@cleocode/core 2026.3.76 → 2026.4.0

package/dist/store/agent-registry-accessor.d.ts

@@ -1,443 +1,21 @@
 /**
- * Agent Registry Accessor — CRUD operations for agent credentials in SQLite.
+ * Agent Registry Accessor — CRUD operations for agent data in signaldock.db.
+ *
+ * signaldock.db is the SSoT for ALL agent data: identity, credentials,
+ * capabilities, skills, transport config. No agent data lives in tasks.db.
  *
- * Implements the `AgentRegistryAPI` contract from `@cleocode/contracts`.
  * API keys are encrypted at rest using the crypto/credentials module.
  *
- * @see docs/specs/SIGNALDOCK-UNIFIED-AGENT-REGISTRY.md Section 3
- * @task T175
+ * @see docs/specs/DATABASE-ARCHITECTURE.md
+ * @task T234
  */
 import type { AgentCredential, AgentListFilter, AgentRegistryAPI } from '@cleocode/contracts';
-import type { NodeSQLiteDatabase } from 'drizzle-orm/node-sqlite';
-import * as schema from './tasks-schema.js';
-/** Typed database instance — preserves end-to-end type safety with the full schema. */
-type TypedDb = NodeSQLiteDatabase<typeof schema>;
-/** Zod validation schemas for agent credentials (drizzle-orm/zod). */
-export declare const agentCredentialInsertSchema: import("drizzle-orm/zod").BuildSchema<"insert", {
-    agentId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "string";
-        data: string;
-        driverParam: string;
-        notNull: true;
-        hasDefault: false;
-        isPrimaryKey: true;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    displayName: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "string";
-        data: string;
-        driverParam: string;
-        notNull: true;
-        hasDefault: false;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    apiKeyEncrypted: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "string";
-        data: string;
-        driverParam: string;
-        notNull: true;
-        hasDefault: false;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    apiBaseUrl: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "string";
-        data: string;
-        driverParam: string;
-        notNull: true;
-        hasDefault: true;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    classification: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "string";
-        data: string;
-        driverParam: string;
-        notNull: false;
-        hasDefault: false;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    privacyTier: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "string";
-        data: string;
-        driverParam: string;
-        notNull: true;
-        hasDefault: true;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    capabilities: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "string";
-        data: string;
-        driverParam: string;
-        notNull: true;
-        hasDefault: true;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    skills: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "string";
-        data: string;
-        driverParam: string;
-        notNull: true;
-        hasDefault: true;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    transportConfig: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "string";
-        data: string;
-        driverParam: string;
-        notNull: true;
-        hasDefault: true;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    isActive: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "boolean";
-        data: boolean;
-        driverParam: number;
-        notNull: true;
-        hasDefault: true;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: undefined;
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    lastUsedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "number int53";
-        data: number;
-        driverParam: number;
-        notNull: false;
-        hasDefault: false;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: undefined;
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "number int53";
-        data: number;
-        driverParam: number;
-        notNull: true;
-        hasDefault: false;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: undefined;
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    updatedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "number int53";
-        data: number;
-        driverParam: number;
-        notNull: true;
-        hasDefault: false;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: undefined;
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-}, undefined, undefined>;
-export declare const agentCredentialSelectSchema: import("drizzle-orm/zod").BuildSchema<"select", {
-    agentId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "string";
-        data: string;
-        driverParam: string;
-        notNull: true;
-        hasDefault: false;
-        isPrimaryKey: true;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    displayName: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "string";
-        data: string;
-        driverParam: string;
-        notNull: true;
-        hasDefault: false;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    apiKeyEncrypted: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "string";
-        data: string;
-        driverParam: string;
-        notNull: true;
-        hasDefault: false;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    apiBaseUrl: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "string";
-        data: string;
-        driverParam: string;
-        notNull: true;
-        hasDefault: true;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    classification: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "string";
-        data: string;
-        driverParam: string;
-        notNull: false;
