases(limit = 100) {
-    return this.db.select().from(cases).orderBy(desc(cases.updatedAt)).limit(limit).all();
+  listCases(limit2 = 100) {
+    return this.db.select().from(cases).orderBy(desc(cases.updatedAt)).limit(limit2).all();
   }
   upsertWorkItem(record) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -1932,8 +2146,8 @@ var osecDB = class {
       }
     }).run();
   }
-  listWorkers(limit = 50) {
-    return this.db.select().from(workers).orderBy(desc(workers.heartbeatAt)).limit(limit).all();
+  listWorkers(limit2 = 50) {
+    return this.db.select().from(workers).orderBy(desc(workers.heartbeatAt)).limit(limit2).all();
   }
   stopWorkersByLabel(label, exceptId) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -2035,8 +2249,8 @@ var osecDB = class {
       params.push(query.target);
     }
     const whereSql = where.length > 0 ? `WHERE ${where.join(" AND ")}` : "";
-    const limit = query.limit ?? 500;
-    return this.sqlite.prepare(`SELECT * FROM persistent_credentials ${whereSql} ORDER BY lastSeenAt DESC LIMIT ${limit}`).all(...params);
+    const limit2 = query.limit ?? 500;
+    return this.sqlite.prepare(`SELECT * FROM persistent_credentials ${whereSql} ORDER BY lastSeenAt DESC LIMIT ${limit2}`).all(...params);
   }
   // ── Trust graph edges (0#771) ──
   /**
@@ -2117,8 +2331,8 @@ var osecDB = class {
       params.push(query.relation);
     }
     const whereSql = where.length > 0 ? `WHERE ${where.join(" AND ")}` : "";
-    const limit = query.limit ?? 500;
-    return this.sqlite.prepare(`SELECT * FROM trust_graph_edges ${whereSql} ORDER BY updatedAt DESC LIMIT ${limit}`).all(...params);
+    const limit2 = query.limit ?? 500;
+    return this.sqlite.prepare(`SELECT * FROM trust_graph_edges ${whereSql} ORDER BY updatedAt DESC LIMIT ${limit2}`).all(...params);
   }
   // ── Utilities ──
   close() {
@@ -2485,6 +2699,7 @@ CREATE INDEX IF NOT EXISTS idx_findings_severity ON findings(severity);
 CREATE INDEX IF NOT EXISTS idx_findings_category ON findings(category);
 CREATE INDEX IF NOT EXISTS idx_findings_status ON findings(status);
 CREATE INDEX IF NOT EXISTS idx_findings_fingerprint ON findings(fingerprint);
+CREATE INDEX IF NOT EXISTS idx_findings_priority_latest ON findings(COALESCE(fingerprint,id),timestamp DESC,id DESC);
 CREATE INDEX IF NOT EXISTS idx_findings_triageStatus ON findings(triageStatus);
 CREATE INDEX IF NOT EXISTS idx_findings_workflowStatus ON findings(workflowStatus);
 CREATE INDEX IF NOT EXISTS idx_attack_results_scanId ON attack_results(scanId);
@@ -2616,7 +2831,447 @@ function writeOsecRunReport(storage, report) {
 }
 
 // packages/db/dist/security-workflows.js
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { createHash as createHash3, randomUUID as randomUUID4 } from "node:crypto";
+
+// packages/db/dist/learning.js
+import { randomUUID as randomUUID3, createHash as createHash2 } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { isAbsolute as isAbsolute2, resolve as resolve3 } from "node:path";
+import { homedir } from "node:os";
+var LearningStoreError = class extends Error {
+  statusCode;
+  constructor(message, statusCode = 400) {
+    super(message);
+    this.statusCode = statusCode;
+    this.name = "LearningStoreError";
+  }
+};
+function learningProjectId(target) {
+  let identity = target.trim();
+  const sourceTarget = identity.startsWith("source:");
+  const path = sourceTarget ? identity.slice("source:".length).trim() : identity;
+  const remote = /^[a-z][a-z0-9+.-]*:\/\//i.test(path);
+  if (!remote && path && (sourceTarget || isAbsolute2(path) || /^\.{1,2}(?:\/|$)/.test(path) || path.startsWith("~/"))) {
+    identity = resolve3(path.startsWith("~/") ? resolve3(homedir(), path.slice(2)) : path);
+    try {
+      identity = realpathSync(identity);
+    } catch {
+    }
+  }
+  return `sha256:${createHash2("sha256").update(identity).digest("hex")}`;
+}
+function learningArtifactDigest(proposal) {
+  return `sha256:${createHash2("sha256").update(proposal).digest("hex")}`;
+}
+function fail(message, status = 400) {
+  throw new LearningStoreError(message, status);
+}
+function bounded(value, name, max = 256) {
+  if (typeof value !== "string" || !value.trim() || value.length > max || /\0/.test(value))
+    fail(`Invalid ${name}.`);
+  if (/-----BEGIN .*PRIVATE KEY|(?:api[_-]?key|authorization|password|access[_-]?token)\s*[:=]\s*\S+|\b(?:sk-|ghp_)[A-Za-z0-9_-]{16,}/i.test(value))
+    fail(`Credential-like content in ${name}.`);
+}
+function refs(values, name) {
+  if (!Array.isArray(values) || values.length > 64)
+    fail(`Invalid ${name}.`);
+  for (const value of values)
+    bounded(value, name, 1024);
+}
+function sources(value) {
+  if (!Array.isArray(value) || value.length > 64)
+    fail("Invalid source links.");
+  for (const item of value) {
+    if (!item || typeof item !== "object" || Object.keys(item).some((key) => !["path", "hash"].includes(key)))
+      fail("Invalid source link.");
+    bounded(item.path, "source path", 4096);
+    bounded(item.hash, "source hash");
+  }
+}
+function limit(value) {
+  return Number.isInteger(value) && value > 0 ? Math.min(value, 200) : 100;
+}
+function read(db, table, id) {
+  const row = db.prepare(`SELECT body FROM ${table} WHERE id = ?`).all(id)[0];
+  return row ? JSON.parse(row.body) : null;
+}
+function write(db, table, value) {
