@aitne/daemon 0.1.7 → 0.1.9

package/dist/db/integration-probe-store.d.ts

@@ -24,4 +24,3 @@ export declare function probeKey(integration: IntegrationKey, backend: BackendId
  * live probe (dashboard button) re-populates the cache.
  */
 export declare function deleteProbesForIntegration(db: Database.Database, integration: IntegrationKey): number;
-//# sourceMappingURL=integration-probe-store.d.ts.map

package/dist/db/integration-probe-store.js

@@ -72,4 +72,3 @@ export function deleteProbesForIntegration(db, integration) {
         .run(integration);
     return result.changes;
 }
-//# sourceMappingURL=integration-probe-store.js.map

package/dist/db/integrations-store.d.ts

@@ -16,4 +16,3 @@ export declare function writeIntegrations(db: Database.Database, update: Partial
 export declare function updateIntegrationState(db: Database.Database, key: IntegrationKey, next: Omit<IntegrationState, "lastChangedAt"> & {
     lastChangedAt?: string;
 }): IntegrationsRecord;
-//# sourceMappingURL=integrations-store.d.ts.map

package/dist/db/integrations-store.js

@@ -82,4 +82,3 @@ export function updateIntegrationState(db, key, next) {
     };
     return writeIntegrations(db, { [key]: stamped });
 }
-//# sourceMappingURL=integrations-store.js.map

