@claudexor/daemon 3.25.1 → 4.0.1

package/dist/store/sql-daemon-services.js

@@ -0,0 +1,124 @@
+import { InteractionRegistry } from "../interactions.js";
+import { LiveInputRegistry } from "../live-input.js";
+import { QuotaRegistry } from "../quota-registry.js";
+import { BlobFiles } from "./blob-files.js";
+import { SqlCommandPruner } from "./command-prune.js";
+import { readJournalEvents } from "./cursors.js";
+import { isServedPid } from "./generations.js";
+import { SqlInteractionStore } from "./interactions.js";
+import { MaintenanceController } from "./maintenance.js";
+import { Obligations } from "./obligations.js";
+import { partitionById } from "./partitions.js";
+import { SqlProjectStore } from "./projects.js";
+import { SqlPurgeFiles, partitionFilesHandler } from "./purge-files.js";
+import { SqlResourceStore } from "./resources.js";
+import { SqlCommandRouter } from "./sql-command-router.js";
+import { SqlTerminalFiles } from "./terminal-files.js";
+/** Builds one storage graph over an opened store. Global projections validate
+ * lazily, so a recovery-required registry cannot hide the recovery owners.
+ * Startup owns admission; this factory discovers no roots or second backend. */
+export function createSqlDaemonServices(store, options) {
+    const blobs = new BlobFiles(store);
+    let resources;
+    const obligations = new Obligations(store, {
+        log: options.log,
+        onCleared: (rows) => resources.onObligationsCleared(rows),
+    });
+    const terminalFiles = new SqlTerminalFiles(store, obligations);
+    const pruner = new SqlCommandPruner(store, blobs, { log: options.log });
+    const projects = new SqlProjectStore(store, blobs, obligations);
+    const threads = new SqlCommandRouter(projects, { obligations, terminalFiles, pruner });
+    let globalEvents = null;
+    resources = new SqlResourceStore(store, blobs, obligations, options.log);
+    const purgeFiles = new SqlPurgeFiles(store, obligations);
+    obligations.registerHandler("purge_fs", purgeFiles.handler(options.purgeFiles));
+    obligations.registerHandler("archive_fs", partitionFilesHandler(store));
+    obligations.registerHandler("quarantine_fs", partitionFilesHandler(store));
+    const maintenance = new MaintenanceController(store, {
+        ...options.maintenance,
+        log: options.log,
+        blobs,
+    });
+    const quotaFor = (events) => new QuotaRegistry(events, options.refreshers, store.now, options.subjects, options.pacerStore);
+    let quota = null;
+    const rebindGlobal = () => {
+        const generation = projects.global();
+        if (generation.pid === globalEvents?.generation.pid && quota)
+            return;
+        const nextEvents = threads.ledger(generation);
+        const nextQuota = quotaFor(nextEvents);
+        globalEvents = nextEvents;
+        quota = nextQuota;
+    };
+    const interactions = new InteractionRegistry({
+        forRequest: (params) => threads.interactionsForRequest(params),
+        forRun: (runId) => threads.interactionsForRun(runId),
+    });
+    const liveInputs = new LiveInputRegistry({
+        pendingForRun: (runId) => interactions.pendingForRun(runId),
+    });
+    return {
+        store,
+        blobs,
+        obligations,
+        terminalFiles,
+        pruner,
+        projects,
+        threads,
+        commands: threads,
+        get globalEvents() {
+            rebindGlobal();
+            return globalEvents;
+        },
+        resources,
+        purgeFiles,
+        maintenance,
+        get quota() {
+            rebindGlobal();
+            return quota;
+        },
+        interactions,
+        liveInputs,
+        /** Called by the existing global recovery replacement owner after it
+         * drains setup and changes the registry generation. Publish both owners
+         * together only after the new quota projection validates. */
+        rebindGlobal,
+        journalEvents: (partition, afterCursor) => readJournalEvents(store, partition, afterCursor, blobs),
+        async recoverAfterStartup() {
+            const effects = await obligations.completeOpen();
+            // Only generations with unfinished work need recovery. No reconstruction
+            // of every project's historical command store on restart.
+            const rows = store
+                .prepare(`SELECT DISTINCT pid FROM command WHERE live=1 AND state IN ('queued','running')
+        UNION SELECT DISTINCT pid FROM interaction WHERE state='pending'`)
+                .all();
+            for (const { pid } of rows) {
+                if (!isServedPid(store, pid))
+                    continue;
+                const generation = partitionById(store, pid);
+                threads.commandStore(generation).recoverAfterStartup();
+                new SqlInteractionStore(store, threads.ledger(generation)).recoverAfterStartup();
+            }
+            threads.recoverRunlessTurns();
+            rebindGlobal();
+            quota.recoverAfterStartup();
+            return effects;
+        },
+        /** Caller closes transports/runners first, then this graph, then its store. */
+        async close() {
+            await maintenance.stop();
+            try {
+                await store.flushed();
+            }
+            finally {
+                try {
+                    await resources.drainCleanup();
+                }
+                finally {
+                    obligations.close();
+                }
+            }
+        },
+    };
+}
+//# sourceMappingURL=sql-daemon-services.js.map

