@astrosheep/keiyaku 1.0.0 → 1.0.2

package/build/core/projection-generation-store.js

@@ -0,0 +1,707 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { GENERATION_VERDICT_STATES, } from "./projection-life-protocol.js";
+import { parseExecutionPact, } from "./execution-pact.js";
+import { configureHeartBusyTimeout } from "./projection/heart.js";
+export { GENERATION_VERDICT_STATES };
+export const PROJECTION_GENERATION_STORE_FILE = "heart";
+export const PROJECTION_GENERATION_SCHEMA_VERSION = 1;
+const SCHEMA_TABLE_SQL = `
+  CREATE TABLE generation_schema (
+    singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+    version INTEGER NOT NULL CHECK (version = ${PROJECTION_GENERATION_SCHEMA_VERSION})
+  ) STRICT
+`;
+const RECORD_TABLE_SQL = `
+  CREATE TABLE generation_records (
+    seq INTEGER PRIMARY KEY CHECK (seq > 0),
+    kind TEXT NOT NULL CHECK (kind IN ('launch', 'adoption', 'verdict')),
+    execution_id TEXT NOT NULL CHECK (length(trim(execution_id)) > 0),
+    facts_json TEXT NOT NULL CHECK (json_valid(facts_json))
+  ) STRICT
+`;
+const IDENTITY_TABLE_SQL = `
+  CREATE TABLE projection_identity (
+    singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+    version INTEGER NOT NULL CHECK (version = 1),
+    pid INTEGER NOT NULL CHECK (pid >= 0),
+    akuma TEXT NOT NULL CHECK (length(trim(akuma)) > 0),
+    provider TEXT NOT NULL CHECK (length(trim(provider)) > 0),
+    authority_json TEXT NOT NULL CHECK (json_valid(authority_json)),
+    binding_json TEXT NOT NULL CHECK (json_valid(binding_json)),
+    minted_at TEXT NOT NULL CHECK (length(trim(minted_at)) > 0),
+    workspace_root TEXT NOT NULL CHECK (length(trim(workspace_root)) > 0),
+    effective_policy_json TEXT CHECK (
+      effective_policy_json IS NULL OR json_valid(effective_policy_json)
+    )
+  ) STRICT
+`;
+const TELL_TABLE_SQL = `
+  CREATE TABLE projection_tells (
+    tell_id TEXT PRIMARY KEY CHECK (length(trim(tell_id)) > 0),
+    text TEXT NOT NULL,
+    created_at TEXT NOT NULL CHECK (length(trim(created_at)) > 0),
+    effort TEXT CHECK (effort IS NULL OR length(trim(effort)) > 0),
+    state TEXT NOT NULL CHECK (
+      state IN ('inbox', 'inflight', 'submitted', 'consumed', 'delivered')
+    ),
+    execution_id TEXT CHECK (
+      execution_id IS NULL OR length(trim(execution_id)) > 0
+    ),
+    fence_json TEXT CHECK (fence_json IS NULL OR json_valid(fence_json)),
+    replayed_from_json TEXT CHECK (
+      replayed_from_json IS NULL OR json_valid(replayed_from_json)
+    ),
+    delivered_at TEXT CHECK (
+      delivered_at IS NULL OR length(trim(delivered_at)) > 0
+    )
+  ) STRICT
+`;
+const VERDICTS = new Set(GENERATION_VERDICT_STATES);
+export class ProjectionGenerationStoreError extends Error {
+    code = "PROJECTION_GENERATION_STORE_ERROR";
+    constructor(message, options) {
+        super(message, options);
+        this.name = "ProjectionGenerationStoreError";
+    }
+}
+function isPlainObject(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+function assertJsonValue(value, location, ancestors) {
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return;
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            throw new ProjectionGenerationStoreError(`${location} contains a non-finite number`);
+        return;
+    }
+    if (typeof value !== "object") {
+        throw new ProjectionGenerationStoreError(`${location} contains a non-JSON value`);
+    }
+    if (ancestors.has(value))
+        throw new ProjectionGenerationStoreError(`${location} contains a cycle`);
+    ancestors.add(value);
+    try {
+        if (Array.isArray(value)) {
+            value.forEach((item, index) => assertJsonValue(item, `${location}[${index}]`, ancestors));
+            return;
+        }
+        if (!isPlainObject(value))
+            throw new ProjectionGenerationStoreError(`${location} must contain only plain JSON objects`);
+        for (const [key, item] of Object.entries(value)) {
+            assertJsonValue(item, `${location}.${key}`, ancestors);
