@cleocode/contracts 2026.5.108 → 2026.5.110

package/src/db-inventory.ts

@@ -0,0 +1,234 @@
+/**
+ * CLEO Database Inventory — SSoT type contract + immutable constant.
+ *
+ * @remarks
+ * This module exports the typed shape and the runtime constant for every
+ * SQLite database that CLEO manages. The runtime data is sourced from the
+ * canonical JSON inventory at `packages/contracts/src/db-inventory.json`
+ * via ESM JSON import (`with { type: 'json' }`). The JSON file is the
+ * single source of truth; this module re-exposes it with a typed contract.
+ *
+ * The JSON file is co-located in this package (rather than referencing a
+ * sibling-package `src/` path) so that the built `dist/db-inventory.js`
+ * resolves the JSON via a relative `./db-inventory.json` import that
+ * works inside the published `@cleocode/contracts` npm tarball — sibling
+ * package `src/` directories are not shipped to consumers.
+ *
+ * Downstream consumers:
+ *
+ * - **T10307 — Fleet survey** (`cleo doctor db-substrate`) iterates `DB_INVENTORY`
+ *   to enumerate every DB on disk across project + global tiers.
+ * - **T10310 — Pragma drift** validates that every open handle for each role
+ *   applies the pragma SSoT (`specs/sqlite-pragmas.json`).
+ * - **T10311 — Migration coverage** asserts that each entry's
+ *   `migrationsDir` exists and contains a `0000_*` baseline.
+ * - **T10312 — Doctor integrity** runs `PRAGMA integrity_check` against
+ *   every entry whose tier resolves to a present file on disk.
+ * - **T10320 — Cross-DB invariants** uses `ownerPackage` + `tier` to
+ *   classify which DBs must agree on shared identifiers (project_id,
+ *   agent_id, session_id, ...).
+ *
+ * Adding a new entry to the inventory is a charter amendment — update
+ * `packages/contracts/src/db-inventory.json` AND
+ * `.cleo/adrs/ADR-068-cleo-database-charter.md` in the same PR (gated by
+ * `cleo check arch` Gate-4 SSoT-EXEMPT lint once T10282 ships its drift
+ * check).
+ *
+ * @see ADR-068 — CLEO Database Charter (canonical narrative)
+ * @see Saga T10281 — SG-BRAIN-DB-RESILIENCE (provenance)
+ * @see Epic T10282 — E1-DB-INVENTORY (this artifact)
+ * @see Research note `sg-brain-db-resilience-deep-audit-2026-05-23`
+ *
+ * @task T10305
+ * @epic T10282
+ * @saga T10281
+ */
+
+import dbInventoryData from './db-inventory.json' with { type: 'json' };
+
+/**
+ * Canonical role names for every SQLite database in the CLEO charter.
+ *
+ * @remarks
+ * Mirrors the `openCleoDb('<role>', cwd)` chokepoint (ADR-068 §3) plus the
+ * three audit-discovered roles (`global-brain`, `global-tasks`, `manifest`)
+ * that exist on disk today but do not yet have a registered opener.
+ *
+ * - `tasks`              — project-tier task engine DB
+ * - `brain`              — project-tier memory DB (PII)
+ * - `conduit`            — project-tier agent message transport
+ * - `manifest`           — project-tier derived blob index (rebuildable)
+ * - `llmtxt`             — reserved project-tier llmtxt session store
+ * - `nexus`              — global-tier cross-project knowledge graph (PII)
+ * - `signaldock-project` — historical project-tier signaldock (post-ADR-037, merged into conduit)
+ * - `signaldock-global`  — global-tier canonical agent identity registry
+ * - `telemetry`          — global-tier opt-in command telemetry
+ * - `skills`             — global-tier per-user skill registry
+ * - `global-brain`       — global-tier brain.db observed on disk (audit §1.2 — provenance under investigation)
+ * - `global-tasks`       — global-tier tasks.db observed on disk (audit §1.2 — provenance under investigation)
+ *
+ * @public
+ */
+export type DbRole =
+  | 'tasks'
+  | 'brain'
+  | 'conduit'
+  | 'manifest'
+  | 'llmtxt'
+  | 'nexus'
+  | 'signaldock-project'
+  | 'signaldock-global'
+  | 'telemetry'
+  | 'skills'
+  | 'global-brain'
+  | 'global-tasks';
+
+/**
+ * Lifecycle scope of a CLEO database.