+  db.prepare(`INSERT INTO ${table}(id,project_id,body,updated_at) VALUES(?,?,?,?) ON CONFLICT(id) DO UPDATE SET body=excluded.body,updated_at=excluded.updated_at`).run(value.id, value.projectId, JSON.stringify(value), value.updatedAt ?? value.createdAt);
+}
+function initializeLearningTables(db) {
+  db.exec(`CREATE TABLE IF NOT EXISTS learning_events(id TEXT PRIMARY KEY,idempotency_key TEXT NOT NULL UNIQUE,project_id TEXT NOT NULL,body TEXT NOT NULL,updated_at TEXT NOT NULL);
+    CREATE TABLE IF NOT EXISTS learning_knowledge(id TEXT PRIMARY KEY,project_id TEXT NOT NULL,body TEXT NOT NULL,updated_at TEXT NOT NULL);
+    CREATE TABLE IF NOT EXISTS learning_candidates(id TEXT PRIMARY KEY,project_id TEXT NOT NULL,body TEXT NOT NULL,updated_at TEXT NOT NULL);
+    CREATE TABLE IF NOT EXISTS learning_suggestion_keys(key TEXT PRIMARY KEY,candidate_id TEXT NOT NULL);
+    CREATE TABLE IF NOT EXISTS learning_active(project_id TEXT NOT NULL,kind TEXT NOT NULL,target_id TEXT NOT NULL,candidate_id TEXT NOT NULL,PRIMARY KEY(project_id,kind,target_id));
+    CREATE TABLE IF NOT EXISTS learning_work(id TEXT PRIMARY KEY,event_id TEXT NOT NULL,kind TEXT NOT NULL,status TEXT NOT NULL,attempts INTEGER NOT NULL DEFAULT 0,available_at INTEGER NOT NULL,lease_until INTEGER,claim_token TEXT,owner TEXT,UNIQUE(event_id,kind));
+    CREATE INDEX IF NOT EXISTS learning_events_project ON learning_events(project_id,updated_at);
+    CREATE INDEX IF NOT EXISTS learning_work_ready ON learning_work(status,available_at,lease_until);`);
+}
+function appendLearningEvent(db, input) {
+  const allowed = ["idempotencyKey", "projectId", "kind", "outcome", "summary", "evidenceStrength", "workflowId", "workflowRevision", "executionId", "runId", "stepId", "sourceLinks", "evidenceRefs", "evidenceDigests"];
+  if (!input || typeof input !== "object" || Object.keys(input).some((key) => !allowed.includes(key)))
+    fail("Invalid learning event fields.");
+  for (const field of ["idempotencyKey", "projectId", "kind", "outcome"])
+    bounded(input[field], field);
+  bounded(input.summary, "summary", 4e3);
+  for (const field of ["workflowId", "executionId", "runId", "stepId"])
+    if (input[field] !== void 0)
+      bounded(input[field], field);
+  if (input.workflowRevision !== void 0 && (!Number.isSafeInteger(input.workflowRevision) || input.workflowRevision < 1))
+    fail("Invalid workflow revision.");
+  if (input.evidenceStrength !== void 0 && !["operational", "hypothesis", "verified", "human-feedback"].includes(input.evidenceStrength))
+    fail("Invalid evidence strength.");
+  if (input.sourceLinks !== void 0)
+    sources(input.sourceLinks);
+  if (input.evidenceRefs !== void 0)
+    refs(input.evidenceRefs, "evidence refs");
+  if (input.evidenceDigests !== void 0)
+    refs(input.evidenceDigests, "evidence digests");
+  const existing = db.prepare("SELECT body FROM learning_events WHERE idempotency_key=?").all(input.idempotencyKey)[0];
+  if (existing) {
+    const event2 = JSON.parse(existing.body);
+    const { id: _id, createdAt: _createdAt, ...original } = event2;
+    const normalize = (v) => JSON.stringify(Object.fromEntries(Object.entries(v).filter(([, x]) => x !== void 0).sort(([a], [b]) => a.localeCompare(b))));
+    if (normalize(original) !== normalize(input))
+      fail("Idempotency key already describes a different event.", 409);
+    return event2;
+  }
+  const event = { ...input, id: randomUUID3(), createdAt: (/* @__PURE__ */ new Date()).toISOString() };
+  db.prepare("INSERT INTO learning_events(id,idempotency_key,project_id,body,updated_at) VALUES(?,?,?,?,?)").run(event.id, event.idempotencyKey, event.projectId, JSON.stringify(event), event.createdAt);
+  return event;
+}
+function enqueueLearningWork(db, eventId, kind = "derive-knowledge") {
+  bounded(eventId, "event ID");
+  bounded(kind, "work kind");
+  if (!read(db, "learning_events", eventId))
+    fail("Learning event not found.", 404);
+  db.prepare("INSERT OR IGNORE INTO learning_work(id,event_id,kind,status,available_at) VALUES(?,?,?,'pending',?)").run(randomUUID3(), eventId, kind, Date.now());
+  return workRow(db.prepare("SELECT * FROM learning_work WHERE event_id=? AND kind=?").all(eventId, kind)[0]);
+}
+function workRow(row) {
+  return { id: String(row.id), eventId: String(row.event_id), kind: String(row.kind), status: row.status, attempts: Number(row.attempts), availableAt: Number(row.available_at), leaseUntil: row.lease_until === null ? null : Number(row.lease_until), claimToken: row.claim_token === null ? null : String(row.claim_token), owner: row.owner === null ? null : String(row.owner) };
+}
+var LearningStore = class {
+  #db;
+  #ownsDatabase;
+  constructor(dbPath) {
+    this.#ownsDatabase = typeof dbPath !== "object";
+    if (typeof dbPath === "object")
+      this.#db = dbPath;
+    else {
+      const path = resolveOsecDbPath(dbPath);
+      ensureDatabaseDirectory(path);
+      this.#db = createShimmedDatabase(path);
+    }
+    this.#db.pragma("busy_timeout = 5000");
+    initializeLearningTables(this.#db);
+  }
+  close() {
+    if (this.#ownsDatabase)
+      this.#db.close();
+  }
+  appendEvent(input) {
+    return this.#db.transaction(() => appendLearningEvent(this.#db, input))();
+  }
+  recordExperience(input, kind = "derive-knowledge") {
+    return this.#db.transaction(() => {
+      const event = appendLearningEvent(this.#db, input);
+      enqueueLearningWork(this.#db, event.id, kind);
+      return event;
+    })();
+  }
+  getEvent(id) {
+    return read(this.#db, "learning_events", id);
+  }