package/dist/db/managed-chromium-sites-store.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Per-site authenticated-session state store for Instance A
+ * (Phase B-2.5).
+ *
+ * MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §16.7.
+ *
+ * Two `runtime_state` keys per site:
+ *   - `managed_chromium.sites.<siteKey>`            — persistent connection
+ *     record. Created by the bootstrap finalize path; read by the
+ *     workflow runner to decide `site_not_connected` vs proceed.
+ *   - `managed_chromium.site_bootstrap.<siteKey>`   — transient sign-in
+ *     handle. Created when the user clicks "Connect <site>"; cleared
+ *     by finalize / disconnect / orphan-reap.
+ *
+ * No new tables. The §16.7 doc commits explicitly to "All B-2.5 state
+ * fits in runtime_state".
+ */
+import type Database from "better-sqlite3";
+import { z } from "zod";
+export declare function siteConnectionKey(siteKey: string): string;
+export declare function siteBootstrapKey(siteKey: string): string;
+/**
+ * Persistent per-site connection record. Created by the bootstrap
+ * finalize path; cleared by disconnect. The `lastWorkflowAt` tick is
+ * advanced by the workflow runner on every successful auth-variant run
+ * so the compromise-detection §16.6 filesystem watcher has a
+ * cross-check timestamp.
+ */
+export interface SiteConnection {
+    /** Schema version for forward-compat. */
+    schemaVersion: 1;
+    /** Epoch ms of the bootstrap finalize. Drives the
+     *  `sessionMaxAgeDays` freshness floor in the workflow runner. */
+    connectedAt: number;
+    /** Display label captured from the signed-in page (e.g., "Hello,
+     *  Alice" → "Alice"). Optional — some sites do not expose a
+     *  readable identifier in the public DOM, and the dashboard
+     *  surfaces just "Connected" in that case. */
+    accountLabel: string | null;
+    /** Epoch ms of the most recent successful auth-variant workflow
+     *  run for this site. Null until the first successful run. */
+    lastWorkflowAt: number | null;
+}
+/** Transient bootstrap state — UI Chromium running interactively. */
+export interface SiteBootstrap {
+    /** PID of the UI Chromium spawned for sign-in. */
+    pid: number;
+    /** Epoch ms past which the reaper SIGKILLs the orphan PID. */
+    deadlineAt: number;
+    /** True when this bootstrap is a reauth (reuses the existing
+     *  profile dir, may auto-sign-in via persistent cookies). */
+    reauth: boolean;
+    /** Kernel-assigned loopback port the UI Chromium's CDP listens on.
+     *  The status probe and the finalize check connect to this port via
+     *  Playwright `connectOverCDP` to verify the per-site
+     *  `signedInSelector` resolves. Loopback-only by Chromium's CDP
+     *  default; the per-cycle launcher pins `--remote-debugging-address=
+     *  127.0.0.1` (defence-in-depth, see `INSTANCE_A_SHARED_FLAGS`). */
+    cdpPort: number;
+}
+/**
+ * Read the persistent connection record for `siteKey`. Returns null
+ * when the row is absent or fails schema validation — a corrupt row is
+ * treated as "never connected" so the runner reports
+ * `site_not_connected` and the dashboard prompts a fresh sign-in. The
+ * profile dir is unaffected by the read; only the metadata row is
+ * discarded.
+ */
+export declare function readSiteConnection(db: Database.Database, siteKey: string): SiteConnection | null;
+export declare function writeSiteConnection(db: Database.Database, siteKey: string, value: SiteConnection): void;
+export declare function clearSiteConnection(db: Database.Database, siteKey: string): void;
+/**
+ * Atomic read-modify-write helper used by the runner to advance
+ * `lastWorkflowAt`. Caller's mutator receives a shallow copy and
+ * returns the new value (or void to mutate in place). Writes the
+ * result through the schema so an accidentally-out-of-shape update
+ * fails fast in tests.
+ */
+export declare function updateSiteConnection(db: Database.Database, siteKey: string, mutate: (current: SiteConnection) => SiteConnection | void): SiteConnection | null;
+export declare function readSiteBootstrap(db: Database.Database, siteKey: string): SiteBootstrap | null;
+export declare function writeSiteBootstrap(db: Database.Database, siteKey: string, value: SiteBootstrap): void;
+export declare function clearSiteBootstrap(db: Database.Database, siteKey: string): void;
+/**
+ * Enumerate every persisted (connection row, siteKey) pair. Used by
+ * the supervisor's orphan reaper to sweep stale bootstrap PIDs across
+ * every connected site without needing a registry import (the reaper
+ * cleans up whatever rows happen to exist, including rows for sites
+ * that were removed from the registry in a later release).
+ *
+ * Returns rows in alphabetical site-key order so output is stable for
+ * tests and audit logs.
+ */
+export declare function listSiteConnectionKeys(db: Database.Database): string[];
+export declare function listSiteBootstrapKeys(db: Database.Database): string[];
+export declare const __testing: {
+    siteConnectionSchema: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        connectedAt: z.ZodNumber;
+        accountLabel: z.ZodNullable<z.ZodString>;
+        lastWorkflowAt: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strip>;
+    siteBootstrapSchema: z.ZodObject<{
+        pid: z.ZodNumber;
+        deadlineAt: z.ZodNumber;
+        reauth: z.ZodBoolean;
+        cdpPort: z.ZodNumber;
+    }, z.core.$strip>;
+    SITES_KEY_PREFIX: string;
+    SITE_BOOTSTRAP_KEY_PREFIX: string;
+};

