@aitne/daemon 0.1.8 → 0.1.9

package/dist/db/browser-task-store.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Browser-task row store — BROWSER_TASK_REDESIGN_PLAN.md §6.4.
+ *
+ * I/O-bound CRUD over `browser_task`. The state machine itself (§4) is
+ * enforced at this layer via the CHECK constraint on the `state` column
+ * (closed set) plus the per-transition helpers below — `markRunning`,
+ * `markAwaitingUser`, `markFinalConfirm`, `markCompleted`,
+ * `markTerminal` — each one's WHERE clause refuses an out-of-order
+ * write so a race between two writers cannot flip a row backwards.
+ *
+ * Pure decision logic (state-machine guards, queue arithmetic) lives in
+ * `services/browser-task/browser-task-slots.ts` and is the 100%-covered
+ * surface; this module is the SQL wrapper and is excluded from the
+ * coverage gate (same posture as `browser-automation-purchase-tokens-store.ts`).
+ */
+import type Database from "better-sqlite3";
+export type BrowserTaskState = "pending" | "running" | "awaiting_user" | "final_confirm" | "completed" | "failed" | "timeout" | "cancelled" | "abandoned";
+export declare const BROWSER_TASK_TERMINAL_STATES: ReadonlySet<BrowserTaskState>;
+export declare const BROWSER_TASK_NON_TERMINAL_STATES: ReadonlySet<BrowserTaskState>;
+export interface BrowserTaskRow {
+    id: string;
+    description: string;
+    siteKey: string | null;
+    extraAllowedHosts: readonly string[];
+    originatingChannel: string | null;
+    scheduleRowId: number | null;
+    requireFinalConfirm: boolean;
+    state: BrowserTaskState;
+    outcomeDetail: string | null;
+    report: string | null;
+    effectiveAllowlistRegex: string | null;
+    blockedRequestsCount: number;
+    extractCharsTotal: number;
+    createdAt: number;
+    startedAt: number | null;
+    finishedAt: number | null;
+}
+export interface CreateBrowserTaskInput {
+    id: string;
+    description: string;
+    siteKey: string | null;
+    extraAllowedHosts: readonly string[];
+    originatingChannel: string | null;
+    scheduleRowId: number | null;
+    requireFinalConfirm: boolean;
+    effectiveAllowlistRegex: string | null;
+    createdAt: number;
+}
+/** Insert a fresh row in state=pending. The slot manager promotes it
+ *  to `running` once a slot frees. */
+export declare function createBrowserTask(db: Database.Database, input: CreateBrowserTaskInput): BrowserTaskRow;
+export declare function getBrowserTask(db: Database.Database, id: string): BrowserTaskRow | null;
+export interface ListBrowserTasksOptions {
+    states?: readonly BrowserTaskState[];
+    siteKey?: string | null;
+    limit?: number;
+    offset?: number;
+}
+export declare function listBrowserTasks(db: Database.Database, options?: ListBrowserTasksOptions): readonly BrowserTaskRow[];
+export declare function countBrowserTasks(db: Database.Database, options?: ListBrowserTasksOptions): number;
+/** Pending → running. CAS on prior state so a concurrent terminal
+ *  transition (cancel-while-pending → cancelled) does not get clobbered.
+ *  Returns the new row or null on CAS miss. */
+export declare function markRunning(db: Database.Database, id: string, startedAt: number): BrowserTaskRow | null;
+/** Running → awaiting_user. Slot stays held; resume via /clarify. */
+export declare function markAwaitingUser(db: Database.Database, id: string): BrowserTaskRow | null;
+/** Running → final_confirm. Slot stays held; resume via token. */
+export declare function markFinalConfirm(db: Database.Database, id: string): BrowserTaskRow | null;
+/** Parked state → running. Used by /clarify resume and token-consume
+ *  resume. Either parked state is acceptable. */
+export declare function markRunningFromParked(db: Database.Database, id: string): BrowserTaskRow | null;
+export interface TerminalTransitionInput {
+    id: string;
+    state: "completed" | "failed" | "timeout" | "cancelled" | "abandoned";
+    outcomeDetail: string | null;
+    report: string | null;
+    finishedAt: number;
+}
+/** Any non-terminal state → terminal. Idempotent — re-running on an
+ *  already-terminal row CAS-misses and returns null. */
+export declare function markTerminal(db: Database.Database, input: TerminalTransitionInput): BrowserTaskRow | null;
+/** Increment the per-task CDP-blocked counter. Atomic. */
+export declare function incrementBlockedRequests(db: Database.Database, id: string, by: number): void;
+/** Increment the per-task cumulative untrusted-content counter. */
+export declare function incrementExtractChars(db: Database.Database, id: string, by: number): void;
+/**
+ * §6.5 boot-recovery sweep — flip every non-terminal row to
+ * (failed, 'daemon_restarted', finishedAt) on boot, before the
+ * dispatcher starts consuming events.
+ *
+ * Pure SQL UPDATE; returns the affected row count and the ids that
+ * were flipped so the caller can fan out one DM per row to the
+ * persisted `originating_channel`.
+ */
+export declare function sweepNonTerminalRowsForBootRecovery(db: Database.Database, nowMs: number): readonly {
+    id: string;
+    originatingChannel: string | null;
+}[];
+/**
+ * Retention prune for terminal `browser_task` rows older than `cutoffMs`
+ * (BROWSER_TASK_REDESIGN_PLAN.md §6.5 deferred follow-up + §14.7 — the
+ * trace-store window is 30 days; the SQL row lifetime matches so the
+ * dashboard never renders a row whose screenshots are 404). Children in
+ * `browser_task_action_log`, `browser_task_clarifications`, and
+ * `browser_task_final_confirm_tokens` go with the parent via the
+ * ON DELETE CASCADE FK declared in `schema.ts`.
+ *
+ * Non-terminal rows are NEVER deleted (the boot-recovery sweep is the
+ * sole path that mutates them after their owner's daemon-restart).
+ * `finished_at` is the lifetime anchor — for the few terminal
+ * transitions where the runner failed to set it (defensive), we fall
+ * back to `created_at` to avoid stranding rows.
+ */
+export declare function deleteTerminalBrowserTasksOlderThan(db: Database.Database, cutoffMs: number): number;