+        }
+    }
+    finally {
+        ancestors.delete(value);
+    }
+}
+function cloneFacts(value, location) {
+    if (!isPlainObject(value))
+        throw new ProjectionGenerationStoreError(`${location} must be a JSON object`);
+    assertJsonValue(value, location, new Set());
+    return JSON.parse(JSON.stringify(value));
+}
+function assertExecutionId(executionId) {
+    if (typeof executionId !== "string" || executionId.trim() === "") {
+        throw new ProjectionGenerationStoreError("executionId must be a non-blank string");
+    }
+    return executionId;
+}
+function assertNonNegativeSafeInteger(value, location) {
+    if (!Number.isSafeInteger(value) || value < 0) {
+        throw new ProjectionGenerationStoreError(`${location} must be a non-negative safe integer`);
+    }
+    return value;
+}
+function assertPositiveSafeInteger(value, location) {
+    if (!Number.isSafeInteger(value) || value <= 0) {
+        throw new ProjectionGenerationStoreError(`${location} must be a positive safe integer`);
+    }
+    return value;
+}
+function assertIsoTimestamp(value, location) {
+    if (typeof value !== "string" || value.trim() === "") {
+        throw new ProjectionGenerationStoreError(`${location} must be an ISO-8601 timestamp`);
+    }
+    const milliseconds = Date.parse(value);
+    if (!Number.isFinite(milliseconds) || new Date(milliseconds).toISOString() !== value) {
+        throw new ProjectionGenerationStoreError(`${location} must be a canonical ISO-8601 timestamp`);
+    }
+    return value;
+}
+function validateTellFence(value, location) {
+    if (!Array.isArray(value))
+        throw new ProjectionGenerationStoreError(`${location} must be an array`);
+    const seen = new Set();
+    return value.map((tellId, index) => {
+        if (typeof tellId !== "string" || tellId.trim() === "") {
+            throw new ProjectionGenerationStoreError(`${location}[${index}] must be a non-blank string`);
+        }
+        if (seen.has(tellId))
+            throw new ProjectionGenerationStoreError(`${location} contains duplicate tell '${tellId}'`);
+        seen.add(tellId);
+        return tellId;
+    });
+}
+function validateLaunchFacts(value, location) {
+    const facts = cloneFacts(value, location);
+    facts.createdAt = assertIsoTimestamp(facts.createdAt, `${location}.createdAt`);
+    if (facts.tellFence !== undefined)
+        facts.tellFence = validateTellFence(facts.tellFence, `${location}.tellFence`);
+    if ("state" in facts)
+        throw new ProjectionGenerationStoreError(`${location}.state is reserved for verdict records`);
+    return facts;
+}
+function validateAdoptionFacts(value, location) {
+    const facts = cloneFacts(value, location);
+    if ("state" in facts)
+        throw new ProjectionGenerationStoreError(`${location}.state is reserved for verdict records`);
+    return facts;
+}
+function validateVerdictFacts(value, location) {
+    const facts = cloneFacts(value, location);
+    if (typeof facts.state !== "string" || !VERDICTS.has(facts.state)) {
+        throw new ProjectionGenerationStoreError(`${location}.state is not in the closed verdict vocabulary`);
+    }
+    return facts;
+}
+function parseStoredRow(row) {
+    const seq = typeof row.seq === "bigint" ? Number(row.seq) : row.seq;
+    if (!Number.isSafeInteger(seq) || seq <= 0) {
+        throw new ProjectionGenerationStoreError(`generation row has invalid seq '${String(row.seq)}'`);
+    }
+    if (row.kind !== "launch" && row.kind !== "adoption" && row.kind !== "verdict") {
+        throw new ProjectionGenerationStoreError(`generation row ${seq} has unknown kind '${row.kind}'`);
+    }
+    const executionId = assertExecutionId(row.execution_id);
+    let decoded;
+    try {
+        decoded = JSON.parse(row.facts_json);
+    }
+    catch (error) {
+        throw new ProjectionGenerationStoreError(`generation row ${seq} contains malformed facts JSON`, { cause: error });
+    }
+    const location = `generation row ${seq} facts`;