+  #list(table, options = {}) {
+    return this.#db.prepare(`SELECT body FROM ${table} WHERE (? IS NULL OR project_id=?) ORDER BY updated_at DESC,id LIMIT ?`).all(options.projectId ?? null, options.projectId ?? null, limit(options.limit)).map((row) => JSON.parse(row.body));
+  }
+  listEvents(options) {
+    return this.#list("learning_events", options);
+  }
+  listKnowledge(options) {
+    return this.#list("learning_knowledge", options);
+  }
+  getKnowledge(id) {
+    return read(this.#db, "learning_knowledge", id);
+  }
+  #checkEvidence(projectId, ids) {
+    refs(ids, "evidence event IDs");
+    if (!ids.length)
+      fail("Evidence is required.");
+    for (const id of ids) {
+      const event = this.getEvent(id);
+      if (!event || event.projectId !== projectId)
+        fail("Evidence must belong to the same project.");
+    }
+  }
+  putKnowledge(input) {
+    bounded(input.projectId, "project ID");
+    bounded(input.summary, "knowledge summary", 4e3);
+    sources(input.sourceLinks);
+    this.#checkEvidence(input.projectId, input.evidenceEventIds);
+    if (input.sourceLinks.length) {
+      const fingerprint = (links) => JSON.stringify([...links].sort((a, b) => a.path.localeCompare(b.path) || a.hash.localeCompare(b.hash)));
+      const matching = this.#db.prepare("SELECT body FROM learning_knowledge WHERE project_id=? AND json_extract(body,'$.summary')=? AND json_extract(body,'$.status')='disabled'").all(input.projectId, input.summary);
+      for (const row of matching) {
+        const prior = JSON.parse(row.body);
+        if (fingerprint(prior.sourceLinks) === fingerprint(input.sourceLinks))
+          return prior;
+      }
+    }
+    const identity = `knowledge:${createHash2("sha256").update(JSON.stringify({ projectId: input.projectId, summary: input.summary, sourceLinks: [...input.sourceLinks].sort((a, b) => a.path.localeCompare(b.path)), evidenceEventIds: [...input.evidenceEventIds].sort() })).digest("hex")}`;
+    const existing = this.getKnowledge(identity);
+    if (existing)
+      return existing;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const entry = { projectId: input.projectId, summary: input.summary, sourceLinks: input.sourceLinks, evidenceEventIds: input.evidenceEventIds, id: identity, status: "current", createdAt: now, updatedAt: now };
+    write(this.#db, "learning_knowledge", entry);
+    return entry;
+  }
+  setKnowledgeStatus(id, status) {
+    if (!["current", "stale", "disabled"].includes(status))
+      fail("Invalid knowledge status.");
+    const entry = this.getKnowledge(id);
+    if (!entry)
+      fail("Knowledge not found.", 404);
+    if (status === "current" && entry.status !== "current")
+      fail("Retain fresh evidence before reactivating knowledge.", 409);
+    entry.status = status;
+    entry.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+    write(this.#db, "learning_knowledge", entry);
+    return entry;
+  }
+  invalidateKnowledge(projectId, currentHashes) {
+    bounded(projectId, "project ID");
+    return this.#db.transaction(() => {
+      let count = 0;
+      const rows = this.#db.prepare("SELECT body FROM learning_knowledge WHERE project_id=?").all(projectId);
+      for (const row of rows) {
+        const entry = JSON.parse(row.body);
+        if (entry.status === "current" && entry.sourceLinks.some((link) => !Object.hasOwn(currentHashes, link.path) || currentHashes[link.path] !== link.hash)) {
+          this.setKnowledgeStatus(entry.id, "stale");
+          count++;
+        }
+      }
+      return count;
+    })();
+  }
+  createCandidate(input) {
+    for (const field of ["projectId", "kind", "targetId", "baseVersion"])
+      bounded(input[field], field);
+    bounded(input.proposal, "proposal", 16e3);
+    this.#checkEvidence(input.projectId, input.evidenceEventIds);
+    if (input.artifactDigest !== void 0 && input.artifactDigest !== learningArtifactDigest(input.proposal))
+      fail("Candidate artifact digest mismatch.");
+    if (input.registry) {
+      for (const field of ["registryVersionId", "registryStorePath", "snapshotDigest"])
+        bounded(input.registry[field], field, 4096);
+      if (!["candidate", "canary", "active", "retired"].includes(input.registry.registryStatus))
+        fail("Invalid registry status.");
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const value = { projectId: input.projectId, kind: input.kind, targetId: input.targetId, baseVersion: input.baseVersion, proposal: input.proposal, evidenceEventIds: input.evidenceEventIds, artifactDigest: learningArtifactDigest(input.proposal), ...input.registry ? { registry: input.registry } : {}, id: randomUUID3(), status: "proposed", revision: 1, evaluations: [], createdAt: now, updatedAt: now };
+    write(this.#db, "learning_candidates", value);
+    return value;
+  }
+  createWorkflowSuggestion(input) {
+    if (input.kind !== "workflow-restore" || input.registry)
+      fail("Invalid workflow suggestion.");
+    const key = learningArtifactDigest(JSON.stringify([input.projectId, input.targetId, input.baseVersion, input.proposal]));
+    return this.#db.transaction(() => {
+      if (this.#db.prepare("SELECT candidate_id FROM learning_suggestion_keys WHERE key=?").all(key).length)
+        return null;
+      const candidate = this.createCandidate(input);
+      this.#db.prepare("INSERT INTO learning_suggestion_keys(key,candidate_id) VALUES(?,?)").run(key, candidate.id);