package/dist/db/browser-task-store.js

@@ -0,0 +1,250 @@
+/**
+ * Browser-task row store — BROWSER_TASK_REDESIGN_PLAN.md §6.4.
+ *
+ * I/O-bound CRUD over `browser_task`. The state machine itself (§4) is
+ * enforced at this layer via the CHECK constraint on the `state` column
+ * (closed set) plus the per-transition helpers below — `markRunning`,
+ * `markAwaitingUser`, `markFinalConfirm`, `markCompleted`,
+ * `markTerminal` — each one's WHERE clause refuses an out-of-order
+ * write so a race between two writers cannot flip a row backwards.
+ *
+ * Pure decision logic (state-machine guards, queue arithmetic) lives in
+ * `services/browser-task/browser-task-slots.ts` and is the 100%-covered
+ * surface; this module is the SQL wrapper and is excluded from the
+ * coverage gate (same posture as `browser-automation-purchase-tokens-store.ts`).
+ */
+export const BROWSER_TASK_TERMINAL_STATES = new Set(["completed", "failed", "timeout", "cancelled", "abandoned"]);
+export const BROWSER_TASK_NON_TERMINAL_STATES = new Set(["pending", "running", "awaiting_user", "final_confirm"]);
+function fromDbRow(row) {
+    let hosts = [];
+    if (row.extra_allowed_hosts_json) {
+        try {
+            const parsed = JSON.parse(row.extra_allowed_hosts_json);
+            hosts = Array.isArray(parsed)
+                ? parsed.filter((v) => typeof v === "string")
+                : [];
+        }
+        catch {
+            hosts = [];
+        }
+    }
+    return {
+        id: row.id,
+        description: row.description,
+        siteKey: row.site_key,
+        extraAllowedHosts: hosts,
+        originatingChannel: row.originating_channel,
+        scheduleRowId: row.schedule_row_id,
+        requireFinalConfirm: row.require_final_confirm === 1,
+        state: row.state,
+        outcomeDetail: row.outcome_detail,
+        report: row.report,
+        effectiveAllowlistRegex: row.effective_allowlist_regex,
+        blockedRequestsCount: row.blocked_requests_count,
+        extractCharsTotal: row.extract_chars_total,
+        createdAt: row.created_at,
+        startedAt: row.started_at,
+        finishedAt: row.finished_at,
+    };
+}
+/** Insert a fresh row in state=pending. The slot manager promotes it
+ *  to `running` once a slot frees. */
+export function createBrowserTask(db, input) {
+    db.prepare(`INSERT INTO browser_task
+       (id, description, site_key, extra_allowed_hosts_json,
+        originating_channel, schedule_row_id, require_final_confirm,
+        state, outcome_detail, report, effective_allowlist_regex,
+        blocked_requests_count, extract_chars_total,
+        created_at, started_at, finished_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', NULL, NULL, ?, 0, 0, ?, NULL, NULL)`).run(input.id, input.description, input.siteKey, JSON.stringify([...input.extraAllowedHosts]), input.originatingChannel, input.scheduleRowId, input.requireFinalConfirm ? 1 : 0, input.effectiveAllowlistRegex, input.createdAt);
+    const row = getBrowserTask(db, input.id);
+    if (!row) {
+        throw new Error(`createBrowserTask: post-insert row for ${input.id} missing`);
+    }
+    return row;
+}
+export function getBrowserTask(db, id) {
+    const row = db
+        .prepare(`SELECT id, description, site_key, extra_allowed_hosts_json,
+              originating_channel, schedule_row_id, require_final_confirm,
+              state, outcome_detail, report, effective_allowlist_regex,
+              blocked_requests_count, extract_chars_total,
+              created_at, started_at, finished_at