+    const facts = row.kind === "launch"
+        ? validateLaunchFacts(decoded, location)
+        : row.kind === "adoption"
+            ? validateAdoptionFacts(decoded, location)
+            : validateVerdictFacts(decoded, location);
+    return { seq, kind: row.kind, executionId, facts };
+}
+function validateHistory(records) {
+    let current = null;
+    const launchIds = new Set();
+    for (let index = 0; index < records.length; index += 1) {
+        const record = records[index];
+        const expectedSeq = index + 1;
+        if (record.seq !== expectedSeq) {
+            throw new ProjectionGenerationStoreError(`generation history is not dense: expected seq ${expectedSeq}, found ${record.seq}`);
+        }
+        if (record.kind === "launch") {
+            if (current && !current.verdict) {
+                throw new ProjectionGenerationStoreError(`generation row ${record.seq} launches before execution '${current.launch.executionId}' is terminal`);
+            }
+            if (launchIds.has(record.executionId)) {
+                throw new ProjectionGenerationStoreError(`generation row ${record.seq} reuses executionId '${record.executionId}'`);
+            }
+            launchIds.add(record.executionId);
+            current = {
+                launch: record,
+            };
+            continue;
+        }
+        if (!current)
+            throw new ProjectionGenerationStoreError(`generation row ${record.seq} appears before any launch`);
+        if (record.executionId !== current.launch.executionId) {
+            throw new ProjectionGenerationStoreError(`generation row ${record.seq} does not join the current launch`);
+        }
+        if (record.kind === "adoption") {
+            if (current.adoption)
+                throw new ProjectionGenerationStoreError(`generation row ${record.seq} duplicates adoption`);
+            if (current.verdict)
+                throw new ProjectionGenerationStoreError(`generation row ${record.seq} adopts a terminal execution`);
+            current.adoption = record;
+            continue;
+        }
+        if (current.verdict)
+            throw new ProjectionGenerationStoreError(`generation row ${record.seq} duplicates verdict`);
+        current.verdict = record;
+    }
+    return current;
+}
+function pragmaNumber(database, pragma) {
+    const row = database.prepare(`PRAGMA ${pragma}`).get();
+    const value = row ? Object.values(row)[0] : undefined;
+    if (typeof value !== "number" && typeof value !== "bigint") {
+        throw new ProjectionGenerationStoreError(`PRAGMA ${pragma} returned an invalid value`);
+    }
+    return Number(value);
+}
+function rollbackQuietly(database) {
+    try {
+        database.exec("ROLLBACK");
+    }
+    catch {
+        // Preserve the transition or schema failure that caused the rollback.
+    }
+}
+export class ProjectionGenerationStore {
+    databasePath;
+    readOnly;
+    #database;
+    #closed = false;
+    constructor(databasePath, database, readOnly) {
+        this.databasePath = databasePath;
+        this.#database = database;
+        this.readOnly = readOnly;
+    }
+    static open(projectionDirectory) {
+        const stat = fs.statSync(projectionDirectory);
+        if (!stat.isDirectory())
+            throw new ProjectionGenerationStoreError("projection generation store parent must be a directory");
+        const databasePath = path.join(projectionDirectory, PROJECTION_GENERATION_STORE_FILE);
+        let database;
+        try {
+            database = new DatabaseSync(databasePath, {
+                enableForeignKeyConstraints: true,
+                enableDoubleQuotedStringLiterals: false,
+                allowExtension: false,
+            });
+            configureHeartBusyTimeout(database);
+            // Rollback journal keeps observers genuinely read-only. A read-only WAL
+            // connection creates/updates -wal and -shm coordination files, while
+            // immutable WAL reads can miss concurrently committed facts.