+ *
+ * @remarks
+ * - `project` — file lives under `<projectRoot>/.cleo/`; lifecycle bound to one CLEO project.
+ * - `global`  — file lives under `$XDG_DATA_HOME/cleo/` (env-paths via `getCleoHome()`).
+ * - `derived` — file lives under the project tier but is rebuildable from a
+ *               non-DB source-of-truth (e.g. content-addressable blob store).
+ *               MAY be excluded from backup-pack.
+ *
+ * @public
+ */
+export type DbTier = 'project' | 'global' | 'derived';
+
+/**
+ * Privacy classification governing backup + cloud-export rules.
+ *
+ * @remarks
+ * - `local-only`               — never cloud-exported.
+ * - `local-only-pii`           — never cloud-exported; PII-class — requires
+ *                                explicit `cleo backup export --include-pii`.
+ * - `cloud-exportable-opt-in`  — may be exported only after explicit opt-in
+ *                                (e.g. `cleo diagnostics enable`).
+ *
+ * @public
+ */
+export type DbPrivacy = 'local-only' | 'local-only-pii' | 'cloud-exportable-opt-in';
+
+/**
+ * Concurrency model for the database.
+ *
+ * @remarks
+ * Every CLEO database today is `single-writer` (WAL mode with in-process
+ * serialization via the `openCleoDb` singleton). The field is enumerated so
+ * a future read-replica or multi-writer DB MUST be declared explicitly.
+ *
+ * @public
+ */
+export type DbConcurrency = 'single-writer' | 'multi-writer';
+
+/**
+ * One row in the CLEO database charter.
+ *
+ * @remarks
+ * Every field is required (no `null` placeholders) EXCEPT `drizzleSchemaPath`
+ * and `migrationsDir` — those MAY be `null` for:
+ *
+ * - `derived` databases whose schema is owned by an upstream library (e.g.
+ *   `manifest.db` is owned by `llmtxt/blob`'s `BlobFsAdapter` contract).
+ * - `reserved` roles whose opener throws `not yet implemented` (e.g.
+ *   `llmtxt.db`).
+ *
+ * Path templates use the substitution tokens:
+ *
+ * - `<projectRoot>`   — resolved at runtime from `CLEO_ROOT` env var or
+ *                       `process.cwd()` via `getCleoProjectDir()`.
+ * - `$XDG_DATA_HOME`  — resolved via env-paths through `getCleoHome()`.
+ *                       Linux: `~/.local/share/cleo/`; macOS:
+ *                       `~/Library/Application Support/cleo/`.
+ *
+ * @public
+ */
+export interface DbInventoryEntry {
+  /** Canonical role identifier used by `openCleoDb` and audit tooling. */
+  readonly role: DbRole;
+  /** Lifecycle scope — project, global, or derived. */
+  readonly tier: DbTier;
+  /**
+   * Filesystem path template with `<projectRoot>` / `$XDG_DATA_HOME` tokens.
+   * Substitution convention is documented on {@link DbInventoryEntry}.
+   */
+  readonly filePathTemplate: string;
+  /**
+   * Repo-relative path to the Drizzle schema TypeScript file. `null` when
+   * the schema is owned by an upstream library or the role is reserved.
+   */
+  readonly drizzleSchemaPath: string | null;
+  /**
+   * Repo-relative path to the Drizzle migrations directory (with trailing
+   * slash). `null` for `derived` rows or reserved roles. The path MUST
+   * exist on disk when non-null — enforced by the contracts test suite.
+   */
+  readonly migrationsDir: string | null;
+  /** npm package that owns the open + lifecycle for this database. */
+  readonly ownerPackage: string;
+  /**
+   * Human-readable description of HOW the database is opened. Typically
+   * a code excerpt like `openCleoDb('tasks', cwd)`. For databases without
+   * a registered opener, describes provenance / status.
+   */
+  readonly openedVia: string;
+  /** Concurrency model — see {@link DbConcurrency}. */
+  readonly concurrency: DbConcurrency;
+  /** Privacy classification — see {@link DbPrivacy}. */
+  readonly privacy: DbPrivacy;
+  /**
+   * Canonical backup path template. For `derived` rows this is the
+   * sentinel string `rebuildable-from-blob-store` (or similar) and the
+   * row is excluded from backup-pack staging.