package/dist/db/managed-chromium-sites-store.js

@@ -0,0 +1,174 @@
+/**
+ * Per-site authenticated-session state store for Instance A
+ * (Phase B-2.5).
+ *
+ * MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §16.7.
+ *
+ * Two `runtime_state` keys per site:
+ *   - `managed_chromium.sites.<siteKey>`            — persistent connection
+ *     record. Created by the bootstrap finalize path; read by the
+ *     workflow runner to decide `site_not_connected` vs proceed.
+ *   - `managed_chromium.site_bootstrap.<siteKey>`   — transient sign-in
+ *     handle. Created when the user clicks "Connect <site>"; cleared
+ *     by finalize / disconnect / orphan-reap.
+ *
+ * No new tables. The §16.7 doc commits explicitly to "All B-2.5 state
+ * fits in runtime_state".
+ */
+import { z } from "zod";
+import { createLogger } from "../logging.js";
+import { deleteRuntimeState, readRuntimeState, writeRuntimeState, } from "./runtime-state.js";
+const logger = createLogger("managed-chromium-sites-store");
+const SITE_KEY_REGEX = /^[a-z][a-z0-9_]*$/;
+const SITES_KEY_PREFIX = "managed_chromium.sites.";
+const SITE_BOOTSTRAP_KEY_PREFIX = "managed_chromium.site_bootstrap.";
+/**
+ * Validate a `siteKey` before composing a runtime_state row key —
+ * registry validation guarantees this for shipping sites, this is the
+ * defence-in-depth path-shape contract for anything that builds the
+ * composite runtime_state key from external input (route params).
+ */
+function assertSiteKey(siteKey) {
+    if (!SITE_KEY_REGEX.test(siteKey)) {
+        throw new Error(`managed-chromium-sites-store: siteKey "${siteKey}" violates naming convention`);
+    }
+}
+export function siteConnectionKey(siteKey) {
+    assertSiteKey(siteKey);
+    return `${SITES_KEY_PREFIX}${siteKey}`;
+}
+export function siteBootstrapKey(siteKey) {
+    assertSiteKey(siteKey);
+    return `${SITE_BOOTSTRAP_KEY_PREFIX}${siteKey}`;
+}
+const siteConnectionSchema = z.object({
+    schemaVersion: z.literal(1),
+    connectedAt: z.number().int().nonnegative(),
+    accountLabel: z.string().max(120).nullable(),
+    lastWorkflowAt: z.number().int().nonnegative().nullable(),
+});
+const siteBootstrapSchema = z.object({
+    pid: z.number().int().positive(),
+    deadlineAt: z.number().int().nonnegative(),
+    reauth: z.boolean(),
+    cdpPort: z.number().int().min(1).max(65535),
+});
+/**
+ * Read the persistent connection record for `siteKey`. Returns null
+ * when the row is absent or fails schema validation — a corrupt row is
+ * treated as "never connected" so the runner reports
+ * `site_not_connected` and the dashboard prompts a fresh sign-in. The
+ * profile dir is unaffected by the read; only the metadata row is
+ * discarded.
+ */
+export function readSiteConnection(db, siteKey) {
+    const raw = readRuntimeState(db, siteConnectionKey(siteKey));
+    if (raw == null)
+        return null;
+    const parsed = siteConnectionSchema.safeParse(raw);
+    if (!parsed.success) {
+        logger.warn({ issues: parsed.error.issues, siteKey }, "managed_chromium site connection row parse failed; treating as disconnected");
+        return null;
+    }
+    return parsed.data;
+}
+export function writeSiteConnection(db, siteKey, value) {
+    const validated = siteConnectionSchema.parse(value);
+    writeRuntimeState(db, siteConnectionKey(siteKey), validated);