+            database.exec("PRAGMA journal_mode = DELETE");
+            database.exec("PRAGMA synchronous = FULL");
+            database.exec("PRAGMA foreign_keys = ON");
+            database.exec("PRAGMA trusted_schema = OFF");
+        }
+        catch (error) {
+            try {
+                database?.close();
+            }
+            catch { /* preserve the open/configuration failure */ }
+            throw new ProjectionGenerationStoreError(`cannot open projection generation store at ${databasePath}`, { cause: error });
+        }
+        const store = new ProjectionGenerationStore(databasePath, database, false);
+        try {
+            store.#initializeOrValidateSchema();
+            store.#readValidatedHistory();
+            return store;
+        }
+        catch (error) {
+            database.close();
+            if (error instanceof ProjectionGenerationStoreError)
+                throw error;
+            throw new ProjectionGenerationStoreError(`invalid projection generation store at ${databasePath}`, { cause: error });
+        }
+    }
+    static openReadOnly(projectionDirectory) {
+        const stat = fs.statSync(projectionDirectory);
+        if (!stat.isDirectory())
+            throw new ProjectionGenerationStoreError("projection generation store parent must be a directory");
+        const databasePath = path.join(projectionDirectory, PROJECTION_GENERATION_STORE_FILE);
+        try {
+            if (!fs.lstatSync(databasePath).isFile()) {
+                throw new ProjectionGenerationStoreError("projection generation store must be a regular file");
+            }
+        }
+        catch (error) {
+            if (error instanceof ProjectionGenerationStoreError)
+                throw error;
+            throw new ProjectionGenerationStoreError(`projection generation store does not exist at ${databasePath}`, { cause: error });
+        }
+        let database;
+        try {
+            database = new DatabaseSync(databasePath, {
+                readOnly: true,
+                enableDoubleQuotedStringLiterals: false,
+                allowExtension: false,
+            });
+            configureHeartBusyTimeout(database);
+            const store = new ProjectionGenerationStore(databasePath, database, true);
+            store.#validateSchemaShape();
+            store.#readValidatedHistory();
+            return store;
+        }
+        catch (error) {
+            try {
+                database?.close();
+            }
+            catch { /* preserve the read/open failure */ }
+            if (error instanceof ProjectionGenerationStoreError)
+                throw error;
+            throw new ProjectionGenerationStoreError(`cannot read projection generation store at ${databasePath}`, { cause: error });
+        }
+    }
+    close() {
+        if (this.#closed)
+            return;
+        this.#closed = true;
+        this.#database.close();
+    }
+    readRecords() {
+        this.#assertOpen();
+        return this.#readValidatedHistory().records;
+    }
+    readCurrentGeneration() {
+        this.#assertOpen();
+        return this.#readValidatedHistory().current;
+    }
+    initializeIdentity(identity) {
+        this.#assertOpen();
+        if (this.readOnly) {
+            throw new ProjectionGenerationStoreError("projection identity store is read-only");
+        }
+        const validated = parseExecutionPact(identity, `${this.databasePath}#projection_identity`);
+        this.#database.exec("BEGIN IMMEDIATE");
+        try {
+            const existing = this.#database.prepare("SELECT COUNT(*) AS count FROM projection_identity").get();
+            if (Number(existing?.count ?? 0) !== 0) {
+                throw new ProjectionGenerationStoreError("projection identity is already initialized");
+            }
+            this.#database.prepare(`
+        INSERT INTO projection_identity (
+          singleton,
+          version,
+          pid,
+          akuma,
+          provider,
+          authority_json,
+          binding_json,
+          minted_at,
+          workspace_root,
+          effective_policy_json