+   */
+  readonly backupPath: string;
+  /**
+   * Provenance pointers — ADR row, related task IDs, audit section
+   * references. Comma-or-semicolon separated string of references.
+   */
+  readonly documentedIn: string;
+}
+
+/**
+ * Shape of the raw JSON SSoT — a header plus the typed entry array.
+ *
+ * @internal
+ */
+interface DbInventoryFile {
+  readonly $schemaNote: string;
+  readonly $pathTokens: Readonly<Record<string, string>>;
+  readonly entries: readonly DbInventoryEntry[];
+}
+
+// Narrow the raw JSON to the typed shape. The runtime parity test
+// (`db-inventory.test.ts`) asserts every field is valid for every entry.
+const rawInventory = dbInventoryData as DbInventoryFile;
+
+/**
+ * Immutable canonical inventory of every CLEO SQLite database.
+ *
+ * @remarks
+ * Sourced from `packages/contracts/src/db-inventory.json` — the SSoT.
+ * Adding a new entry is a charter amendment per ADR-068 §"How to add a
+ * new database". The {@link db-inventory.test.ts} suite asserts:
+ *
+ * 1. Every `role` is unique across the array.
+ * 2. Every `drizzleSchemaPath` (when non-null) exists on disk.
+ * 3. Every `migrationsDir` (when non-null) exists on disk.
+ * 4. Every `tier` is a member of the {@link DbTier} union.
+ *
+ * @example Iterate every project-tier database
+ * ```typescript
+ * import { DB_INVENTORY } from '@cleocode/contracts';
+ *
+ * const projectDbs = DB_INVENTORY.filter((entry) => entry.tier === 'project');
+ * for (const entry of projectDbs) {
+ *   console.log(entry.role, entry.filePathTemplate);
+ * }
+ * ```
+ *
+ * @public
+ */
+export const DB_INVENTORY: readonly DbInventoryEntry[] = rawInventory.entries;

package/src/db-recovery.ts

@@ -0,0 +1,144 @@
+/**
+ * Generic CLEO database recovery contracts — generalised from the brain-only
+ * T10303/T10304 shapes so the same envelope works for every role declared in
+ * {@link DB_INVENTORY}.
+ *
+ * These types mirror {@link BrainRecoveryResult} + {@link BackupRecoverBrainResult}
+ * almost verbatim, with two adjustments:
+ *
+ * 1. `observationsRecovered: number | null` is generalised to
+ *    `rowCounts: DbRecoveredRowCounts` — a `Record<tableName, number | null>`
+ *    keyed by the user tables discovered in the restored DB via
+ *    `sqlite_master`. Tables that fail to count surface as `null`.
+ * 2. Every envelope carries the `role: DbRole` it pertains to so envelopes from
+ *    `cleo backup recover <role>` are self-describing across tools that may
+ *    fan recovery out across multiple DBs.
+ *
+ * The brain-specific shapes ({@link BrainRecoveryResult},
+ * {@link BackupRecoverBrainResult}, {@link BrainRecoveredRowCounts}) remain in
+ * {@link brain.ts} as the backward-compatible surface — the brain CLI verb
+ * (`cleo backup recover brain`) still emits the same envelope it did before
+ * T10318 generalised the pipeline.
+ *
+ * @task T10318
+ * @epic T10284
+ * @saga T10281
+ * @adr ADR-068
+ */
+
+import type { DbRole } from './db-inventory.js';
+
+/**
+ * Best-effort per-table row counts probed from a recovered CLEO database.
+ *
+ * @remarks
+ * The recovery pipeline enumerates user tables in the restored DB via
+ * `sqlite_master` (excluding internal `sqlite_*` and Drizzle journal tables)
+ * and runs `SELECT COUNT(*)` on each. Tables that fail to count — for
+ * example, a missing table in a very old snapshot, or a schema/version
+ * mismatch — surface as `null` instead of throwing so the envelope always
+ * serialises cleanly.
+ *
+ * Keys are exact SQLite table names (case-sensitive). Values are non-negative
+ * integers or `null`.