+}
+export function clearSiteConnection(db, siteKey) {
+    deleteRuntimeState(db, siteConnectionKey(siteKey));
+}
+/**
+ * Atomic read-modify-write helper used by the runner to advance
+ * `lastWorkflowAt`. Caller's mutator receives a shallow copy and
+ * returns the new value (or void to mutate in place). Writes the
+ * result through the schema so an accidentally-out-of-shape update
+ * fails fast in tests.
+ */
+export function updateSiteConnection(db, siteKey, mutate) {
+    const current = readSiteConnection(db, siteKey);
+    if (!current)
+        return null;
+    const draft = { ...current };
+    const next = mutate(draft) ?? draft;
+    const validated = siteConnectionSchema.parse(next);
+    writeRuntimeState(db, siteConnectionKey(siteKey), validated);
+    return validated;
+}
+export function readSiteBootstrap(db, siteKey) {
+    const raw = readRuntimeState(db, siteBootstrapKey(siteKey));
+    if (raw == null)
+        return null;
+    const parsed = siteBootstrapSchema.safeParse(raw);
+    if (!parsed.success) {
+        logger.warn({ issues: parsed.error.issues, siteKey }, "managed_chromium site bootstrap row parse failed; treating as idle");
+        return null;
+    }
+    return parsed.data;
+}
+export function writeSiteBootstrap(db, siteKey, value) {
+    const validated = siteBootstrapSchema.parse(value);
+    writeRuntimeState(db, siteBootstrapKey(siteKey), validated);
+}
+export function clearSiteBootstrap(db, siteKey) {
+    deleteRuntimeState(db, siteBootstrapKey(siteKey));
+}
+/**
+ * Enumerate every persisted (connection row, siteKey) pair. Used by
+ * the supervisor's orphan reaper to sweep stale bootstrap PIDs across
+ * every connected site without needing a registry import (the reaper
+ * cleans up whatever rows happen to exist, including rows for sites
+ * that were removed from the registry in a later release).
+ *
+ * Returns rows in alphabetical site-key order so output is stable for
+ * tests and audit logs.
+ */
+export function listSiteConnectionKeys(db) {
+    let rows;
+    try {
+        rows = db
+            .prepare(`SELECT key FROM runtime_state
+         WHERE key LIKE ?
+         ORDER BY key ASC`)
+            .all(`${SITES_KEY_PREFIX}%`);
+    }
+    catch (err) {
+        logger.error({ err }, "site-connection enumeration failed");
+        return [];
+    }
+    const out = [];
+    for (const { key } of rows) {
+        const siteKey = key.slice(SITES_KEY_PREFIX.length);
+        if (SITE_KEY_REGEX.test(siteKey))
+            out.push(siteKey);
+    }
+    return out;
+}
+export function listSiteBootstrapKeys(db) {
+    let rows;
+    try {
+        rows = db
+            .prepare(`SELECT key FROM runtime_state
+         WHERE key LIKE ?
+         ORDER BY key ASC`)
+            .all(`${SITE_BOOTSTRAP_KEY_PREFIX}%`);
+    }
+    catch (err) {
+        logger.error({ err }, "site-bootstrap enumeration failed");
+        return [];
+    }
+    const out = [];
+    for (const { key } of rows) {
+        const siteKey = key.slice(SITE_BOOTSTRAP_KEY_PREFIX.length);
+        if (SITE_KEY_REGEX.test(siteKey))
+            out.push(siteKey);
+    }
+    return out;
+}
+export const __testing = {
+    siteConnectionSchema,
+    siteBootstrapSchema,
+    SITES_KEY_PREFIX,
+    SITE_BOOTSTRAP_KEY_PREFIX,
+};