+        ) VALUES (1, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(validated.version, validated.pid, validated.akuma, validated.provider, JSON.stringify(validated.authority), JSON.stringify(validated.binding), validated.mintedAt, validated.workspaceRoot, validated.effectivePolicy === undefined
+                ? null
+                : JSON.stringify(validated.effectivePolicy));
+            this.#database.exec("COMMIT");
+        }
+        catch (error) {
+            rollbackQuietly(this.#database);
+            throw error;
+        }
+    }
+    readIdentity() {
+        this.#assertOpen();
+        const rows = this.#database.prepare(`
+      SELECT
+        version,
+        pid,
+        akuma,
+        provider,
+        authority_json,
+        binding_json,
+        minted_at,
+        workspace_root,
+        effective_policy_json
+      FROM projection_identity
+    `).all();
+        if (rows.length !== 1) {
+            throw new ProjectionGenerationStoreError(`projection identity row count must be 1, found ${rows.length}`);
+        }
+        const row = rows[0];
+        let authority;
+        let binding;
+        let effectivePolicy;
+        try {
+            authority = JSON.parse(row.authority_json);
+            binding = JSON.parse(row.binding_json);
+            effectivePolicy = row.effective_policy_json === null
+                ? undefined
+                : JSON.parse(row.effective_policy_json);
+        }
+        catch (error) {
+            throw new ProjectionGenerationStoreError("projection identity contains malformed JSON", {
+                cause: error,
+            });
+        }
+        return parseExecutionPact({
+            version: Number(row.version),
+            pid: Number(row.pid),
+            akuma: row.akuma,
+            provider: row.provider,
+            authority,
+            binding,
+            mintedAt: row.minted_at,
+            workspaceRoot: row.workspace_root,
+            ...(effectivePolicy === undefined ? {} : { effectivePolicy }),
+        }, `${this.databasePath}#projection_identity`);
+    }
+    launchIfSettled(input) {
+        const executionId = assertExecutionId(input.executionId);
+        const facts = validateLaunchFacts(input.facts, "launch facts");
+        return this.#writeTransition(() => {
+            const history = this.#readValidatedHistory();
+            if (history.records.some((record) => record.kind === "launch" && record.executionId === executionId)) {
+                return this.#rejected("execution-id-already-used", history.current);
+            }
+            if (history.current && !history.current.verdict) {
+                return this.#rejected("current-generation-open", history.current);
+            }
+            return this.#committed([this.#append("launch", executionId, facts, history.records.length + 1)]);
+        });
+    }
+    adoptionIfCurrent(input) {
+        const executionId = assertExecutionId(input.executionId);
+        const facts = validateAdoptionFacts(input.facts, "adoption facts");
+        return this.#writeTransition(() => {
+            const history = this.#readValidatedHistory();
+            const current = history.current;
+            if (!current)
+                return this.#rejected("no-current-launch", null);
+            if (current.launch.executionId !== executionId)
+                return this.#rejected("not-current", current);
+            if (current.verdict)
+                return this.#rejected("already-terminal", current);
+            if (current.adoption)
+                return this.#rejected("already-adopted", current);
+            return this.#committed([this.#append("adoption", executionId, facts, history.records.length + 1)]);
+        });
+    }
+    verdictIfOpen(input) {
+        const executionId = assertExecutionId(input.executionId);
+        if (!VERDICTS.has(input.verdict))
+            throw new ProjectionGenerationStoreError(`unknown verdict '${String(input.verdict)}'`);
+        const facts = validateVerdictFacts({ ...(input.facts ?? {}), state: input.verdict }, "verdict facts");
+        return this.#writeTransition(() => {
+            const history = this.#readValidatedHistory();
+            const current = history.current;
+            if (!current)
+                return this.#rejected("no-current-launch", null);