+      return candidate;
+    })();
+  }
+  getCandidate(id) {
+    return read(this.#db, "learning_candidates", id);
+  }
+  listCandidates(options) {
+    return this.#list("learning_candidates", options);
+  }
+  #candidate(id, revision) {
+    const value = this.getCandidate(id);
+    if (!value)
+      fail("Candidate not found.", 404);
+    if (value.revision !== revision)
+      fail("Candidate changed. Reload before updating.", 409);
+    return value;
+  }
+  #saveCandidate(value) {
+    value.revision++;
+    value.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+    write(this.#db, "learning_candidates", value);
+    return value;
+  }
+  transitionCandidate(id, revision, status) {
+    return this.#db.transaction(() => {
+      const value = this.#candidate(id, revision);
+      const allowed = { proposed: ["evaluating", "rejected"], evaluating: ["rejected"], validated: ["rejected"] };
+      if (!allowed[value.status]?.includes(status))
+        fail("Invalid candidate transition.", 409);
+      value.status = status;
+      return this.#saveCandidate(value);
+    })();
+  }
+  recordEvaluation(id, revision, input) {
+    for (const field of ["suiteDigest", "baselineDigest", "candidateDigest"])
+      bounded(input[field], field);
+    if (input.evaluatorDigest !== void 0)
+      bounded(input.evaluatorDigest, "evaluator digest");
+    if (input.evaluationKind !== void 0 && !["output-fixture", "security-proof"].includes(input.evaluationKind))
+      fail("Invalid evaluation kind.");
+    if (input.outcome !== void 0 && !["passed", "failed", "inconclusive"].includes(input.outcome))
+      fail("Invalid evaluation outcome.");
+    if (input.outcome !== void 0 && input.passed !== (input.outcome === "passed"))
+      fail("Contradictory evaluation outcome.");
+    if (typeof input.passed !== "boolean" || !input.metrics || typeof input.metrics !== "object" || Array.isArray(input.metrics) || Object.keys(input.metrics).length > 32 || Object.entries(input.metrics).some(([key, value]) => key.length > 128 || typeof value !== "number" || !Number.isFinite(value)))
+      fail("Invalid evaluation metrics.");
+    return this.#db.transaction(() => {
+      const value = this.#candidate(id, revision);
+      if (value.evaluations.length >= 64)
+        fail("Too many evaluation receipts.");
+      if (value.status !== "evaluating")
+        fail("Candidate is not evaluating.", 409);
+      if (input.candidateDigest !== value.artifactDigest)
+        fail("Evaluation does not match the candidate artifact.", 409);
+      value.evaluations.push({ ...input.evaluatorDigest ? { evaluatorDigest: input.evaluatorDigest } : {}, ...input.evaluationKind ? { evaluationKind: input.evaluationKind } : {}, ...input.outcome ? { outcome: input.outcome } : {}, suiteDigest: input.suiteDigest, baselineDigest: input.baselineDigest, candidateDigest: input.candidateDigest, passed: input.passed, metrics: input.metrics, id: randomUUID3(), createdAt: (/* @__PURE__ */ new Date()).toISOString() });
+      value.status = input.outcome === "inconclusive" ? "evaluating" : input.passed ? "validated" : "rejected";
+      return this.#saveCandidate(value);
+    })();
+  }
+  /** Reviewed workflow edit, distinct from evaluated security deployment. */
+  markWorkflowSuggestionApplied(id, revision) {
+    const value = this.#candidate(id, revision);
+    if (value.kind !== "workflow-restore" || value.registry || value.status !== "proposed")
+      fail("Suggestion is no longer available.", 409);
+    value.status = "applied";
+    return this.#saveCandidate(value);
+  }
+  getActiveCandidate(projectId, kind, targetId) {
+    const row = this.#db.prepare("SELECT candidate_id FROM learning_active WHERE project_id=? AND kind=? AND target_id=?").all(projectId, kind, targetId)[0];
+    return row ? this.getCandidate(row.candidate_id) : null;
+  }
+  activateCandidate(id, revision, expectedActiveId = null) {
+    return this.#db.transaction(() => {
+      const value = this.#candidate(id, revision);
+      if (value.status !== "validated" || !value.evaluations.at(-1)?.passed)
+        fail("Candidate needs a passing evaluation.", 409);
+      const active = this.getActiveCandidate(value.projectId, value.kind, value.targetId);
+      if ((active?.id ?? null) !== expectedActiveId)
+        fail("Active version changed.", 409);
+      if (active) {
+        active.status = "retired";
+        this.#saveCandidate(active);
+        value.previousActiveId = active.id;
+      }
+      value.status = "active";
+      this.#db.prepare("INSERT INTO learning_active(project_id,kind,target_id,candidate_id) VALUES(?,?,?,?) ON CONFLICT(project_id,kind,target_id) DO UPDATE SET candidate_id=excluded.candidate_id").run(value.projectId, value.kind, value.targetId, value.id);
+      return this.#saveCandidate(value);
+    })();
+  }
+  rollbackCandidate(id, revision) {
+    return this.#db.transaction(() => {
+      const value = this.#candidate(id, revision);
+      if (value.status !== "active" || this.getActiveCandidate(value.projectId, value.kind, value.targetId)?.id !== id)
+        fail("Candidate is not active.", 409);
+      value.status = "retired";
+      const previous = value.previousActiveId ? this.getCandidate(value.previousActiveId) : null;
+      if (previous) {
+        previous.status = "active";
+        this.#saveCandidate(previous);