+         FROM browser_task
+        WHERE id = ?`)
+        .get(id);
+    return row ? fromDbRow(row) : null;
+}
+export function listBrowserTasks(db, options = {}) {
+    const { states, siteKey, limit = 50, offset = 0 } = options;
+    const where = [];
+    const params = [];
+    if (states && states.length > 0) {
+        where.push(`state IN (${states.map(() => "?").join(", ")})`);
+        params.push(...states);
+    }
+    if (siteKey !== undefined) {
+        if (siteKey === null) {
+            where.push("site_key IS NULL");
+        }
+        else {
+            where.push("site_key = ?");
+            params.push(siteKey);
+        }
+    }
+    const sql = `SELECT id, description, site_key, extra_allowed_hosts_json,
+                      originating_channel, schedule_row_id, require_final_confirm,
+                      state, outcome_detail, report, effective_allowlist_regex,
+                      blocked_requests_count, extract_chars_total,
+                      created_at, started_at, finished_at
+                 FROM browser_task
+               ${where.length ? `WHERE ${where.join(" AND ")}` : ""}
+               ORDER BY created_at DESC
+               LIMIT ? OFFSET ?`;
+    params.push(limit, offset);
+    const rows = db
+        .prepare(sql)
+        .all(...params);
+    return rows.map(fromDbRow);
+}
+export function countBrowserTasks(db, options = {}) {
+    const { states, siteKey } = options;
+    const where = [];
+    const params = [];
+    if (states && states.length > 0) {
+        where.push(`state IN (${states.map(() => "?").join(", ")})`);
+        params.push(...states);
+    }
+    if (siteKey !== undefined) {
+        if (siteKey === null) {
+            where.push("site_key IS NULL");
+        }
+        else {
+            where.push("site_key = ?");
+            params.push(siteKey);
+        }
+    }
+    const sql = `SELECT COUNT(*) AS c
+                 FROM browser_task
+               ${where.length ? `WHERE ${where.join(" AND ")}` : ""}`;
+    const row = db.prepare(sql).get(...params);
+    return row?.c ?? 0;
+}
+/** Pending → running. CAS on prior state so a concurrent terminal
+ *  transition (cancel-while-pending → cancelled) does not get clobbered.
+ *  Returns the new row or null on CAS miss. */
+export function markRunning(db, id, startedAt) {
+    const result = db
+        .prepare(`UPDATE browser_task
+          SET state = 'running', started_at = ?
+        WHERE id = ? AND state = 'pending'`)
+        .run(startedAt, id);
+    return result.changes > 0 ? getBrowserTask(db, id) : null;
+}
+/** Running → awaiting_user. Slot stays held; resume via /clarify. */
+export function markAwaitingUser(db, id) {
+    const result = db
+        .prepare(`UPDATE browser_task
+          SET state = 'awaiting_user'
+        WHERE id = ? AND state = 'running'`)
+        .run(id);
+    return result.changes > 0 ? getBrowserTask(db, id) : null;
+}
+/** Running → final_confirm. Slot stays held; resume via token. */
+export function markFinalConfirm(db, id) {
+    const result = db
+        .prepare(`UPDATE browser_task
+          SET state = 'final_confirm'
+        WHERE id = ? AND state = 'running'`)
+        .run(id);
+    return result.changes > 0 ? getBrowserTask(db, id) : null;
+}
+/** Parked state → running. Used by /clarify resume and token-consume
+ *  resume. Either parked state is acceptable. */
+export function markRunningFromParked(db, id) {
+    const result = db
+        .prepare(`UPDATE browser_task
+          SET state = 'running'
