@agnt-sdk/simon-server 0.0.0-stage → 0.1.0

package/dist/store/sqlite-migration.d.ts

@@ -0,0 +1,82 @@
+import { DatabaseSync } from 'node:sqlite';
+import { type RetractionCapacity } from './store.ts';
+type Stage = 'SNAPSHOTTED' | 'PREFLIGHT_OK' | 'COPIED' | 'VERIFIED';
+export declare class SqliteMigrationRefusal extends Error {
+    readonly code: string;
+    constructor(code: string);
+}
+/**
+ * The bundle's `004-VERIFIED.json` is durable, but releasing the source handles/writer exclusions failed
+ * afterwards. Not a refusal: the bundle keeps its single VERIFIED meaning and carries no REFUSED marker.
+ */
+export declare class SqliteV2CleanupFailure extends Error {
+    readonly code = "cleanup_failed";
+    readonly candidate: SqliteV2Candidate;
+    constructor(candidate: SqliteV2Candidate);
+}
+declare function ledger(db: DatabaseSync, tables: readonly string[]): {
+    [k: string]: {
+        count: number;
+        orderedRowHashes: string[];
+        digest: string;
+    };
+};
+export interface SqliteV2CandidateOptions {
+    /** Existing actual schema2 file; its app-arrivals.sqlite cohort is required beside it. */
+    source: string;
+    /** Fresh private bundle directory; no existing unrelated directory or target is overwritten. */
+    directory: string;
+    /** Private external maintenance/drain attestation, including the still-held host fence. */
+    maintenanceFile: string;
+    retractions?: Partial<RetractionCapacity>;
+    /** Synthetic fault injection only; never a CLI argument or a promotion hook. */
+    afterStage?: (stage: Stage) => void;
+    /** Synthetic failure points inside conversion (`cleanup`: releasing the source handles), absent from the CLI. */
+    faultAt?: 'copy-row' | 'bootstrap' | 'verify' | 'cleanup';
+}
+export interface SqliteV2Candidate {
+    status: 'VERIFIED_COPY_HELD';
+    activationBlocked: true;
+    holds: string[];
+    bundleId: string;
+    maintenanceDigest: string;
+    origin: string;
+    serverKeyFingerprint: string;
+    configDigest: string;
+    toolCommit: string;
+    retractionLimits: RetractionCapacity;
+    observation: {
+        at: string;
+        provenance: string;
+        previous?: string;
+    };
+    sourcePaths: {
+        core: string;
+        outbox: string;
+    };
+    source: {
+        core: ReturnType<typeof ledger>;
+        outbox: ReturnType<typeof ledger>;
+    };
+    snapshots: {
+        core: string;
+        outbox: string;
+    };
+    candidate: {
+        core: string;
+        outbox: string;
+    };
+    hashes: Record<string, string>;
+    highWatermark: number;
+    usableHeadroom: number;
+    archivedTombstones: string[];
+    generations: Record<string, string>;
+    noOperationalPromotion: true;
+}
+/**
+ * The maintenance attestation is an operator prerequisite, not proof that arbitrary external processes
+ * stopped. Both actual SQLite writer locks are acquired before either snapshot; the host fence must
+ * remain owned/respected outside this command. Output never selects an operational database path.
+ */
+export declare function createSqliteV2Candidate(options: SqliteV2CandidateOptions): Promise<SqliteV2Candidate>;
+export {};