+        this.#db.prepare("UPDATE learning_active SET candidate_id=? WHERE project_id=? AND kind=? AND target_id=?").run(previous.id, value.projectId, value.kind, value.targetId);
+      } else
+        this.#db.prepare("DELETE FROM learning_active WHERE project_id=? AND kind=? AND target_id=?").run(value.projectId, value.kind, value.targetId);
+      return this.#saveCandidate(value);
+    })();
+  }
+  enqueue(eventId, kind = "derive-knowledge") {
+    return enqueueLearningWork(this.#db, eventId, kind);
+  }
+  claimWork(owner, leaseMs = 6e4, now = Date.now(), projectId) {
+    bounded(owner, "worker owner");
+    if (!Number.isSafeInteger(now) || !Number.isSafeInteger(leaseMs) || leaseMs < 100 || leaseMs > 36e5)
+      fail("Invalid lease.");
+    return this.#db.transaction(() => {
+      const row = this.#db.prepare("SELECT id FROM learning_work WHERE ((status='pending' AND available_at<=?) OR (status='claimed' AND lease_until<=?)) AND (? IS NULL OR event_id IN (SELECT id FROM learning_events WHERE project_id=?)) ORDER BY available_at,id LIMIT 1").all(now, now, projectId ?? null, projectId ?? null)[0];
+      if (!row)
+        return null;
+      this.#db.prepare("UPDATE learning_work SET status='claimed',owner=?,claim_token=?,lease_until=?,attempts=attempts+1 WHERE id=?").run(owner, randomUUID3(), now + leaseMs, row.id);
+      return workRow(this.#db.prepare("SELECT * FROM learning_work WHERE id=?").all(row.id)[0]);
+    })();
+  }
+  queueStatus(projectId) {
+    const counts = { pending: 0, claimed: 0, completed: 0 };
+    for (const row of this.#db.prepare("SELECT status,COUNT(*) AS count FROM learning_work WHERE (? IS NULL OR event_id IN (SELECT id FROM learning_events WHERE project_id=?)) GROUP BY status").all(projectId ?? null, projectId ?? null)) {
+      const value = row;
+      counts[value.status] = Number(value.count);
+    }
+    return counts;
+  }
+  /** Mirror a trusted external registry's existing lifecycle; this is not a promotion API. */
+  mirrorRegistryCandidate(input, status, evaluations = []) {
+    if (!["proposed", "canary", "active", "retired", "rejected", "validated", "evaluating"].includes(status))
+      fail("Invalid registry mirror status.");
+    const matching = { candidate: status === "rejected" ? "rejected" : "proposed", canary: "canary", active: "active", retired: "retired" };
+    if (matching[input.registry.registryStatus] !== status)
+      fail("Mirror status must match the registry.");
+    if (evaluations.length > 64)
+      fail("Too many evaluation receipts.");
+    for (const receipt of evaluations) {
+      if (receipt.evaluationKind !== "output-fixture")
+        fail("External registry receipts are output fixtures.");
+      for (const field of ["suiteDigest", "baselineDigest", "candidateDigest"])
+        bounded(receipt[field], field);
+      if (receipt.candidateDigest !== input.registry.snapshotDigest)
+        fail("Registry receipt snapshot does not match.");
+      if (typeof receipt.passed !== "boolean" || !receipt.metrics || typeof receipt.metrics !== "object" || Array.isArray(receipt.metrics) || Object.keys(receipt.metrics).length > 32 || Object.entries(receipt.metrics).some(([k, v]) => k.length > 128 || typeof v !== "number" || !Number.isFinite(v)))
+        fail("Invalid mirror receipt.");
+    }
+    return this.#db.transaction(() => {
+      const rows = this.#db.prepare("SELECT body FROM learning_candidates WHERE project_id=?").all(input.projectId);
+      const existing = rows.map((row) => JSON.parse(row.body)).find((candidate) => candidate.registry?.registryStorePath === input.registry.registryStorePath && candidate.registry.registryVersionId === input.registry.registryVersionId);
+      if (existing && (existing.proposal !== input.proposal || existing.registry?.snapshotDigest !== input.registry.snapshotDigest))
+        fail("Immutable registry artifact changed.", 409);
+      const value = existing ?? this.createCandidate(input);
+      value.status = status;
+      value.registry = input.registry;
+      for (const receipt of evaluations)
+        if (!value.evaluations.some((v) => v.suiteDigest === receipt.suiteDigest && v.candidateDigest === receipt.candidateDigest && v.baselineDigest === receipt.baselineDigest && v.passed === receipt.passed))
+          value.evaluations.push({ ...receipt, id: randomUUID3(), createdAt: (/* @__PURE__ */ new Date()).toISOString() });
+      return this.#saveCandidate(value);
+    })();
+  }
+  #finishWork(id, token, status, delayMs, now) {
+    if (!Number.isSafeInteger(delayMs) || delayMs < 0 || delayMs > 864e5 || !Number.isSafeInteger(now))
+      fail("Invalid retry delay.");
+    const result = this.#db.prepare("UPDATE learning_work SET status=?,available_at=?,owner=NULL,claim_token=NULL,lease_until=NULL WHERE id=? AND status='claimed' AND claim_token=? AND lease_until>?").run(status, now + delayMs, id, token, now);
+    if (!result.changes)
+      fail("Work lease expired or belongs to another worker.", 409);
+  }
+  completeWork(id, token, now = Date.now()) {
+    this.#finishWork(id, token, "completed", 0, now);
+  }
+  retryWork(id, token, delayMs = 1e3, now = Date.now()) {
+    this.#finishWork(id, token, "pending", delayMs, now);
+  }
+};
+
+// packages/db/dist/security-workflows.js
+function workflowRestorePolicy(workflow) {
+  return JSON.stringify({
+    target: workflow.target,
+    template: workflow.template,
+    edges: workflow.edges,
+    nodes: workflow.nodes.map(({ label: _label, execution, ...node }) => ({
+      ...node,