package/dist/store/sql-daemon-services.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-daemon-services.js","sourceRoot":"","sources":["../../src/store/sql-daemon-services.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIrD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAqC,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAyB,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAWvD;;gFAEgF;AAChF,MAAM,UAAU,uBAAuB,CAAC,KAAkB,EAAE,OAAiC;IAC3F,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,SAA2B,CAAC;IAChC,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,KAAK,EAAE;QACzC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,oBAAoB,CAAC,IAAI,CAAC;KAC1D,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,IAAI,gBAAgB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;IACvF,IAAI,YAAY,GAA0B,IAAI,CAAC;IAC/C,SAAS,GAAG,IAAI,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,IAAI,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACzD,WAAW,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAChF,WAAW,CAAC,eAAe,CAAC,YAAY,EAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,WAAW,CAAC,eAAe,CAAC,eAAe,EAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC,KAAK,EAAE;QACnD,GAAG,OAAO,CAAC,WAAW;QACtB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK;KACN,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,CAAC,MAAsB,EAAE,EAAE,CAC1C,IAAI,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACjG,IAAI,KAAK,GAAyB,IAAI,CAAC;IACvC,MAAM,YAAY,GAAG,GAAG,EAAE;QACxB,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,GAAG,KAAK,YAAY,EAAE,UAAU,CAAC,GAAG,IAAI,KAAK;YAAE,OAAO;QACrE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;QACvC,YAAY,GAAG,UAAU,CAAC;QAC1B,KAAK,GAAG,SAAS,CAAC;IACpB,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,mBAAmB,CAAC;QAC3C,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,MAAM,CAAC;QAC9D,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC;KACrD,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,iBAAiB,CAAC;QACvC,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC;KAC5D,CAAC,CAAC;IACH,OAAO;QACL,KAAK;QACL,KAAK;QACL,WAAW;QACX,aAAa;QACb,MAAM;QACN,QAAQ;QACR,OAAO;QACP,QAAQ,EAAE,OAAO;QACjB,IAAI,YAAY;YACd,YAAY,EAAE,CAAC;YACf,OAAO,YAAa,CAAC;QACvB,CAAC;QACD,SAAS;QACT,UAAU;QACV,WAAW;QACX,IAAI,KAAK;YACP,YAAY,EAAE,CAAC;YACf,OAAO,KAAM,CAAC;QAChB,CAAC;QACD,YAAY;QACZ,UAAU;QACV;;qEAE6D;QAC7D,YAAY;QACZ,aAAa,EAAE,CAAC,SAAiB,EAAE,WAAoB,EAAE,EAAE,CACzD,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC;QACzD,KAAK,CAAC,mBAAmB;YACvB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,YAAY,EAAE,CAAC;YACjD,yEAAyE;YACzE,0DAA0D;YAC1D,MAAM,IAAI,GAAG,KAAK;iBACf,OAAO,CACN;yEAC+D,CAChE;iBACA,GAAG,EAA4B,CAAC;YACnC,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;gBAC3B,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC;oBAAE,SAAS;gBACvC,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,GAAG,CAAE,CAAC;gBAC9C,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,mBAAmB,EAAE,CAAC;gBACvD,IAAI,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC;YACnF,CAAC;YACD,OAAO,CAAC,mBAAmB,EAAE,CAAC;YAC9B,YAAY,EAAE,CAAC;YACf,KAAM,CAAC,mBAAmB,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,+EAA+E;QAC/E,KAAK,CAAC,KAAK;YACT,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;YACxB,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC;oBACH,MAAM,SAAS,CAAC,YAAY,EAAE,CAAC;gBACjC,CAAC;wBAAS,CAAC;oBACT,WAAW,CAAC,KAAK,EAAE,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/store/sql-recovery-export.d.ts

@@ -0,0 +1,8 @@
+import type { ControlJournalExportReceipt } from "@claudexor/schema";
+import { type BlobFiles } from "./blob-files.js";
+import type { MaintenanceController } from "./maintenance.js";
+import type { EngineStore } from "./store.js";
+/** One snapshot bundle, not a second backup authority. Missing required bodies
+ * fail the export; concurrent GC never turns a partial copy into a receipt. */
+export declare function exportSqlRecovery(store: EngineStore, blobs: BlobFiles, maintenance: Pick<MaintenanceController, "exportTo">, partition: string): Promise<ControlJournalExportReceipt>;
+//# sourceMappingURL=sql-recovery-export.d.ts.map

package/dist/store/sql-recovery-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-recovery-export.d.ts","sourceRoot":"","sources":["../../src/store/sql-recovery-export.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAErE,OAAO,EAAwB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA4B9C;+EAC+E;AAC/E,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,SAAS,EAChB,WAAW,EAAE,IAAI,CAAC,qBAAqB,EAAE,UAAU,CAAC,EACpD,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,2BAA2B,CAAC,CA8EtC"}