+        WHERE id = ? AND state IN ('awaiting_user', 'final_confirm')`)
+        .run(id);
+    return result.changes > 0 ? getBrowserTask(db, id) : null;
+}
+/** Any non-terminal state → terminal. Idempotent — re-running on an
+ *  already-terminal row CAS-misses and returns null. */
+export function markTerminal(db, input) {
+    const result = db
+        .prepare(`UPDATE browser_task
+          SET state = ?,
+              outcome_detail = ?,
+              report = COALESCE(?, report),
+              finished_at = ?
+        WHERE id = ?
+          AND state IN ('pending', 'running', 'awaiting_user', 'final_confirm')`)
+        .run(input.state, input.outcomeDetail, input.report, input.finishedAt, input.id);
+    return result.changes > 0 ? getBrowserTask(db, input.id) : null;
+}
+/** Increment the per-task CDP-blocked counter. Atomic. */
+export function incrementBlockedRequests(db, id, by) {
+    db.prepare(`UPDATE browser_task
+        SET blocked_requests_count = blocked_requests_count + ?
+      WHERE id = ?`).run(by, id);
+}
+/** Increment the per-task cumulative untrusted-content counter. */
+export function incrementExtractChars(db, id, by) {
+    db.prepare(`UPDATE browser_task
+        SET extract_chars_total = extract_chars_total + ?
+      WHERE id = ?`).run(by, id);
+}
+/**
+ * §6.5 boot-recovery sweep — flip every non-terminal row to
+ * (failed, 'daemon_restarted', finishedAt) on boot, before the
+ * dispatcher starts consuming events.
+ *
+ * Pure SQL UPDATE; returns the affected row count and the ids that
+ * were flipped so the caller can fan out one DM per row to the
+ * persisted `originating_channel`.
+ */
+export function sweepNonTerminalRowsForBootRecovery(db, nowMs) {
+    const txn = db.transaction(() => {
+        const rows = db
+            .prepare(`SELECT id, originating_channel
+           FROM browser_task
+          WHERE state IN ('pending', 'running', 'awaiting_user', 'final_confirm')`)
+            .all();
+        if (rows.length === 0)
+            return [];
+        db.prepare(`UPDATE browser_task
+          SET state = 'failed',
+              outcome_detail = 'daemon_restarted',
+              finished_at = ?
+        WHERE state IN ('pending', 'running', 'awaiting_user', 'final_confirm')`).run(nowMs);
+        return rows.map((r) => ({
+            id: r.id,
+            originatingChannel: r.originating_channel,
+        }));
+    });
+    return txn();
+}
+/**
+ * Retention prune for terminal `browser_task` rows older than `cutoffMs`
+ * (BROWSER_TASK_REDESIGN_PLAN.md §6.5 deferred follow-up + §14.7 — the
+ * trace-store window is 30 days; the SQL row lifetime matches so the
+ * dashboard never renders a row whose screenshots are 404). Children in
+ * `browser_task_action_log`, `browser_task_clarifications`, and
+ * `browser_task_final_confirm_tokens` go with the parent via the
+ * ON DELETE CASCADE FK declared in `schema.ts`.
+ *
+ * Non-terminal rows are NEVER deleted (the boot-recovery sweep is the
+ * sole path that mutates them after their owner's daemon-restart).
+ * `finished_at` is the lifetime anchor — for the few terminal
+ * transitions where the runner failed to set it (defensive), we fall
+ * back to `created_at` to avoid stranding rows.
+ */
+export function deleteTerminalBrowserTasksOlderThan(db, cutoffMs) {
+    const result = db
+        .prepare(`DELETE FROM browser_task
+        WHERE state IN ('completed', 'failed', 'timeout', 'cancelled', 'abandoned')
+          AND COALESCE(finished_at, created_at) < ?`)
+        .run(cutoffMs);
+    return result.changes;
+}