+      ...execution ? { execution: { allowedAgentTools: execution.allowedAgentTools } } : {}
+    }))
+  });
+}
 var SecurityWorkflowStoreError = class extends Error {
   statusCode;
   constructor(message, statusCode) {
@@ -2629,17 +3284,39 @@ var activeStatuses = { queued: true, running: true };
 var statuses = { queued: true, running: true, completed: true, failed: true, cancelled: true, interrupted: true };
 var SecurityWorkflowStore = class {
   #db;
-  #runnerInstanceId = randomUUID3();
+  #runnerInstanceId = randomUUID4();
   constructor(dbPath) {
     const path = resolveOsecDbPath(dbPath);
     ensureDatabaseDirectory(path);
     this.#db = createShimmedDatabase(path);
     this.#db.pragma("busy_timeout = 5000");
+    initializeLearningTables(this.#db);
     this.#db.exec(`CREATE TABLE IF NOT EXISTS workflow_definitions (id TEXT PRIMARY KEY, revision INTEGER NOT NULL, definition_json TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL);
       CREATE TABLE IF NOT EXISTS workflow_executions (id TEXT PRIMARY KEY, workflow_id TEXT NOT NULL, workflow_revision INTEGER NOT NULL, session_id TEXT NOT NULL, status TEXT NOT NULL, execution_json TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL);
       CREATE INDEX IF NOT EXISTS workflow_executions_workflow ON workflow_executions(workflow_id, created_at);
       CREATE INDEX IF NOT EXISTS workflow_executions_session ON workflow_executions(session_id, created_at);`);
     this.#db.exec("CREATE TABLE IF NOT EXISTS workflow_execution_results (execution_id TEXT PRIMARY KEY, result_json TEXT NOT NULL);");
+    this.#db.exec(`CREATE TABLE IF NOT EXISTS workflow_definition_versions (
+      workflow_id TEXT NOT NULL, revision INTEGER NOT NULL, definition_json TEXT NOT NULL,
+      parent_revision INTEGER, restored_from_revision INTEGER, digest TEXT NOT NULL, created_at TEXT NOT NULL,
+      PRIMARY KEY (workflow_id, revision));`);
+    this.#db.transaction(() => {
+      for (const workflow of this.list()) {
+        if (this.getVersion(workflow.id, workflow.revision))
+          continue;
+        this.#recordVersion(workflow, null, null, true);
+        const snapshots = this.#db.prepare("SELECT execution_json FROM workflow_executions WHERE workflow_id = ? ORDER BY created_at, id").all(workflow.id);
+        for (const row of snapshots) {
+          const execution = JSON.parse(String(row.execution_json));
+          if (execution.workflow.revision < workflow.revision)
+            this.#recordVersion(execution.workflow, null, null, true);
+        }
+      }
+    })();
+  }
+  /** Shares the control connection so learning and workflow transactions cannot race. */
+  learningStore() {
+    return new LearningStore(this.#db);
   }
   list() {
     return this.#db.prepare("SELECT definition_json FROM workflow_definitions ORDER BY updated_at DESC, id").all().map((row) => JSON.parse(String(row.definition_json)));
@@ -2648,6 +3325,65 @@ var SecurityWorkflowStore = class {
     const row = this.#db.prepare("SELECT definition_json FROM workflow_definitions WHERE id = ?").all(id)[0];
     return row ? JSON.parse(String(row.definition_json)) : null;
   }
+  listVersions(id) {
+    return this.#db.prepare("SELECT * FROM workflow_definition_versions WHERE workflow_id = ? ORDER BY revision DESC").all(id).map(readVersion);
+  }
+  getVersion(id, revision) {
+    const row = this.#db.prepare("SELECT * FROM workflow_definition_versions WHERE workflow_id = ? AND revision = ?").all(id, revision)[0];
+    return row ? readVersion(row) : null;
+  }
+  #recordVersion(workflow, parentRevision, restoredFromRevision, recover = false) {
+    const json = JSON.stringify(workflow);
+    this.#db.prepare(`${recover ? "INSERT OR IGNORE" : "INSERT"} INTO workflow_definition_versions (workflow_id, revision, definition_json, parent_revision, restored_from_revision, digest, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)`).run(workflow.id, workflow.revision, json, parentRevision, restoredFromRevision, createHash3("sha256").update(json).digest("hex"), workflow.updatedAt);
+  }
+  /** CAS restore: existing runs and reviewed schedule revisions remain pinned. */
+  rollback(id, targetRevision, expectedRevision) {
+    if (!Number.isInteger(targetRevision) || targetRevision < 1 || !Number.isInteger(expectedRevision) || expectedRevision < 1)
+      throw new SecurityWorkflowStoreError("Invalid workflow revision.", 400);
+    return this.#db.transaction(() => {
+      const current = this.get(id);
+      if (!current)
+        throw new SecurityWorkflowStoreError("Workflow not found.", 404);
+      if (current.revision !== expectedRevision)
+        throw new SecurityWorkflowStoreError("Workflow changed. Reload before restoring.", 409);
+      const previous = this.getVersion(id, targetRevision);
+      if (!previous)
+        throw new SecurityWorkflowStoreError("Workflow version not found.", 404);
+      const workflow = { ...previous.definition, revision: current.revision + 1, createdAt: current.createdAt, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+      this.#db.prepare("UPDATE workflow_definitions SET revision = ?, definition_json = ?, updated_at = ? WHERE id = ? AND revision = ?").run(workflow.revision, JSON.stringify(workflow), workflow.updatedAt, id, expectedRevision);
+      this.#recordVersion(workflow, current.revision, targetRevision);
+      return workflow;
+    })();
+  }