package/dist/store/sql-recovery-export.js

@@ -0,0 +1,110 @@
+import { createHash, randomUUID } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { chmod, copyFile, mkdir, open, rm, stat } from "node:fs/promises";
+import { constants } from "node:fs";
+import { dirname, join } from "node:path";
+import { ControlJournalExportReceipt as Receipt } from "@claudexor/schema";
+import { BLOB_OWNER_PREDICATE } from "./blob-files.js";
+import { StoreError } from "./errors.js";
+import { partitionEvidence, partitionRecovery, recoveryGeneration, } from "./sql-recovery-inspection.js";
+async function digestFile(path) {
+    const hash = createHash("sha256");
+    for await (const bytes of createReadStream(path))
+        hash.update(bytes);
+    return hash.digest("hex");
+}
+async function syncFile(path, directory = false) {
+    try {
+        const fd = await open(path, directory ? "r" : "r+");
+        try {
+            await fd.sync();
+        }
+        finally {
+            await fd.close();
+        }
+    }
+    catch (error) {
+        // Directory durability has the existing platform limit; database/body
+        // file synchronization never takes this exception.
+        if (!directory || process.platform !== "win32")
+            throw error;
+    }
+}
+/** One snapshot bundle, not a second backup authority. Missing required bodies
+ * fail the export; concurrent GC never turns a partial copy into a receipt. */
+export async function exportSqlRecovery(store, blobs, maintenance, partition) {
+    const exportId = `journal-export-${store.now().getTime().toString(36)}-${randomUUID()}`;
+    const exportsRoot = join(dirname(store.paths.database), "recovery-exports");
+    await mkdir(exportsRoot, { recursive: true, mode: 0o700 });
+    const bundlePath = join(exportsRoot, exportId);
+    await mkdir(bundlePath, { mode: 0o700 });
+    const databasePath = join(bundlePath, "engine.sqlite");
+    try {
+        await maintenance.exportTo(databasePath);
+        // All evidence, including required body refs, belongs to this exact copy.
+        const db = new store.runtime.sqlite.DatabaseSync(databasePath, { readOnly: true });
+        let evidence;
+        let recovery;
+        let required;
+        try {
+            evidence = partitionEvidence(db, recoveryGeneration(db, partition));
+            recovery = partitionRecovery(db, evidence.generation);
+            required = db
+                .prepare(`SELECT sha256,size FROM blob WHERE inline IS NULL AND (${BLOB_OWNER_PREDICATE.replaceAll("?1", "blob.sha256")}) ORDER BY sha256`)
+                .all();
+        }
+        finally {
+            db.close();
+        }
+        const entries = [];
+        if (required.length)
+            await mkdir(join(bundlePath, "blobs"), { mode: 0o700 });
+        for (const body of required) {
+            const target = join(bundlePath, "blobs", body.sha256);
+            await copyFile(blobs.filePath(body.sha256), target, constants.COPYFILE_EXCL);
+            const bytes = (await stat(target)).size;
+            const sha256 = await digestFile(target);
+            if (bytes !== Number(body.size) || sha256 !== body.sha256)
+                throw new Error(`SQL body ${body.sha256} does not match its snapshot digest/size`);
+            await syncFile(target);
+            await chmod(target, 0o400);
+            entries.push({ path: `blobs/${body.sha256}`, sha256, bytes });
+        }
+        await syncFile(databasePath);
+        await chmod(databasePath, 0o400);
+        entries.unshift({
+            path: "engine.sqlite",
+            sha256: await digestFile(databasePath),
+            bytes: (await stat(databasePath)).size,
+        });
+        const createdAt = store.now().toISOString();
+        const manifest = Buffer.from(`${JSON.stringify({ schemaVersion: 1, exportId, partition, fingerprint: evidence.fingerprint, recovery, createdAt, scope: "whole_engine_store", storeId: evidence.storeId, generation: evidence.generation, counts: evidence.counts, entries, externalEvidence: "Upload .part files, legacy upload idempotency-key files not yet adopted into SQL, per-run event logs, run artifacts and setup operational artifacts remain in their existing locations and are not included." }, null, 2)}\n`);
+        const manifestPath = join(bundlePath, "manifest.json");
+        const fd = await open(manifestPath, "wx", 0o400);
+        try {
+            await fd.writeFile(manifest);
+            await fd.sync();
+        }
+        finally {
+            await fd.close();
+        }
+        if (required.length)
+            await syncFile(join(bundlePath, "blobs"), true);
+        await syncFile(bundlePath, true);
+        await syncFile(exportsRoot, true);
+        return Receipt.parse({
+            schemaVersion: 1,
+            exportId,
+            partition,
+            fingerprint: evidence.fingerprint,
+            bundlePath,
+            manifestSha256: createHash("sha256").update(manifest).digest("hex"),
+            createdAt,
+        });
+    }
+    catch (error) {
+        await rm(bundlePath, { recursive: true, force: true });
+        throw new StoreError("recovery_export_incomplete", 503, true, `SQL recovery export did not complete: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+//# sourceMappingURL=sql-recovery-export.js.map