+ *
+ * @public
+ */
+export type DbRecoveredRowCounts = Readonly<Record<string, number | null>>;
+
+/**
+ * Result of a generic CLEO DB auto-recovery attempt.
+ *
+ * @remarks
+ * Returned by `recoverMalformedDb({ role, ... })` (T10318) when the chokepoint
+ * (or an operator invoking `cleo backup recover <role>`) detects malformation
+ * via `ERR_SQLITE_ERROR errcode=11` or a failing `PRAGMA integrity_check` /
+ * `PRAGMA quick_check`. The corrupt DB has been moved to a quarantine
+ * directory and the freshest validated snapshot has been copied to the
+ * canonical role path.
+ *
+ * Consumers read this structure to decide whether to re-attempt the open and
+ * to emit user-facing diagnostics with the data-loss window.
+ *
+ * @public
+ */
+export interface DbRecoveryResult {
+  /** Canonical role of the database that was recovered. */
+  role: DbRole;
+  /** Absolute path to the snapshot that was restored, or `null` if recovery failed. */
+  restoredFrom: string | null;
+  /**
+   * Approximate hours between the snapshot's timestamp and the recovery
+   * event. `null` when the snapshot timestamp could not be parsed.
+   * Used in the recovery warning to make the data-loss window legible.
+   */
+  dataLossWindowHours: number | null;
+  /**
+   * Per-table row counts probed from the restored DB. Each key is a user
+   * table name; each value is the row count, or `null` on count failure.
+   * Empty record `{}` when the restored DB has no user tables (or when
+   * the probe itself failed to open the DB).
+   */
+  rowCounts: DbRecoveredRowCounts;
+  /** `true` if the restored DB passes `PRAGMA quick_check`. */
+  integrityOK: boolean;
+  /**
+   * Absolute path to the quarantine directory where the corrupt DB plus
+   * its `-wal`/`-shm` sidecars were moved before restore. `null` when no
+   * corrupt DB existed at the canonical path (recovery into an empty slot).
+   */
+  quarantineDir: string | null;
+}
+
+/**
+ * Envelope payload returned by `cleo backup recover <role>`.
+ *
+ * @remarks
+ * Wraps {@link DbRecoveryResult} with three CLI-only additions:
+ *
+ * - `rowsRecovered` aliases `rowCounts` to keep the envelope shape compatible
+ *   with the brain-specific {@link BackupRecoverBrainResult}.
+ * - `quarantinedTo: string` is the non-nullable string form (empty string in
+ *   `--dry-run` mode where no files were touched) — easier for shell scripts
+ *   that pipe the envelope into `jq` and then path operations.
+ * - `dryRun: boolean` records whether the envelope is a *plan* (would-do)
+ *   versus a *record* (already-done). Consumers MUST check this before
+ *   treating `restoredFrom` as a post-condition.
+ *
+ * @task T10318
+ * @epic T10284
+ * @saga T10281
+ * @public
+ */
+export interface BackupRecoverResult {
+  /** Canonical role of the database that was (or would be) recovered. */
+  role: DbRole;
+  /**
+   * Absolute path to the snapshot that was (or would be) restored. Empty
+   * string when no snapshot was available — the envelope's caller surfaces
+   * that as a failure mode via a structured error.
+   */
+  restoredFrom: string;
+  /** Per-table row counts probed from the restored DB (or the plan target). */
+  rowsRecovered: DbRecoveredRowCounts;
+  /**
+   * Approximate hours between the snapshot's timestamp and the recovery
+   * event. `null` when the snapshot timestamp could not be parsed (e.g.
+   * legacy `<role>.db.PRE-DUP-FIX-*` fallback artifact).
+   */
+  dataLossWindowHours: number | null;
+  /** `true` when the restored DB passes `PRAGMA quick_check`. */
+  integrityOK: boolean;
+  /**
+   * Absolute path to the quarantine directory where the corrupt DB plus
+   * its `-wal`/`-shm` sidecars were moved. Empty string in `--dry-run`
+   * mode where no files were touched.
+   */
+  quarantinedTo: string;
+  /**
+   * `true` when invoked with `--dry-run` — indicates the envelope is a
+   * plan, NOT a record of mutations performed. Consumers MUST check this
+   * before treating `restoredFrom` as a post-condition.
+   */
+  dryRun: boolean;
+}