+  applyLearningRestore(candidateId, candidateRevision, expectedWorkflowRevision) {
+    return this.#db.transaction(() => {
+      const learning = this.learningStore();
+      const candidate = learning.getCandidate(candidateId);
+      if (!candidate || candidate.kind !== "workflow-restore" || candidate.status !== "proposed" || candidate.revision !== candidateRevision)
+        throw new SecurityWorkflowStoreError("Suggestion changed. Reload before applying.", 409);
+      const proposal = JSON.parse(candidate.proposal);
+      const current = this.get(candidate.targetId);
+      const previous = this.getVersion(candidate.targetId, proposal.restoreRevision)?.definition;
+      if (!current || !previous || proposal.action !== "restore-workflow-instructions" || proposal.workflowId !== current.id || current.revision !== expectedWorkflowRevision || proposal.fromRevision !== current.revision || candidate.baseVersion !== String(current.revision) || candidate.projectId !== learningProjectId(current.target || current.id) || workflowRestorePolicy(current) !== workflowRestorePolicy(previous))
+        throw new SecurityWorkflowStoreError("Workflow changed or its scope differs. Review it again.", 409);
+      const updated = { ...previous, revision: current.revision + 1, createdAt: current.createdAt, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+      this.#db.prepare("UPDATE workflow_definitions SET revision = ?, definition_json = ?, updated_at = ? WHERE id = ? AND revision = ?").run(updated.revision, JSON.stringify(updated), updated.updatedAt, current.id, current.revision);
+      this.#recordVersion(updated, current.revision, previous.revision);
+      learning.markWorkflowSuggestionApplied(candidate.id, candidateRevision);
+      appendLearningEvent(this.#db, {
+        idempotencyKey: `workflow-suggestion-applied:${candidate.id}`,
+        projectId: candidate.projectId,
+        kind: "workflow-suggestion",
+        outcome: "applied",
+        summary: "Earlier workflow instructions restored after review.",
+        evidenceStrength: "operational",
+        workflowId: current.id,
+        workflowRevision: updated.revision,
+        evidenceRefs: [candidate.id]
+      });
+      return updated;
+    })();
+  }
   save(value) {
     let input;
     try {
@@ -2661,12 +3397,15 @@ var SecurityWorkflowStore = class {
         throw new SecurityWorkflowStoreError("Workflow not found.", 404);
       if (existing && input.revision !== existing.revision)
         throw new SecurityWorkflowStoreError("Workflow changed. Reload before saving.", 409);
+      if (input.id && !existing && this.#db.prepare("SELECT 1 FROM workflow_definition_versions WHERE workflow_id = ? LIMIT 1").all(input.id).length > 0)
+        throw new SecurityWorkflowStoreError("Deleted workflow IDs cannot be reused.", 409);
       const now = (/* @__PURE__ */ new Date()).toISOString();
-      const workflow = { ...input, id: input.id ?? randomUUID3(), revision: (existing?.revision ?? 0) + 1, createdAt: existing?.createdAt ?? now, updatedAt: now };
+      const workflow = { ...input, id: input.id ?? randomUUID4(), revision: (existing?.revision ?? 0) + 1, createdAt: existing?.createdAt ?? now, updatedAt: now };
       if (existing)
         this.#db.prepare("UPDATE workflow_definitions SET revision = ?, definition_json = ?, updated_at = ? WHERE id = ?").run(workflow.revision, JSON.stringify(workflow), now, workflow.id);
       else
         this.#db.prepare("INSERT INTO workflow_definitions (id, revision, definition_json, created_at, updated_at) VALUES (?, ?, ?, ?, ?)").run(workflow.id, workflow.revision, JSON.stringify(workflow), now, now);
+      this.#recordVersion(workflow, existing?.revision ?? null, null);
       return workflow;
     })();
   }
@@ -2691,7 +3430,7 @@ var SecurityWorkflowStore = class {
       if (revision !== void 0 && revision !== workflow.revision)
         throw new SecurityWorkflowStoreError("Workflow changed. Review it before running.", 409);
       const now = (/* @__PURE__ */ new Date()).toISOString();
-      const execution = { id: randomUUID3(), workflowId, workflowRevision: workflow.revision, workflow, sessionId, ownerPid: process.pid, runnerInstanceId: this.#runnerInstanceId, status: "queued", nodeResults: {}, createdAt: now, updatedAt: now };
+      const execution = { id: randomUUID4(), workflowId, workflowRevision: workflow.revision, workflow, sessionId, ownerPid: process.pid, runnerInstanceId: this.#runnerInstanceId, status: "queued", nodeResults: {}, createdAt: now, updatedAt: now };
       this.#db.prepare("INSERT INTO workflow_executions (id, workflow_id, workflow_revision, session_id, status, execution_json, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)").run(execution.id, workflowId, workflow.revision, sessionId, execution.status, JSON.stringify(execution), now, now);
       return execution;
     })();
@@ -2702,8 +3441,8 @@ var SecurityWorkflowStore = class {
       throw new SecurityWorkflowStoreError("Invalid execution owner.", 400);
     const input = parseSecurityWorkflowInput(value);
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const workflow = { ...input, id: input.id ?? randomUUID3(), revision: input.revision ?? 1, createdAt: now, updatedAt: now };
-    const execution = { id: randomUUID3(), workflowId: workflow.id, workflowRevision: workflow.revision, workflow, sessionId, ownerPid: process.pid, runnerInstanceId: this.#runnerInstanceId, status: "queued", nodeResults: {}, createdAt: now, updatedAt: now };