package/dist/store/sql-recovery-export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-recovery-export.js","sourceRoot":"","sources":["../../src/store/sql-recovery-export.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,2BAA2B,IAAI,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAkB,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,8BAA8B,CAAC;AAEtC,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,SAAS,GAAG,KAAK;IACrD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAClB,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sEAAsE;QACtE,mDAAmD;QACnD,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,MAAM,KAAK,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;+EAC+E;AAC/E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAkB,EAClB,KAAgB,EAChB,WAAoD,EACpD,SAAiB;IAEjB,MAAM,QAAQ,GAAG,kBAAkB,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,UAAU,EAAE,EAAE,CAAC;IACxF,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC5E,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACzC,0EAA0E;QAC1E,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACnF,IAAI,QAAQ,CAAC;QACb,IAAI,QAAQ,CAAC;QACb,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,iBAAiB,CAAC,EAAE,EAAE,kBAAkB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;YACpE,QAAQ,GAAG,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;YACtD,QAAQ,GAAG,EAAE;iBACV,OAAO,CACN,0DAA0D,oBAAoB,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,mBAAmB,CAClI;iBACA,GAAG,EAAsD,CAAC;QAC/D,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;QACD,MAAM,OAAO,GAA2D,EAAE,CAAC;QAC3E,IAAI,QAAQ,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACtD,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;YAC7E,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,KAAK,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;gBACvD,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,MAAM,0CAA0C,CAAC,CAAC;YACrF,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;YACvB,MAAM,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC7B,MAAM,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACjC,OAAO,CAAC,OAAO,CAAC;YACd,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,MAAM,UAAU,CAAC,YAAY,CAAC;YACtC,KAAK,EAAE,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;SACvC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAC1B,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,8MAA8M,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC/d,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QACvD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC7B,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAClB,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM;YAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QACrE,MAAM,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAClC,OAAO,OAAO,CAAC,KAAK,CAAC;YACnB,aAAa,EAAE,CAAC;YAChB,QAAQ;YACR,SAAS;YACT,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,UAAU;YACV,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACnE,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,IAAI,UAAU,CAClB,4BAA4B,EAC5B,GAAG,EACH,IAAI,EACJ,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClG,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/store/sql-recovery-inspection.d.ts

@@ -0,0 +1,22 @@
+import { type JournalRecoveryState } from "./errors.js";
+import { ControlJournalInspection } from "@claudexor/schema";
+import { type PartitionGeneration } from "./partitions.js";
+import type { SqlWriteContext } from "./mutation.js";
+export type RecoveryReader = Pick<SqlWriteContext, "prepare">;
+/** Current registry authority, including a partition that cannot serve product work. */
+export declare function recoveryGeneration(sql: RecoveryReader, name: string): PartitionGeneration;
+export interface SqlPartitionEvidence {
+    storeId: string;
+    generation: PartitionGeneration;
+    counts: Array<{
+        type: string;
+        count: number;
+    }>;
+    fingerprint: string;
+}
+/** Inspection fingerprints metadata only; command/turn/event bodies stay unopened. */
+export declare function partitionEvidence(sql: RecoveryReader, generation: PartitionGeneration): SqlPartitionEvidence;
+export declare function partitionRecovery(sql: RecoveryReader, generation: PartitionGeneration): JournalRecoveryState;
+export declare function inspection(sql: RecoveryReader, evidence: SqlPartitionEvidence, observedAt: string): ControlJournalInspection;
+export declare function assertPartitionReadable(sql: RecoveryReader, generation: PartitionGeneration): void;
+//# sourceMappingURL=sql-recovery-inspection.d.ts.map

package/dist/store/sql-recovery-inspection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-recovery-inspection.d.ts","sourceRoot":"","sources":["../../src/store/sql-recovery-inspection.ts"],"names":[],"mappings":"AACA,OAAO,EAAgC,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,wBAAwB,EAA+B,MAAM,mBAAmB,CAAC;AAE1F,OAAO,EAAiB,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;AAE9D,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,mBAAmB,CAiBzF;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,mBAAmB,CAAC;IAChC,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,cAAc,EACnB,UAAU,EAAE,mBAAmB,GAC9B,oBAAoB,CAqBtB;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,cAAc,EACnB,UAAU,EAAE,mBAAmB,GAC9B,oBAAoB,CAsBtB;AAED,wBAAgB,UAAU,CACxB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,oBAAoB,EAC9B,UAAU,EAAE,MAAM,GACjB,wBAAwB,CAY1B;AAED,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,cAAc,EACnB,UAAU,EAAE,mBAAmB,GAC9B,IAAI,CAGN"}