package/dist/db/client.d.ts

@@ -3,4 +3,3 @@ import type { AgentConfig } from "../config.js";
 export declare function createDatabase(config: AgentConfig): Database.Database;
 /** Create an in-memory database for testing */
 export declare function createTestDatabase(): Database.Database;
-//# sourceMappingURL=client.d.ts.map

package/dist/db/client.js

@@ -44,4 +44,3 @@ export function createTestDatabase() {
     db.pragma("foreign_keys = ON");
     return db;
 }
-//# sourceMappingURL=client.js.map

package/dist/db/entities-store.d.ts

@@ -3,7 +3,7 @@ import { type Domain, type EntityType } from "@aitne/shared";
 /**
  * Public entity DTO. `sources` is the parsed `frontmatter.sources` map
  * — keys are user-typed app labels, matching the `App` column in
- * `rules/management.md`. The route layer serializes this directly.
+ * `policies/management.md`. The route layer serializes this directly.
  */
 export interface EntityRecord {
     path: string;
@@ -89,4 +89,3 @@ export declare function resolveDomainType(domain: string, typePluralOrSingular:
     domain: Domain;
     type: EntityType;
 } | null;
-//# sourceMappingURL=entities-store.d.ts.map

package/dist/db/entities-store.js

@@ -177,4 +177,3 @@ function escapeLike(value) {
     // metacharacters keeps the API contract simple.
     return value.replace(/[\\%_]/g, "");
 }
-//# sourceMappingURL=entities-store.js.map

package/dist/db/hourly-check-signals.d.ts

@@ -75,4 +75,3 @@ export interface ComputeHourlyCheckSignalsOptions {
     agentTimezone?: string;
 }
 export declare function computeHourlyCheckSignals(db: Database.Database, options?: ComputeHourlyCheckSignalsOptions): HourlyCheckSignals;
-//# sourceMappingURL=hourly-check-signals.d.ts.map

package/dist/db/hourly-check-signals.js

@@ -372,4 +372,3 @@ function parseSqliteUtc(value) {
     const ts = Date.parse(iso);
     return Number.isFinite(ts) ? ts : null;
 }
-//# sourceMappingURL=hourly-check-signals.js.map

package/dist/db/integration-probe-store.d.ts

@@ -24,4 +24,3 @@ export declare function probeKey(integration: IntegrationKey, backend: BackendId
  * live probe (dashboard button) re-populates the cache.
  */
 export declare function deleteProbesForIntegration(db: Database.Database, integration: IntegrationKey): number;
-//# sourceMappingURL=integration-probe-store.d.ts.map

package/dist/db/integration-probe-store.js

@@ -72,4 +72,3 @@ export function deleteProbesForIntegration(db, integration) {
         .run(integration);
     return result.changes;
 }
-//# sourceMappingURL=integration-probe-store.js.map

package/dist/db/integrations-store.d.ts

@@ -16,4 +16,3 @@ export declare function writeIntegrations(db: Database.Database, update: Partial
 export declare function updateIntegrationState(db: Database.Database, key: IntegrationKey, next: Omit<IntegrationState, "lastChangedAt"> & {
     lastChangedAt?: string;
 }): IntegrationsRecord;
-//# sourceMappingURL=integrations-store.d.ts.map

package/dist/db/integrations-store.js

@@ -82,4 +82,3 @@ export function updateIntegrationState(db, key, next) {
     };
     return writeIntegrations(db, { [key]: stamped });
 }
-//# sourceMappingURL=integrations-store.js.map