+            if (current.launch.executionId !== executionId)
+                return this.#rejected("not-current", current);
+            if (current.verdict)
+                return this.#rejected("already-terminal", current);
+            if (input.verdict === "launch-failed" && current.adoption) {
+                return this.#rejected("already-adopted", current);
+            }
+            return this.#committed([this.#append("verdict", executionId, facts, history.records.length + 1)]);
+        });
+    }
+    supersedeStartupTimeout(input) {
+        const executionId = assertExecutionId(input.executionId);
+        const successorExecutionId = assertExecutionId(input.successorExecutionId);
+        const observedAtMs = assertNonNegativeSafeInteger(input.observedAtMs, "observedAtMs");
+        const startupTimeoutMs = assertPositiveSafeInteger(input.startupTimeoutMs, "startupTimeoutMs");
+        const diagnostic = cloneFacts(input.diagnostic, "startup-timeout diagnostic");
+        const successorFacts = validateLaunchFacts(input.successorFacts, "successor launch facts");
+        return this.#writeTransition(() => {
+            const history = this.#readValidatedHistory();
+            const current = history.current;
+            if (!current)
+                return this.#rejected("no-current-launch", null);
+            if (current.launch.executionId !== executionId)
+                return this.#rejected("not-current", current);
+            if (current.verdict)
+                return this.#rejected("already-terminal", current);
+            if (current.adoption)
+                return this.#rejected("already-adopted", current);
+            if (history.records.some((record) => record.kind === "launch" && record.executionId === successorExecutionId)) {
+                return this.#rejected("execution-id-already-used", current);
+            }
+            const launchedAtMs = Date.parse(current.launch.facts.createdAt);
+            if (observedAtMs - launchedAtMs < startupTimeoutMs) {
+                return this.#rejected("startup-timeout-not-elapsed", current);
+            }
+            const verdictFacts = validateVerdictFacts({ ...diagnostic, state: "launch-failed" }, "startup-timeout verdict facts");
+            const firstSeq = history.records.length + 1;
+            return this.#committed([
+                this.#append("verdict", executionId, verdictFacts, firstSeq),
+                this.#append("launch", successorExecutionId, successorFacts, firstSeq + 1),
+            ]);
+        });
+    }
+    replaceDeadRunner(input) {
+        const executionId = assertExecutionId(input.executionId);
+        const successorExecutionId = assertExecutionId(input.successorExecutionId);
+        const releasedLockEvidence = cloneFacts(input.releasedLockEvidence, "released runner-lock evidence");
+        if (Object.keys(releasedLockEvidence).length === 0) {
+            throw new ProjectionGenerationStoreError("released runner-lock evidence must not be empty");
+        }
+        const successorFacts = validateLaunchFacts(input.successorFacts, "dead-runner successor launch facts");
+        return this.#writeTransition(() => {
+            const history = this.#readValidatedHistory();
+            const current = history.current;
+            if (!current)
+                return this.#rejected("no-current-launch", null);
+            if (current.launch.executionId !== executionId)
+                return this.#rejected("not-current", current);
+            if (current.verdict)
+                return this.#rejected("already-terminal", current);
+            if (!current.adoption)
+                return this.#rejected("not-adopted", current);
+            if (history.records.some((record) => record.kind === "launch" && record.executionId === successorExecutionId)) {
+                return this.#rejected("execution-id-already-used", current);
+            }
+            const verdictFacts = validateVerdictFacts({ state: "lost-runner", releasedLockEvidence }, "dead-runner verdict facts");
+            const firstSeq = history.records.length + 1;
+            return this.#committed([
+                this.#append("verdict", executionId, verdictFacts, firstSeq),