-        hasDefault: false;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    privacyTier: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "string";
-        data: string;
-        driverParam: string;
-        notNull: true;
-        hasDefault: true;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    capabilities: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "string";
-        data: string;
-        driverParam: string;
-        notNull: true;
-        hasDefault: true;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    skills: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "string";
-        data: string;
-        driverParam: string;
-        notNull: true;
-        hasDefault: true;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    transportConfig: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "string";
-        data: string;
-        driverParam: string;
-        notNull: true;
-        hasDefault: true;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: [string, ...string[]];
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    isActive: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "boolean";
-        data: boolean;
-        driverParam: number;
-        notNull: true;
-        hasDefault: true;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: undefined;
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    lastUsedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "number int53";
-        data: number;
-        driverParam: number;
-        notNull: false;
-        hasDefault: false;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: undefined;
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "number int53";
-        data: number;
-        driverParam: number;
-        notNull: true;
-        hasDefault: false;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: undefined;
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-    updatedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-        name: string;
-        tableName: "agent_credentials";
-        dataType: "number int53";
-        data: number;
-        driverParam: number;
-        notNull: true;
-        hasDefault: false;
-        isPrimaryKey: false;
-        isAutoincrement: false;
-        hasRuntimeDefault: false;
-        enumValues: undefined;
-        baseColumn: never;
-        identity: undefined;
-        generated: undefined;
-    }, {}>;
-}, undefined, undefined>;
-/** SQLite implementation of the AgentRegistryAPI. */
+/** signaldock.db implementation of the AgentRegistryAPI. */
 export declare class AgentRegistryAccessor implements AgentRegistryAPI {
-    private db;
     private projectPath;
-    constructor(db: TypedDb, projectPath: string);
+    constructor(projectPath: string);
+    /** Ensure signaldock.db exists with full schema before any operation. */
+    private ensureDb;
     register(credential: Omit<AgentCredential, 'createdAt' | 'updatedAt'>): Promise<AgentCredential>;
     get(agentId: string): Promise<AgentCredential | null>;
     list(filter?: AgentListFilter): Promise<AgentCredential[]>;
@@ -450,5 +28,4 @@ export declare class AgentRegistryAccessor implements AgentRegistryAPI {
     getActive(): Promise<AgentCredential | null>;
     markUsed(agentId: string): Promise<void>;
 }
-export {};
 //# sourceMappingURL=agent-registry-accessor.d.ts.map

package/dist/store/agent-registry-accessor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-registry-accessor.d.ts","sourceRoot":"","sources":["../../src/store/agent-registry-accessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,gBAAgB,EAEjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAGlE,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAC;AAI5C,uFAAuF;AACvF,KAAK,OAAO,GAAG,kBAAkB,CAAC,OAAO,MAAM,CAAC,CAAC;AAEjD,sEAAsE;AACtE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAAuC,CAAC;AAChF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAAuC,CAAC;AAyBhF,qDAAqD;AACrD,qBAAa,qBAAsB,YAAW,gBAAgB;IAE1D,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,WAAW;gBADX,EAAE,EAAE,OAAO,EACX,WAAW,EAAE,MAAM;IAGvB,QAAQ,CACZ,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,WAAW,CAAC,GAC3D,OAAO,CAAC,eAAe,CAAC;IAyBrB,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAUrD,IAAI,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAa1D,MAAM,CACV,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,WAAW,CAAC,CAAC,GAC/D,OAAO,CAAC,eAAe,CAAC;IA6BrB,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtC,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IA4B3E,SAAS,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAa5C,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAM/C"}
+{"version":3,"file":"agent-registry-accessor.d.ts","sourceRoot":"","sources":["../../src/store/agent-registry-accessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,gBAAgB,EAEjB,MAAM,qBAAqB,CAAC;AA+F7B,4DAA4D;AAC5D,qBAAa,qBAAsB,YAAW,gBAAgB;IAChD,OAAO,CAAC,WAAW;gBAAX,WAAW,EAAE,MAAM;IAEvC,yEAAyE;YAC3D,QAAQ;IAIhB,QAAQ,CACZ,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,WAAW,CAAC,GAC3D,OAAO,CAAC,eAAe,CAAC;IAwErB,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAcrD,IAAI,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAgB1D,MAAM,CACV,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,WAAW,CAAC,CAAC,GAC/D,OAAO,CAAC,eAAe,CAAC;IA8ErB,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYtC,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAwB3E,SAAS,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAgB5C,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAc/C"}

package/dist/store/agent-registry-accessor.js

@@ -0,0 +1,169 @@
+/**
+ * Agent Registry Accessor — CRUD operations for agent credentials in SQLite.
+ *
+ * Implements the `AgentRegistryAPI` contract from `@cleocode/contracts`.
+ * API keys are encrypted at rest using the crypto/credentials module.