package/dist/db/managed-chromium-sites-store.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Per-site authenticated-session state store for Instance A
+ * (Phase B-2.5).
+ *
+ * MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §16.7.
+ *
+ * Two `runtime_state` keys per site:
+ *   - `managed_chromium.sites.<siteKey>`            — persistent connection
+ *     record. Created by the bootstrap finalize path; read by the
+ *     workflow runner to decide `site_not_connected` vs proceed.
+ *   - `managed_chromium.site_bootstrap.<siteKey>`   — transient sign-in
+ *     handle. Created when the user clicks "Connect <site>"; cleared
+ *     by finalize / disconnect / orphan-reap.
+ *
+ * No new tables. The §16.7 doc commits explicitly to "All B-2.5 state
+ * fits in runtime_state".
+ */
+import type Database from "better-sqlite3";
+import { z } from "zod";
+export declare function siteConnectionKey(siteKey: string): string;
+export declare function siteBootstrapKey(siteKey: string): string;
+/**
+ * Persistent per-site connection record. Created by the bootstrap
+ * finalize path; cleared by disconnect. The `lastWorkflowAt` tick is
+ * advanced by the workflow runner on every successful auth-variant run
+ * so the compromise-detection §16.6 filesystem watcher has a
+ * cross-check timestamp.
+ */
+export interface SiteConnection {
+    /** Schema version for forward-compat. */
+    schemaVersion: 1;
+    /** Epoch ms of the bootstrap finalize. Drives the
+     *  `sessionMaxAgeDays` freshness floor in the workflow runner. */
+    connectedAt: number;
+    /** Display label captured from the signed-in page (e.g., "Hello,
+     *  Alice" → "Alice"). Optional — some sites do not expose a
+     *  readable identifier in the public DOM, and the dashboard
+     *  surfaces just "Connected" in that case. */
+    accountLabel: string | null;
+    /** Epoch ms of the most recent successful auth-variant workflow
+     *  run for this site. Null until the first successful run. */
+    lastWorkflowAt: number | null;
+}
+/** Transient bootstrap state — UI Chromium running interactively. */
+export interface SiteBootstrap {
+    /** PID of the UI Chromium spawned for sign-in. */
+    pid: number;
+    /** Epoch ms past which the reaper SIGKILLs the orphan PID. */
+    deadlineAt: number;
+    /** True when this bootstrap is a reauth (reuses the existing
+     *  profile dir, may auto-sign-in via persistent cookies). */
+    reauth: boolean;
+    /** Kernel-assigned loopback port the UI Chromium's CDP listens on.
+     *  The status probe and the finalize check connect to this port via
+     *  Playwright `connectOverCDP` to verify the per-site
+     *  `signedInSelector` resolves. Loopback-only by Chromium's CDP
+     *  default; the per-cycle launcher pins `--remote-debugging-address=
+     *  127.0.0.1` (defence-in-depth, see `INSTANCE_A_SHARED_FLAGS`). */
+    cdpPort: number;
+}
+/**
+ * Read the persistent connection record for `siteKey`. Returns null
+ * when the row is absent or fails schema validation — a corrupt row is
+ * treated as "never connected" so the runner reports
+ * `site_not_connected` and the dashboard prompts a fresh sign-in. The
+ * profile dir is unaffected by the read; only the metadata row is
+ * discarded.
+ */
+export declare function readSiteConnection(db: Database.Database, siteKey: string): SiteConnection | null;
+export declare function writeSiteConnection(db: Database.Database, siteKey: string, value: SiteConnection): void;
+export declare function clearSiteConnection(db: Database.Database, siteKey: string): void;
+/**
+ * Atomic read-modify-write helper used by the runner to advance
+ * `lastWorkflowAt`. Caller's mutator receives a shallow copy and
+ * returns the new value (or void to mutate in place). Writes the
+ * result through the schema so an accidentally-out-of-shape update
+ * fails fast in tests.
+ */
+export declare function updateSiteConnection(db: Database.Database, siteKey: string, mutate: (current: SiteConnection) => SiteConnection | void): SiteConnection | null;
+export declare function readSiteBootstrap(db: Database.Database, siteKey: string): SiteBootstrap | null;
+export declare function writeSiteBootstrap(db: Database.Database, siteKey: string, value: SiteBootstrap): void;
+export declare function clearSiteBootstrap(db: Database.Database, siteKey: string): void;
+/**
+ * Enumerate every persisted (connection row, siteKey) pair. Used by
+ * the supervisor's orphan reaper to sweep stale bootstrap PIDs across
+ * every connected site without needing a registry import (the reaper
+ * cleans up whatever rows happen to exist, including rows for sites
+ * that were removed from the registry in a later release).
+ *
+ * Returns rows in alphabetical site-key order so output is stable for
+ * tests and audit logs.
+ */
+export declare function listSiteConnectionKeys(db: Database.Database): string[];
+export declare function listSiteBootstrapKeys(db: Database.Database): string[];
+export declare const __testing: {
+    siteConnectionSchema: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        connectedAt: z.ZodNumber;
+        accountLabel: z.ZodNullable<z.ZodString>;
+        lastWorkflowAt: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strip>;
+    siteBootstrapSchema: z.ZodObject<{
+        pid: z.ZodNumber;
+        deadlineAt: z.ZodNumber;
+        reauth: z.ZodBoolean;
+        cdpPort: z.ZodNumber;
+    }, z.core.$strip>;
+    SITES_KEY_PREFIX: string;
+    SITE_BOOTSTRAP_KEY_PREFIX: string;
+};