package/dist/store/sql-recovery-inspection.js

@@ -0,0 +1,88 @@
+import { createHash } from "node:crypto";
+import { JournalRecoveryRequiredError } from "./errors.js";
+import { ControlJournalInspection, ControlJournalRecoveryState } from "@claudexor/schema";
+import { globalGeneration } from "./generations.js";
+import { partitionById } from "./partitions.js";
+/** Current registry authority, including a partition that cannot serve product work. */
+export function recoveryGeneration(sql, name) {
+    const global = globalGeneration(sql);
+    if (name === "global" && global)
+        return global;
+    if (global && global.status === "ready") {
+        const project = sql
+            .prepare(`SELECT q.id FROM project p JOIN partition q ON q.id=p.current_pid
+      WHERE p.pid=? AND p.status='active' AND q.name=?`)
+            .get(global.pid, name);
+        const generation = project ? partitionById(sql, project.id) : null;
+        if (generation)
+            return generation;
+    }
+    throw Object.assign(new Error(`journal partition is not registered: ${name}`), {
+        code: "journal_partition_not_found",
+        status: 404,
+    });
+}
+/** Inspection fingerprints metadata only; command/turn/event bodies stay unopened. */
+export function partitionEvidence(sql, generation) {
+    const identity = sql.prepare("SELECT value FROM meta WHERE key='store_id'").get();
+    if (!identity)
+        throw new Error("engine store identity is missing");
+    const counts = sql
+        .prepare("SELECT type,count(*) AS count FROM event WHERE pid=? GROUP BY type ORDER BY type")
+        .all(generation.pid).map((row) => ({ type: row.type, count: Number(row.count) }));
+    const fingerprint = createHash("sha256")
+        .update(JSON.stringify({
+        store_id: identity.value,
+        name: generation.name,
+        epoch: generation.epoch,
+        next_seq: generation.nextSeq,
+        counts,
+    }))
+        .digest("hex");
+    return { storeId: identity.value, generation, counts, fingerprint };
+}
+export function partitionRecovery(sql, generation) {
+    if (generation.status === "ready")
+        return { status: "ready", discardedTailBytes: 0 };
+    const imported = sql
+        .prepare("SELECT problem FROM import_partition WHERE pid=? AND problem IS NOT NULL")
+        .get(generation.pid);
+    if (imported) {
+        try {
+            const parsed = ControlJournalRecoveryState.parse(JSON.parse(imported.problem));
+            if (parsed.status === "recovery_required")
+                return parsed;
+        }
+        catch {
+            /* Preserve a usable recovery doorway when the original detail is unavailable. */
+        }
+    }
+    const issue = sql
+        .prepare("SELECT seq,reason FROM unclassified WHERE pid=? ORDER BY seq LIMIT 1")
+        .get(generation.pid);
+    return {
+        status: "recovery_required",
+        location: { kind: "cursor", epoch: generation.epoch, seq: issue ? Number(issue.seq) : 0 },
+        reason: issue?.reason ?? `partition generation is ${generation.status}`,
+        discardedTailBytes: 0,
+    };
+}
+export function inspection(sql, evidence, observedAt) {
+    const recovery = partitionRecovery(sql, evidence.generation);
+    return ControlJournalInspection.parse({
+        schemaVersion: 1,
+        partition: evidence.generation.name,
+        generation: evidence.generation.pid,
+        status: recovery.status,
+        recovery,
+        fingerprint: evidence.fingerprint,
+        observedAt,
+        evidenceRefs: [`recovery:${evidence.generation.name}:${evidence.fingerprint}`],
+    });
+}
+export function assertPartitionReadable(sql, generation) {
+    const state = partitionRecovery(sql, generation);
+    if (state.status === "recovery_required")
+        throw new JournalRecoveryRequiredError(state);
+}
+//# sourceMappingURL=sql-recovery-inspection.js.map