+                this.#append("launch", successorExecutionId, successorFacts, firstSeq + 1),
+            ]);
+        });
+    }
+    handoff(input) {
+        const executionId = assertExecutionId(input.executionId);
+        const successorExecutionId = assertExecutionId(input.successorExecutionId);
+        const completionFacts = cloneFacts(input.completionFacts, "handoff completion facts");
+        if ("state" in completionFacts)
+            throw new ProjectionGenerationStoreError("handoff completion facts.state is reserved");
+        const successorFactsBase = validateLaunchFacts(input.successorFacts, "handoff successor launch facts");
+        if (successorFactsBase.tellFence !== undefined) {
+            throw new ProjectionGenerationStoreError("handoff successor launch facts.tellFence must be supplied only through handoff.tellFence");
+        }
+        const tellFence = validateTellFence([...input.tellFence], "handoff tellFence");
+        const successorFacts = validateLaunchFacts({ ...successorFactsBase, tellFence }, "handoff successor launch facts");
+        return this.#writeTransition(() => {
+            const history = this.#readValidatedHistory();
+            const current = history.current;
+            if (!current)
+                return this.#rejected("no-current-launch", null);
+            if (current.launch.executionId !== executionId)
+                return this.#rejected("not-current", current);
+            if (current.verdict)
+                return this.#rejected("already-terminal", current);
+            if (!current.adoption)
+                return this.#rejected("not-adopted", current);
+            if (history.records.some((record) => record.kind === "launch" && record.executionId === successorExecutionId)) {
+                return this.#rejected("execution-id-already-used", current);
+            }
+            const verdictFacts = validateVerdictFacts({ ...completionFacts, state: "completed" }, "handoff verdict facts");
+            const firstSeq = history.records.length + 1;
+            return this.#committed([
+                this.#append("verdict", executionId, verdictFacts, firstSeq),
+                this.#append("launch", successorExecutionId, successorFacts, firstSeq + 1),
+            ]);
+        });
+    }
+    #initializeOrValidateSchema() {
+        this.#database.exec("BEGIN EXCLUSIVE");
+        try {
+            const version = pragmaNumber(this.#database, "user_version");
+            const objects = this.#database.prepare(`
+        SELECT name, type
+        FROM sqlite_schema
+        WHERE name NOT LIKE 'sqlite_%'
+        ORDER BY name
+      `).all();
+            if (version === 0 && objects.length === 0) {
+                this.#database.exec(SCHEMA_TABLE_SQL);
+                this.#database.exec(RECORD_TABLE_SQL);
+                this.#database.exec(IDENTITY_TABLE_SQL);
+                this.#database.exec(TELL_TABLE_SQL);
+                this.#database.prepare("INSERT INTO generation_schema (singleton, version) VALUES (1, ?)")
+                    .run(PROJECTION_GENERATION_SCHEMA_VERSION);
+                this.#database.exec(`PRAGMA user_version = ${PROJECTION_GENERATION_SCHEMA_VERSION}`);
+            }
+            else if (version !== PROJECTION_GENERATION_SCHEMA_VERSION) {
+                throw new ProjectionGenerationStoreError(`projection generation schema version ${version} is not supported; expected ${PROJECTION_GENERATION_SCHEMA_VERSION}`);
+            }
+            this.#validateSchemaShape();
+            this.#database.exec("COMMIT");
+        }
+        catch (error) {
+            rollbackQuietly(this.#database);
+            throw error;
+        }
+    }
+    #validateSchemaShape() {
+        const objects = this.#database.prepare(`
+      SELECT name, type
+      FROM sqlite_schema
+      WHERE name NOT LIKE 'sqlite_%'
+      ORDER BY name
+    `).all();
+        const signature = objects.map((object) => `${object.type}:${object.name}`).join(",");
+        if (signature !== "table:generation_records,table:generation_schema,table:projection_identity,table:projection_tells") {
+            throw new ProjectionGenerationStoreError(`projection generation schema contains unexpected objects: ${signature || "none"}`);