+ *
+ * @see docs/specs/SIGNALDOCK-UNIFIED-AGENT-REGISTRY.md Section 3
+ * @task T175
+ */
+import { desc, eq } from 'drizzle-orm';
+import { createInsertSchema, createSelectSchema } from 'drizzle-orm/zod';
+import { decrypt, encrypt } from '../crypto/credentials.js';
+import * as schema from './tasks-schema.js';
+const { agentCredentials } = schema;
+/** Zod validation schemas for agent credentials (drizzle-orm/zod). */
+export const agentCredentialInsertSchema = createInsertSchema(agentCredentials);
+export const agentCredentialSelectSchema = createSelectSchema(agentCredentials);
+/** Convert a database row to an AgentCredential, decrypting the API key. */
+async function rowToCredential(row, projectPath) {
+    const apiKey = await decrypt(row.apiKeyEncrypted, projectPath);
+    return {
+        agentId: row.agentId,
+        displayName: row.displayName,
+        apiKey,
+        apiBaseUrl: row.apiBaseUrl,
+        classification: row.classification ?? undefined,
+        privacyTier: row.privacyTier,
+        capabilities: JSON.parse(row.capabilities),
+        skills: JSON.parse(row.skills),
+        transportConfig: JSON.parse(row.transportConfig),
+        isActive: row.isActive,
+        lastUsedAt: row.lastUsedAt ? new Date(row.lastUsedAt).toISOString() : undefined,
+        createdAt: new Date(row.createdAt).toISOString(),
+        updatedAt: new Date(row.updatedAt).toISOString(),
+    };
+}
+/** SQLite implementation of the AgentRegistryAPI. */
+export class AgentRegistryAccessor {
+    db;
+    projectPath;
+    constructor(db, projectPath) {
+        this.db = db;
+        this.projectPath = projectPath;
+    }
+    async register(credential) {
+        const now = Date.now();
+        const apiKeyEncrypted = await encrypt(credential.apiKey, this.projectPath);
+        await this.db.insert(agentCredentials).values({
+            agentId: credential.agentId,
+            displayName: credential.displayName,
+            apiKeyEncrypted,
+            apiBaseUrl: credential.apiBaseUrl,
+            classification: credential.classification ?? null,
+            privacyTier: credential.privacyTier,
+            capabilities: JSON.stringify(credential.capabilities),
+            skills: JSON.stringify(credential.skills),
+            transportConfig: JSON.stringify(credential.transportConfig),
+            isActive: credential.isActive,
+            lastUsedAt: credential.lastUsedAt ? new Date(credential.lastUsedAt).getTime() : null,
+            createdAt: now,
+            updatedAt: now,
+        });
+        const result = await this.get(credential.agentId);
+        if (!result)
+            throw new Error(`Failed to register agent: ${credential.agentId}`);
+        return result;
+    }
+    async get(agentId) {
+        const rows = await this.db
+            .select()
+            .from(agentCredentials)
+            .where(eq(agentCredentials.agentId, agentId));
+        if (rows.length === 0)
+            return null;
+        return rowToCredential(rows[0], this.projectPath);
+    }
+    async list(filter) {
+        const query = filter?.active !== undefined
+            ? this.db
+                .select()
+                .from(agentCredentials)
+                .where(eq(agentCredentials.isActive, filter.active))
+            : this.db.select().from(agentCredentials);
+        const rows = await query;
+        return Promise.all(rows.map((row) => rowToCredential(row, this.projectPath)));
+    }
+    async update(agentId, updates) {
+        // C2 fix: pre-flight check — fail fast if agent doesn't exist
+        const existing = await this.get(agentId);
+        if (!existing)
+            throw new Error(`Agent not found: ${agentId}`);
+        const now = Date.now();
+        const values = { updatedAt: now };
+        if (updates.displayName !== undefined)
+            values['displayName'] = updates.displayName;
+        if (updates.apiBaseUrl !== undefined)
+            values['apiBaseUrl'] = updates.apiBaseUrl;
+        if (updates.classification !== undefined)
+            values['classification'] = updates.classification;
+        if (updates.privacyTier !== undefined)
+            values['privacyTier'] = updates.privacyTier;
+        if (updates.capabilities !== undefined)
+            values['capabilities'] = JSON.stringify(updates.capabilities);
+        if (updates.skills !== undefined)
+            values['skills'] = JSON.stringify(updates.skills);
+        if (updates.transportConfig !== undefined)
+            values['transportConfig'] = JSON.stringify(updates.transportConfig);
+        if (updates.isActive !== undefined)
+            values['isActive'] = updates.isActive;
+        if (updates.apiKey !== undefined) {
+            values['apiKeyEncrypted'] = await encrypt(updates.apiKey, this.projectPath);
+        }
+        await this.db.update(agentCredentials).set(values).where(eq(agentCredentials.agentId, agentId));
+        const result = await this.get(agentId);
+        if (!result)
+            throw new Error(`Agent not found after update: ${agentId}`);
+        return result;
+    }
+    async remove(agentId) {
+        // H2 fix: pre-flight check — throw if agent doesn't exist
+        const existing = await this.get(agentId);
+        if (!existing)
+            throw new Error(`Agent not found: ${agentId}`);
+        await this.db.delete(agentCredentials).where(eq(agentCredentials.agentId, agentId));
+    }
+    async rotateKey(agentId) {
+        const credential = await this.get(agentId);
+        if (!credential)
+            throw new Error(`Agent not found: ${agentId}`);
+        // Call cloud API to rotate key
+        const response = await fetch(`${credential.apiBaseUrl}/agents/${agentId}/rotate-key`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${credential.apiKey}`,
+                'X-Agent-Id': agentId,
+            },
+        });
+        if (!response.ok) {