package/dist/store/sql-recovery-inspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-recovery-inspection.js","sourceRoot":"","sources":["../../src/store/sql-recovery-inspection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,4BAA4B,EAA6B,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,aAAa,EAA4B,MAAM,iBAAiB,CAAC;AAK1E,wFAAwF;AACxF,MAAM,UAAU,kBAAkB,CAAC,GAAmB,EAAE,IAAY;IAClE,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,QAAQ,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC/C,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,GAAG;aAChB,OAAO,CACN;uDAC+C,CAChD;aACA,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAA+B,CAAC;QACvD,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnE,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;IACpC,CAAC;IACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,IAAI,EAAE,CAAC,EAAE;QAC7E,IAAI,EAAE,6BAA6B;QACnC,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;AACL,CAAC;AASD,sFAAsF;AACtF,MAAM,UAAU,iBAAiB,CAC/B,GAAmB,EACnB,UAA+B;IAE/B,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC,GAAG,EAChD,CAAC;IAChC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACnE,MAAM,MAAM,GACV,GAAG;SACA,OAAO,CAAC,kFAAkF,CAAC;SAC3F,GAAG,CAAC,UAAU,CAAC,GAAG,CACtB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC;SACrC,MAAM,CACL,IAAI,CAAC,SAAS,CAAC;QACb,QAAQ,EAAE,QAAQ,CAAC,KAAK;QACxB,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,QAAQ,EAAE,UAAU,CAAC,OAAO;QAC5B,MAAM;KACP,CAAC,CACH;SACA,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,GAAmB,EACnB,UAA+B;IAE/B,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC;IACrF,MAAM,QAAQ,GAAG,GAAG;SACjB,OAAO,CAAC,0EAA0E,CAAC;SACnF,GAAG,CAAC,UAAU,CAAC,GAAG,CAAoC,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/E,IAAI,MAAM,CAAC,MAAM,KAAK,mBAAmB;gBAAE,OAAO,MAAM,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,iFAAiF;QACnF,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,GAAG;SACd,OAAO,CAAC,sEAAsE,CAAC;SAC/E,GAAG,CAAC,UAAU,CAAC,GAAG,CAAgD,CAAC;IACtE,OAAO;QACL,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QACzF,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,2BAA2B,UAAU,CAAC,MAAM,EAAE;QACvE,kBAAkB,EAAE,CAAC;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,GAAmB,EACnB,QAA8B,EAC9B,UAAkB;IAElB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7D,OAAO,wBAAwB,CAAC,KAAK,CAAC;QACpC,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI;QACnC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,GAAG;QACnC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ;QACR,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,UAAU;QACV,YAAY,EAAE,CAAC,YAAY,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;KAC/E,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,GAAmB,EACnB,UAA+B;IAE/B,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,mBAAmB;QAAE,MAAM,IAAI,4BAA4B,CAAC,KAAK,CAAC,CAAC;AAC1F,CAAC"}

package/dist/store/sql-recovery.d.ts

@@ -0,0 +1,69 @@
+import { ControlJournalQuarantineReceipt, ControlJournalValidation, type ControlJournalInspection } from "@claudexor/schema";
+import { type JournalQuarantineRequest } from "../journal-recovery-operation.js";
+import type { PartitionControlPort } from "../store-contracts.js";
+import type { BlobFiles } from "./blob-files.js";
+import { StoreError } from "./errors.js";
+import type { MaintenanceController } from "./maintenance.js";
+import { type PartitionGeneration } from "./partitions.js";
+import type { EngineStore } from "./store.js";
+/** The composition root supplies its existing pure/stateful projection validators.
+ * Validation must be synchronous and side-effect free; no substitute reducers. */
+export interface SqlRecoveryProjection {
+    name: string;
+    validate(generation: PartitionGeneration): void;
+}
+export interface SqlRecoveryOptions {
+    projections(generation: PartitionGeneration): readonly SqlRecoveryProjection[];
+    onQuarantined?(receipt: ControlJournalQuarantineReceipt, previous: PartitionGeneration, current: PartitionGeneration): void;
+    onPhysicalCorruption?(problem: StoreError): void;
+}
+/** Logical partition recovery over one supplied store. Physical SQLite repair
+ * remains the owning application's whole-store engine-state lifecycle. */
+export declare class SqlPartitionRecovery implements PartitionControlPort {
+    private readonly store;
+    private readonly blobs;
+    private readonly maintenance;
+    readonly partition: string;
+    private readonly options;
+    constructor(store: EngineStore, blobs: BlobFiles, maintenance: Pick<MaintenanceController, "integrityCheck" | "exportTo">, partition: string, options: SqlRecoveryOptions);
+    inspect(): ControlJournalInspection;
+    validate(): Promise<ControlJournalValidation>;
+    events(afterCursor?: string): {
+        schemaVersion: 1;
+        cursor: string;
+        partition: string;
+        type: string;
+        observedAt: string;
+        payload?: unknown;
+    }[];
+    exportRecovery(): Promise<{
+        schemaVersion: 1;
+        exportId: string;
+        partition: string;
+        fingerprint: string;
+        bundlePath: string;
+        manifestSha256: string;
+        createdAt: string;
+    }>;
+    preflightQuarantine(input: JournalQuarantineRequest): {
+        disposition: string;
+        receipt: {
+            schemaVersion: 1;
+            operationId: string;
+            partition: string;
+            previousFingerprint: string;
+            quarantineArtifactId: string;
+            quarantinePath: string;
+            newEpoch: string;
+            completedAt: string;
+        };
+    } | {
+        disposition: string;
+        receipt: null;
+    };
+    quarantineAndStartFresh(input: JournalQuarantineRequest): ControlJournalQuarantineReceipt;
+    private replay;
+    private assertPhysicalHealthy;
+    private physicalCorruption;
+}
+//# sourceMappingURL=sql-recovery.d.ts.map