package/dist/db/managed-chromium-state.d.ts

@@ -0,0 +1,58 @@
+import type Database from "better-sqlite3";
+import { z } from "zod";
+import { type ManagedChromiumState } from "../services/browser-history/managed-chromium/types.js";
+/**
+ * Read the singleton managed-chromium state blob. Returns the canonical
+ * default shape when the row is absent or fails schema validation —
+ * corrupt rows are treated as "never written" rather than throwing, so a
+ * malformed runtime_state row cannot brick the daemon's boot path.
+ */
+export declare function readManagedChromiumState(db: Database.Database): ManagedChromiumState;
+/**
+ * Atomic read-modify-write helper. The mutator receives a deep copy and
+ * returns the new value (or void to mutate in place); the resulting
+ * value is validated through the same schema before persistence so an
+ * accidentally-out-of-shape update fails fast in tests.
+ */
+export declare function updateManagedChromiumState(db: Database.Database, mutate: (current: ManagedChromiumState) => ManagedChromiumState | void): ManagedChromiumState;
+/**
+ * Reset to the default shape. Called on disconnect and during the
+ * Danger-Zone context wipe.
+ */
+export declare function clearManagedChromiumState(db: Database.Database): void;
+export declare const __testing: {
+    stateSchema: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        enabled: z.ZodBoolean;
+        state: z.ZodEnum<{
+            off: "off";
+            needs_setup: "needs_setup";
+            missing_binary: "missing_binary";
+            missing_sandbox: "missing_sandbox";
+            ready: "ready";
+            needs_reauth: "needs_reauth";
+            disconnected: "disconnected";
+        }>;
+        signedInUser: z.ZodNullable<z.ZodString>;
+        lastCheckAt: z.ZodNullable<z.ZodNumber>;
+        lastSyncAt: z.ZodNullable<z.ZodNumber>;
+        recentRowCount: z.ZodNullable<z.ZodNumber>;
+        bootstrap: z.ZodNullable<z.ZodObject<{
+            pid: z.ZodNumber;
+            deadlineAt: z.ZodNumber;
+            reauth: z.ZodBoolean;
+        }, z.core.$strip>>;
+        lastDmAt: z.ZodDefault<z.ZodObject<{
+            healthy: z.ZodOptional<z.ZodNumber>;
+            sync_silent: z.ZodOptional<z.ZodNumber>;
+            account_changed: z.ZodOptional<z.ZodNumber>;
+            corrupt_local_state: z.ZodOptional<z.ZodNumber>;
+            signed_out: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        consecutiveFailures: z.ZodNumber;
+        pausedUntil: z.ZodNullable<z.ZodNumber>;
+        unsandboxedOptIn: z.ZodBoolean;
+    }, z.core.$strip>;
+    REAUTH_KINDS: readonly ["healthy", "sync_silent", "account_changed", "corrupt_local_state", "signed_out"];
+    STATE_VALUES: readonly ["off", "needs_setup", "missing_binary", "missing_sandbox", "ready", "needs_reauth", "disconnected"];
+};