+        }
+        const metadata = this.#database.prepare("SELECT singleton, version FROM generation_schema").all();
+        if (metadata.length !== 1 || Number(metadata[0].singleton) !== 1 || Number(metadata[0].version) !== PROJECTION_GENERATION_SCHEMA_VERSION) {
+            throw new ProjectionGenerationStoreError("projection generation schema metadata is malformed");
+        }
+        const recordColumns = this.#database.prepare("PRAGMA table_info(generation_records)").all();
+        const columnSignature = recordColumns
+            .map((column) => `${column.name}:${column.type}:${Number(column.notnull)}:${Number(column.pk)}`)
+            .join(",");
+        if (columnSignature !== "seq:INTEGER:0:1,kind:TEXT:1:0,execution_id:TEXT:1:0,facts_json:TEXT:1:0") {
+            throw new ProjectionGenerationStoreError("projection generation record schema is malformed");
+        }
+        const identityColumns = this.#database.prepare("PRAGMA table_info(projection_identity)").all();
+        const identitySignature = identityColumns
+            .map((column) => `${column.name}:${column.type}:${Number(column.notnull)}:${Number(column.pk)}`)
+            .join(",");
+        if (identitySignature !== "singleton:INTEGER:0:1,version:INTEGER:1:0,pid:INTEGER:1:0,akuma:TEXT:1:0,provider:TEXT:1:0,authority_json:TEXT:1:0,binding_json:TEXT:1:0,minted_at:TEXT:1:0,workspace_root:TEXT:1:0,effective_policy_json:TEXT:0:0") {
+            throw new ProjectionGenerationStoreError("projection identity schema is malformed");
+        }
+        const tellColumns = this.#database.prepare("PRAGMA table_info(projection_tells)").all();
+        const tellSignature = tellColumns
+            .map((column) => `${column.name}:${column.type}:${Number(column.notnull)}:${Number(column.pk)}`)
+            .join(",");
+        if (tellSignature !== "tell_id:TEXT:1:1,text:TEXT:1:0,created_at:TEXT:1:0,effort:TEXT:0:0,state:TEXT:1:0,execution_id:TEXT:0:0,fence_json:TEXT:0:0,replayed_from_json:TEXT:0:0,delivered_at:TEXT:0:0") {
+            throw new ProjectionGenerationStoreError("projection tell schema is malformed");
+        }
+        const quickCheck = this.#database.prepare("PRAGMA quick_check").get();
+        if (!quickCheck || Object.values(quickCheck)[0] !== "ok") {
+            throw new ProjectionGenerationStoreError("projection generation database failed quick_check");
+        }
+    }
+    #readValidatedHistory() {
+        const rows = this.#database.prepare(`
+      SELECT seq, kind, execution_id, facts_json
+      FROM generation_records
+      ORDER BY seq
+    `).all();
+        const records = rows.map(parseStoredRow);
+        return { records, current: validateHistory(records) };
+    }
+    #writeTransition(run) {
+        this.#assertOpen();
+        if (this.readOnly) {
+            throw new ProjectionGenerationStoreError("projection generation store is read-only");
+        }
+        this.#database.exec("BEGIN IMMEDIATE");
+        try {
+            const result = run();
+            this.#database.exec("COMMIT");
+            return result;
+        }
+        catch (error) {
+            rollbackQuietly(this.#database);
+            throw error;
+        }
+    }
+    #append(kind, executionId, facts, seq) {
+        const encoded = JSON.stringify(facts);
+        this.#database.prepare(`
+      INSERT INTO generation_records (seq, kind, execution_id, facts_json)
+      VALUES (?, ?, ?, ?)
+    `).run(seq, kind, executionId, encoded);
+        return { seq, kind, executionId, facts: JSON.parse(encoded) };
+    }
+    #committed(records) {
+        return { status: "committed", records };
+    }
+    #rejected(reason, current) {
+        return { status: "rejected", reason, current };
+    }
+    #assertOpen() {
+        if (this.#closed)
+            throw new ProjectionGenerationStoreError("projection generation store is closed");
+    }
+}
+export function openProjectionGenerationStore(projectionDirectory) {
+    return ProjectionGenerationStore.open(projectionDirectory);
+}
+export function openProjectionGenerationStoreReadOnly(projectionDirectory) {
+    return ProjectionGenerationStore.openReadOnly(projectionDirectory);
+}