package/dist/store/sql-recovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-recovery.d.ts","sourceRoot":"","sources":["../../src/store/sql-recovery.ts"],"names":[],"mappings":"AACA,OAAO,EACL,+BAA+B,EAC/B,wBAAwB,EACxB,KAAK,wBAAwB,EAC9B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAKL,KAAK,wBAAwB,EAC9B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAE9D,OAAO,EAAiB,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAS9C;kFACkF;AAClF,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,UAAU,EAAE,mBAAmB,GAAG,IAAI,CAAC;CACjD;AACD,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,UAAU,EAAE,mBAAmB,GAAG,SAAS,qBAAqB,EAAE,CAAC;IAC/E,aAAa,CAAC,CACZ,OAAO,EAAE,+BAA+B,EACxC,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,mBAAmB,GAC3B,IAAI,CAAC;IACR,oBAAoB,CAAC,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAAC;CAClD;AAED;0EAC0E;AAC1E,qBAAa,oBAAqB,YAAW,oBAAoB;IAE7D,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,YACmB,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,SAAS,EAChB,WAAW,EAAE,IAAI,CAAC,qBAAqB,EAAE,gBAAgB,GAAG,UAAU,CAAC,EAC/E,SAAS,EAAE,MAAM,EACT,OAAO,EAAE,kBAAkB,EAC1C;IAEJ,OAAO,IAAI,wBAAwB,CAQlC;IAEK,QAAQ,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAmDlD;IAED,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM;;;;;;;QAI1B;IAED,cAAc;;;;;;;;OAIb;IAED,mBAAmB,CAAC,KAAK,EAAE,wBAAwB;;;;;;;;;;;;;;;MAelD;IAED,uBAAuB,CAAC,KAAK,EAAE,wBAAwB,GAAG,+BAA+B,CA2BxF;IAED,OAAO,CAAC,MAAM;IAwDd,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,kBAAkB;CAU3B"}