+            throw new Error(`Failed to rotate key on cloud: ${response.status} ${response.statusText}`);
+        }
+        const data = (await response.json());
+        const newApiKey = data.data?.apiKey;
+        if (!newApiKey)
+            throw new Error('Cloud API did not return a new API key');
+        // Re-encrypt and store locally
+        await this.update(agentId, { apiKey: newApiKey });
+        // C1 fix: return only agentId, not plaintext key — callers use get() to retrieve
+        return { agentId, newApiKey: `${newApiKey.substring(0, 8)}...rotated` };
+    }
+    async getActive() {
+        // H3 fix: secondary orderBy(createdAt desc) for deterministic tie-breaking
+        const rows = await this.db
+            .select()
+            .from(agentCredentials)
+            .where(eq(agentCredentials.isActive, true))
+            .orderBy(desc(agentCredentials.lastUsedAt), desc(agentCredentials.createdAt))
+            .limit(1);
+        if (rows.length === 0)
+            return null;
+        return rowToCredential(rows[0], this.projectPath);
+    }
+    async markUsed(agentId) {
+        await this.db
+            .update(agentCredentials)
+            .set({ lastUsedAt: Date.now(), updatedAt: Date.now() })
+            .where(eq(agentCredentials.agentId, agentId));
+    }
+}
+//# sourceMappingURL=agent-registry-accessor.js.map

package/dist/store/agent-registry-accessor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-registry-accessor.js","sourceRoot":"","sources":["../../src/store/agent-registry-accessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAC;AAE5C,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;AAKpC,sEAAsE;AACtE,MAAM,CAAC,MAAM,2BAA2B,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;AAChF,MAAM,CAAC,MAAM,2BAA2B,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;AAEhF,4EAA4E;AAC5E,KAAK,UAAU,eAAe,CAC5B,GAAyC,EACzC,WAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IAC/D,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,MAAM;QACN,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,SAAS;QAC/C,WAAW,EAAE,GAAG,CAAC,WAA6C;QAC9D,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAa;QACtD,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAa;QAC1C,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAoB;QACnE,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;QAC/E,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QAChD,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;KACjD,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,OAAO,qBAAqB;IAEtB;IACA;IAFV,YACU,EAAW,EACX,WAAmB;QADnB,OAAE,GAAF,EAAE,CAAS;QACX,gBAAW,GAAX,WAAW,CAAQ;IAC1B,CAAC;IAEJ,KAAK,CAAC,QAAQ,CACZ,UAA4D;QAE5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAE3E,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC;YAC5C,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,eAAe;YACf,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,cAAc,EAAE,UAAU,CAAC,cAAc,IAAI,IAAI;YACjD,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC;YACrD,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC;YACzC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,eAAe,CAAC;YAC3D,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;YACpF,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe;QACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAEhD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAwB;QACjC,MAAM,KAAK,GACT,MAAM,EAAE,MAAM,KAAK,SAAS;YAC1B,CAAC,CAAC,IAAI,CAAC,EAAE;iBACJ,MAAM,EAAE;iBACR,IAAI,CAAC,gBAAgB,CAAC;iBACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACxD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAE9C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC;QACzB,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,MAAM,CACV,OAAe,EACf,OAAgE;QAEhE,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;QAE9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAA4B,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QAE3D,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;YAAE,MAAM,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;QACnF,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;YAAE,MAAM,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;QAChF,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS;YAAE,MAAM,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;QAC5F,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;YAAE,MAAM,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;QACnF,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;YACpC,MAAM,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpF,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS;YACvC,MAAM,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACtE,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;YAAE,MAAM,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,CAAC,iBAAiB,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAEhG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAC;QACzE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;QAE9D,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe;QAC7B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;QAEhE,+BAA+B;QAC/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,CAAC,UAAU,WAAW,OAAO,aAAa,EAAE;YACpF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,UAAU,CAAC,MAAM,EAAE;gBAC5C,YAAY,EAAE,OAAO;aACtB;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmC,CAAC;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACpC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAE1E,+BAA+B;QAC/B,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAElD,iFAAiF;QACjF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,SAAS;QACb,2EAA2E;QAC3E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;aAC1C,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;aAC5E,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,gBAAgB,CAAC;aACxB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;aACtD,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;CACF"}