+    const workflow = { ...input, id: input.id ?? randomUUID4(), revision: input.revision ?? 1, createdAt: now, updatedAt: now };
+    const execution = { id: randomUUID4(), workflowId: workflow.id, workflowRevision: workflow.revision, workflow, sessionId, ownerPid: process.pid, runnerInstanceId: this.#runnerInstanceId, status: "queued", nodeResults: {}, createdAt: now, updatedAt: now };
     this.#db.prepare("INSERT INTO workflow_executions (id, workflow_id, workflow_revision, session_id, status, execution_json, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)").run(execution.id, execution.workflowId, execution.workflowRevision, sessionId, execution.status, JSON.stringify(execution), now, now);
     return execution;
   }
@@ -2757,6 +3496,29 @@ var SecurityWorkflowStore = class {
       }
       const execution = { ...current, status: update.status ?? current.status, jobId: update.jobId ?? current.jobId, nodeResults: update.nodeResults ?? current.nodeResults, error: update.error ?? current.error, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
       this.#db.prepare("UPDATE workflow_executions SET status = ?, execution_json = ?, updated_at = ? WHERE id = ?").run(execution.status, JSON.stringify(execution), execution.updatedAt, id);
+      const projectId = learningProjectId(execution.workflow.target || execution.workflowId);
+      const observe = (kind, outcome, stepId) => {
+        const event = appendLearningEvent(this.#db, {
+          idempotencyKey: `workflow-terminal:${createHash3("sha256").update(JSON.stringify({ executionId: id, stepId: stepId ?? null, kind, outcome })).digest("hex")}`,
+          projectId,
+          kind,
+          outcome,
+          evidenceStrength: "operational",
+          summary: stepId ? `Workflow step ${outcome}.` : `Workflow execution ${outcome}.`,
+          executionId: id,
+          workflowId: execution.workflowId,
+          workflowRevision: execution.workflowRevision,
+          ...stepId ? { stepId } : {}
+        });
+        enqueueLearningWork(this.#db, event.id);
+      };
+      const terminalNodes = /* @__PURE__ */ new Set(["completed", "failed", "cancelled", "interrupted", "skipped", "blocked"]);
+      for (const [stepId, result] of Object.entries(execution.nodeResults)) {
+        if (terminalNodes.has(result.status) && !terminalNodes.has(current.nodeResults[stepId]?.status ?? ""))
+          observe("workflow-step", result.status, stepId);
+      }
+      if (!activeStatuses[execution.status])
+        observe("workflow-run", execution.status);
       return execution;
     })();
   }
@@ -2789,9 +3551,13 @@ function processAlive(pid) {
     return !(error && typeof error === "object" && "code" in error && error.code === "ESRCH");
   }
 }
+function readVersion(value) {
+  const row = value;
+  return { workflowId: row.workflow_id, revision: row.revision, definition: JSON.parse(row.definition_json), parentRevision: row.parent_revision, restoredFromRevision: row.restored_from_revision, digest: row.digest, createdAt: row.created_at };
+}
 
 // packages/db/dist/workflow-triggers.js
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 var TRIGGER_INTERVAL_MS = { hourly: 36e5, daily: 864e5, weekly: 6048e5 };
 function nextWorkflowTriggerFire(startAt, cadence, now) {
   const anchor = Date.parse(startAt);
@@ -2819,7 +3585,7 @@ var WorkflowTriggerStore = class {
   }
   create(input, now = Date.now()) {
     const stamp = new Date(now).toISOString();
-    const trigger = { ...input, kind: "schedule", id: randomUUID4(), version: 1, nextFireAt: nextWorkflowTriggerFire(input.startAt, input.cadence, now), createdAt: stamp, updatedAt: stamp };
+    const trigger = { ...input, kind: "schedule", id: randomUUID5(), version: 1, nextFireAt: nextWorkflowTriggerFire(input.startAt, input.cadence, now), createdAt: stamp, updatedAt: stamp };
     this.#db.prepare("INSERT INTO workflow_triggers(id,workflow_id,enabled,next_fire_at,active_claim,trigger_json) VALUES(?,?,?,?,NULL,?)").run(trigger.id, trigger.workflowId, trigger.enabled ? 1 : 0, trigger.nextFireAt, JSON.stringify(trigger));
     return trigger;
   }
@@ -2845,7 +3611,7 @@ var WorkflowTriggerStore = class {
     const current = this.get(id);
     if (!current?.enabled || current.activeClaim || Date.parse(current.nextFireAt) > now)
       return null;
-    const claim = randomUUID4();
+    const claim = randomUUID5();
     const next = { ...current, version: (current.version ?? 1) + 1, activeClaim: claim, ownerPid: process.pid, nextFireAt: nextWorkflowTriggerFire(current.startAt, current.cadence, now), lastStatus: "starting", lastExecutionId: void 0, lastError: void 0, updatedAt: new Date(now).toISOString() };
     this.#db.prepare("UPDATE workflow_triggers SET active_claim=?, next_fire_at=?, trigger_json=? WHERE id=? AND enabled=1 AND active_claim IS NULL AND next_fire_at=? AND trigger_json=?").run(claim, next.nextFireAt, JSON.stringify(next), id, current.nextFireAt, JSON.stringify(current));
     return this.get(id)?.activeClaim === claim ? next : null;
@@ -2910,6 +3676,14 @@ export {
   resolveOsecRunStorage,
   listOsecRunDatabasePaths,
   writeOsecRunReport,
+  LearningStoreError,
+  learningProjectId,
+  learningArtifactDigest,
+  initializeLearningTables,
+  appendLearningEvent,
+  enqueueLearningWork,
+  LearningStore,
+  workflowRestorePolicy,
   SecurityWorkflowStoreError,
   SecurityWorkflowStore,
   TRIGGER_INTERVAL_MS,