package/dist/store/sql-recovery.js

@@ -0,0 +1,169 @@
+import { randomUUID } from "node:crypto";
+import { ControlJournalQuarantineReceipt, ControlJournalValidation, } from "@claudexor/schema";
+import { conflict, quarantineRequestDigest, typedError, validateRequest, } from "../journal-recovery-operation.js";
+import { sha256 } from "../journal-recovery-files.js";
+import { readJournalEvents } from "./cursors.js";
+import { StoreError } from "./errors.js";
+import { quarantineGeneration, setGenerationStatusInTx } from "./generations.js";
+import { runMutation } from "./mutation.js";
+import { partitionById } from "./partitions.js";
+import { exportSqlRecovery } from "./sql-recovery-export.js";
+import { assertPartitionReadable, inspection, partitionEvidence, recoveryGeneration, } from "./sql-recovery-inspection.js";
+/** Logical partition recovery over one supplied store. Physical SQLite repair
+ * remains the owning application's whole-store engine-state lifecycle. */
+export class SqlPartitionRecovery {
+    store;
+    blobs;
+    maintenance;
+    partition;
+    options;
+    constructor(store, blobs, maintenance, partition, options) {
+        this.store = store;
+        this.blobs = blobs;
+        this.maintenance = maintenance;
+        this.partition = partition;
+        this.options = options;
+    }
+    inspect() {
+        this.assertPhysicalHealthy();
+        const generation = recoveryGeneration(this.store, this.partition);
+        return inspection(this.store, partitionEvidence(this.store, generation), this.store.now().toISOString());
+    }
+    async validate() {
+        const integrity = await this.maintenance.integrityCheck();
+        if (!integrity.ok)
+            this.physicalCorruption(integrity.problems.join("; "));
+        const generation = recoveryGeneration(this.store, this.partition);
+        const before = partitionEvidence(this.store, generation);
+        const statuses = [
+            {
+                name: "sqlite.integrity",
+                status: "valid",
+                detail: "Whole engine database integrity_check passed.",
+            },
+        ];
+        const projections = this.options.projections(generation);
+        if (projections.length === 0)
+            throw new StoreError("recovery_validation_unavailable", 503, false, "no projection validators are registered for this partition");
+        let failed = false;
+        for (const projection of projections) {
+            try {
+                const result = projection.validate(generation);
+                if (result && typeof result.then === "function")
+                    throw new Error("SQL recovery projection validation must be synchronous");
+                statuses.push({ name: projection.name, status: "valid", detail: null });
+            }
+            catch (error) {
+                if (error.code === "store_corrupt")
+                    this.physicalCorruption(error instanceof Error ? error.message : String(error));
+                failed = true;
+                statuses.push({
+                    name: projection.name,
+                    status: "invalid",
+                    detail: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
+        const after = partitionEvidence(this.store, recoveryGeneration(this.store, this.partition));
+        if (before.fingerprint !== after.fingerprint)
+            throw new StoreError("recovery_validation_changed", 409, true, "partition changed during projection validation");
+        if (failed)
+            runMutation(this.store, (tx) => setGenerationStatusInTx(tx, generation.pid, "recovery_required"));
+        return ControlJournalValidation.parse({ ...this.inspect(), projectionStatus: statuses });
+    }
+    events(afterCursor) {
+        this.assertPhysicalHealthy();
+        assertPartitionReadable(this.store, recoveryGeneration(this.store, this.partition));
+        return readJournalEvents(this.store, this.partition, afterCursor, this.blobs);
+    }
+    exportRecovery() {
+        this.assertPhysicalHealthy();
+        recoveryGeneration(this.store, this.partition);
+        return exportSqlRecovery(this.store, this.blobs, this.maintenance, this.partition);
+    }
+    preflightQuarantine(input) {
+        validateRequest(input);
+        this.assertPhysicalHealthy();
+        const prior = this.replay(input);
+        if (prior)
+            return { disposition: "completed", receipt: prior };
+        const current = this.inspect();
+        if (recoveryGeneration(this.store, this.partition).status !== "recovery_required")
+            throw typedError("journal_partition_ready", 409, "only a corrupt partition can be quarantined");
+        if (current.fingerprint !== input.expectedFingerprint)
+            throw conflict("recovery_fingerprint_mismatch");
+        return { disposition: "new", receipt: null };
+    }
+    quarantineAndStartFresh(input) {
+        const preflight = this.preflightQuarantine(input);
+        if (preflight.disposition === "completed")
+            return preflight.receipt;
+        const previous = recoveryGeneration(this.store, this.partition);
+        const operationId = randomUUID();
+        const epoch = randomUUID().replaceAll("-", "");
+        const receipt = ControlJournalQuarantineReceipt.parse({
+            schemaVersion: 1,
+            operationId,
+            partition: this.partition,
+            previousFingerprint: input.expectedFingerprint,
+            quarantineArtifactId: `partition-${previous.pid}-${operationId}`,
+            quarantinePath: `partition:${this.partition}@${previous.epoch}`,
+            newEpoch: epoch,
+            completedAt: this.store.now().toISOString(),
+        });
+        const outcome = quarantineGeneration(this.store, this.blobs, {
+            oldPid: previous.pid,
+            keyDigest: sha256(Buffer.from(input.idempotencyKey)),
+            requestDigest: quarantineRequestDigest(this.partition, input),
+            operationId,
+            payload: receipt,
+            epoch,
+        });
+        if (outcome.replay)
+            return this.replay(input);
+        this.options.onQuarantined?.(receipt, previous, outcome.generation);
+        return receipt;
+    }
+    replay(input) {
+        // The old generation is the key's scope. Search its addressed binding before
+        // current-registry preconditions; global recovery may have hidden the project.
+        const rows = this.store
+            .prepare(`SELECT i.pid,i.request_digest,i.target_id FROM partition p JOIN idempotency i
+      ON i.pid=p.id AND i.owner='quarantine' AND i.key_digest=? WHERE p.name=? LIMIT 2`)
+            .all(sha256(Buffer.from(input.idempotencyKey)), this.partition);
+        if (rows.length === 0)
+            return null;
+        if (rows.length !== 1)
+            throw typedError("recovery_operation_ambiguous", 503, "multiple quarantine bindings match this key");
+        const binding = rows[0];
+        if (binding.request_digest !== quarantineRequestDigest(this.partition, input))
+            throw conflict("idempotency_conflict");
+        const old = partitionById(this.store, binding.pid);
+        // Receipts are small, retained event rows. Never use today's current epoch
+        // to manufacture a receipt for an earlier successfully committed operation.
+        const records = this.store
+            .prepare(`SELECT e.payload FROM partition p JOIN event e ON e.pid=p.id
+      WHERE p.name=? AND e.type='journal.partition_quarantined'
+      AND json_extract(CAST(e.payload AS TEXT),'$.operationId')=?`)
+            .all(this.partition, binding.target_id);
+        if (records.length !== 1)
+            throw typedError("recovery_operation_missing", 503, "original quarantine receipt is unavailable");
+        const receipt = ControlJournalQuarantineReceipt.parse(JSON.parse(Buffer.from(records[0].payload).toString("utf8")));
+        if (receipt.partition !== this.partition ||
+            receipt.operationId !== binding.target_id ||
+            receipt.previousFingerprint !== input.expectedFingerprint ||
+            receipt.quarantinePath !== `partition:${this.partition}@${old.epoch}`)
+            throw typedError("recovery_receipt_mismatch", 503, "quarantine receipt does not match intent");
+        return receipt;
+    }
+    assertPhysicalHealthy() {
+        if (this.store.facts().integrity === "failed")
+            this.physicalCorruption("engine store integrity check failed");
+    }
+    physicalCorruption(detail) {
+        const problem = new StoreError("store_corrupt", 503, false, `physical SQLite recovery requires the whole engine-state owner: ${detail}`);
+        this.options.onPhysicalCorruption?.(problem);
+        throw problem;
+    }
+}
+//# sourceMappingURL=sql-recovery.js.map