package/dist/db/managed-chromium-state.js

@@ -0,0 +1,104 @@
+import { z } from "zod";
+import { DEFAULT_MANAGED_CHROMIUM_STATE, MANAGED_CHROMIUM_STATE_KEY, } from "../services/browser-history/managed-chromium/types.js";
+import { createLogger } from "../logging.js";
+import { deleteRuntimeState, readRuntimeState, writeRuntimeState, } from "./runtime-state.js";
+const logger = createLogger("managed-chromium-state");
+/**
+ * Reauth kinds known to the state shape. Mirrors
+ * `ManagedChromiumReauthKind` — kept in sync via the matching test.
+ */
+const REAUTH_KINDS = [
+    "healthy",
+    "sync_silent",
+    "account_changed",
+    "corrupt_local_state",
+    "signed_out",
+];
+const STATE_VALUES = [
+    "off",
+    "needs_setup",
+    "missing_binary",
+    "missing_sandbox",
+    "ready",
+    "needs_reauth",
+    "disconnected",
+];
+const bootstrapSchema = z.object({
+    pid: z.number().int().positive(),
+    deadlineAt: z.number().int().nonnegative(),
+    reauth: z.boolean(),
+});
+const stateSchema = z.object({
+    schemaVersion: z.literal(1),
+    enabled: z.boolean(),
+    state: z.enum(STATE_VALUES),
+    signedInUser: z.string().nullable(),
+    lastCheckAt: z.number().int().nonnegative().nullable(),
+    lastSyncAt: z.number().int().nonnegative().nullable(),
+    recentRowCount: z.number().int().nonnegative().nullable(),
+    bootstrap: bootstrapSchema.nullable(),
+    // Per-kind DM rate-limit timestamps. Each known kind is optional —
+    // an absent key means "never DMed". Modeled as `z.object({...optional})`
+    // rather than `z.record(z.enum(...), …)` because the latter requires
+    // every enum key to be present in the persisted value to typecheck,
+    // which contradicts the in-memory `Partial<Record<…>>` shape.
+    lastDmAt: z
+        .object({
+        healthy: z.number().int().nonnegative().optional(),
+        sync_silent: z.number().int().nonnegative().optional(),
+        account_changed: z.number().int().nonnegative().optional(),
+        corrupt_local_state: z.number().int().nonnegative().optional(),
+        signed_out: z.number().int().nonnegative().optional(),
+    })
+        .default({}),
+    consecutiveFailures: z.number().int().nonnegative(),
+    pausedUntil: z.number().int().nonnegative().nullable(),
+    unsandboxedOptIn: z.boolean(),
+});
+/**
+ * Read the singleton managed-chromium state blob. Returns the canonical
+ * default shape when the row is absent or fails schema validation —
+ * corrupt rows are treated as "never written" rather than throwing, so a
+ * malformed runtime_state row cannot brick the daemon's boot path.
+ */
+export function readManagedChromiumState(db) {
+    const raw = readRuntimeState(db, MANAGED_CHROMIUM_STATE_KEY);
+    if (raw == null)
+        return { ...DEFAULT_MANAGED_CHROMIUM_STATE };
+    const parsed = stateSchema.safeParse(raw);
+    if (!parsed.success) {
+        logger.warn({ issues: parsed.error.issues }, "managed_chromium state parse failed; using default shape");
+        return { ...DEFAULT_MANAGED_CHROMIUM_STATE };
+    }
+    return parsed.data;
+}
+/**
+ * Atomic read-modify-write helper. The mutator receives a deep copy and
+ * returns the new value (or void to mutate in place); the resulting
+ * value is validated through the same schema before persistence so an
+ * accidentally-out-of-shape update fails fast in tests.
+ */
+export function updateManagedChromiumState(db, mutate) {
+    const current = readManagedChromiumState(db);
+    const draft = {
+        ...current,
+        bootstrap: current.bootstrap ? { ...current.bootstrap } : null,
+        lastDmAt: { ...current.lastDmAt },
+    };
+    const next = mutate(draft) ?? draft;
+    const validated = stateSchema.parse(next);
+    writeRuntimeState(db, MANAGED_CHROMIUM_STATE_KEY, validated);
+    return validated;
+}
+/**
+ * Reset to the default shape. Called on disconnect and during the
+ * Danger-Zone context wipe.
+ */
+export function clearManagedChromiumState(db) {
+    deleteRuntimeState(db, MANAGED_CHROMIUM_STATE_KEY);
+}
+export const __testing = {
+    stateSchema,
+    REAUTH_KINDS,
+    STATE_VALUES,
+};

package/dist/db/managed-tasks-store.d.ts

@@ -127,4 +127,3 @@ export declare function deleteManagedTask(db: Database.Database, id: string): bo
  * registration time (§10.1 step 2).
  */
 export declare function findManagedTaskByAppCadence(db: Database.Database, app: string, cadence: string): ManagedTask | null;
-//# sourceMappingURL=managed-tasks-store.d.ts.map

package/dist/db/managed-tasks-store.js

@@ -235,4 +235,3 @@ export function findManagedTaskByAppCadence(db, app, cadence) {
         .get(normalizeAppLabel(app), cadence);
     return row ? rowToManagedTask(row) : null;
 }
-//# sourceMappingURL=managed-tasks-store.js.map

package/dist/db/management-parse-failures-store.d.ts

@@ -42,4 +42,3 @@ export declare function listManagementParseFailures(db: Database.Database, limit
  */
 export declare function clearManagementParseFailures(db: Database.Database): number;
 export {};
-//# sourceMappingURL=management-parse-failures-store.d.ts.map

package/dist/db/management-parse-failures-store.js

@@ -33,4 +33,3 @@ export function clearManagementParseFailures(db) {
     const result = db.prepare("DELETE FROM management_parse_failures").run();
     return result.changes;
 }
-//# sourceMappingURL=management-parse-failures-store.js.map