@deksden-com/dd-flow-cli 0.9.0-beta.11 → 0.9.0-beta.111

package/dist/storage/foreign-key-transaction.js

@@ -0,0 +1,39 @@
+import { AppError } from "../shared/errors.js";
+/** Relocation changes related keys together; restore connection policy even
+ * when BEGIN or rollback fails, and never reuse a connection with unknown FK mode. */
+export function foreignKeyTransaction(db, operation) {
+    const foreignKeys = db.get("PRAGMA foreign_keys").foreign_keys;
+    let value, primary, failed = false, committed = false;
+    try {
+        db.exec("PRAGMA foreign_keys = OFF");
+        if (db.get("PRAGMA foreign_keys")?.foreign_keys !== 0)
+            throw new AppError("foreign_key_transaction_active", "Key relocation requires its own connection transaction", 1);
+        value = db.writeTransaction(() => { db.afterCommit(() => { committed = true; }); return operation(); });
+    }
+    catch (error) {
+        primary = error;
+        failed = true;
+    }
+    try {
+        db.exec(`PRAGMA foreign_keys = ${foreignKeys ? "ON" : "OFF"}`);
+        if (db.get("PRAGMA foreign_keys")?.foreign_keys !== foreignKeys)
+            throw new Error("Foreign-key enforcement was not restored");
+    }
+    catch (restore) {
+        const details = { foreign_keys_restore_error: String(restore), effect: committed ? "committed" : "unknown" };
+        try {
+            db.close?.();
+        }
+        catch (close) {
+            details.connection_close_error = String(close);
+        }
+        if (primary instanceof AppError)
+            Object.assign(primary.details, details);
+        else
+            primary = new AppError("foreign_key_restoration_failed", primary instanceof Error ? primary.message : "Cannot restore foreign-key enforcement", 1, { ...details, ...(failed ? { cause: String(primary) } : {}) });
+        failed = true;
+    }
+    if (failed)
+        throw primary;
+    return value;
+}

package/dist/storage/immutable-input.js

@@ -0,0 +1,45 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { AppError } from "../shared/errors.js";
+/** Durable immutable candidate; only a later SQL receipt grants it authority. */
+export function publishImmutableInput(file, bytes, conflictCode) {
+    const expected = crypto.createHash("sha256").update(bytes).digest("hex");
+    const verify = () => {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink() || crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex") !== expected)
+            throw new AppError(conflictCode, "Immutable input differs from the accepted bytes", 1, { path: file, expected_sha256: expected });
+    };
+    const temporary = `${file}.tmp-${crypto.randomUUID()}`;
+    try {
+        fs.writeFileSync(temporary, bytes, { flag: "wx", mode: 0o600 });
+        const descriptor = fs.openSync(temporary, "r");
+        try {
+            fs.fsyncSync(descriptor);
+        }
+        finally {
+            fs.closeSync(descriptor);
+        }
+        try {
+            fs.linkSync(temporary, file);
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            verify();
+        }
+        const directory = fs.openSync(path.dirname(file), "r");
+        try {
+            fs.fsyncSync(directory);
+        }
+        finally {
+            fs.closeSync(directory);
+        }
+    }
+    finally {
+        try {
+            fs.rmSync(temporary, { force: true });
+        }
+        catch { /* Unreferenced staging garbage must not mask the accepted input or primary error. */ }
+    }
+}

package/dist/storage/import-guard.js

@@ -0,0 +1,102 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { AppError } from "../shared/errors.js";
+/** Outside the replaced runtime tree, so a copied source receipt cannot make
+ * an incomplete target look ready. A failed target is diagnostic evidence. */
+export function importGuardPath(home) {
+    const absolute = canonicalHome(home);
+    return path.join(path.dirname(absolute), `.${path.basename(absolute)}.dd-flow-import.json`);
+}
+function canonicalHome(home) {
+    let existing = path.resolve(home);
+    const suffix = [];
+    while (!fs.existsSync(existing)) {
+        suffix.unshift(path.basename(existing));
+        existing = path.dirname(existing);
+    }
+    return path.join(fs.realpathSync(existing), ...suffix);
+}
+function readImportGuard(home) {
+    const file = importGuardPath(home);
+    if (!fs.existsSync(file))
+        return null;
+    let guard;
+    try {
+        guard = JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch {
+        throw new AppError("snapshot_import_incomplete", "Snapshot import guard is unreadable; preserve this target for diagnosis", 1, { guard_path: file });
+    }
+    if (guard.schema_id !== "dd-flow/import-guard@1" || guard.runtime_home !== canonicalHome(home)
+        || !/^[0-9a-f-]{36}$/.test(guard.import_id) || !/^[a-f0-9]{64}$/.test(guard.source_manifest_sha256)
+        || !path.isAbsolute(guard.project_root) || !path.isAbsolute(guard.workspace_root)
+        || !["in_progress", "completed"].includes(guard.status)) {
+        throw new AppError("snapshot_import_incomplete", "Snapshot import guard does not identify this target", 1, { guard_path: file });
+    }
+    return guard;
+}
+export function assertImportAdmission(home, permit) {
+    const guard = readImportGuard(home);
+    if (guard?.status === "in_progress" && guard.import_id !== permit)
+        throw new AppError("snapshot_import_incomplete", "Snapshot import has not completed; preserve this target for diagnosis and restore into fresh targets", 1, { guard_path: importGuardPath(home), import_id: guard.import_id });
+}
+function durableWrite(file, bytes, create) {
+    const target = create ? file : `${file}.tmp-${crypto.randomUUID()}`;
+    try {
+        fs.writeFileSync(target, bytes, { flag: "wx", mode: 0o600 });
+        const descriptor = fs.openSync(target, "r");
+        try {
+            fs.fsyncSync(descriptor);
+        }
+        finally {
+            fs.closeSync(descriptor);
+        }
+        if (!create)
+            fs.renameSync(target, file);
+        const directory = fs.openSync(path.dirname(file), "r");
+        try {
+            fs.fsyncSync(directory);
+        }
+        finally {
+            fs.closeSync(directory);
+        }
+    }
+    finally {
+        if (!create)
+            fs.rmSync(target, { force: true });
+    }
+}
+export function beginSnapshotImport(input) {
+    const importId = crypto.randomUUID();
+    const guard = { schema_id: "dd-flow/import-guard@1", import_id: importId, status: "in_progress", source_manifest_sha256: input.sourceManifestSha256,
+        runtime_home: canonicalHome(input.home), project_root: path.resolve(input.projectRoot), workspace_root: path.resolve(input.workspaceRoot) };
+    durableWrite(importGuardPath(input.home), `${JSON.stringify(guard)}\n`, true);
+    return importId;
+}
+/** A fork with its own matching intent may rebuild a completed import when
+ * its final fork receipt was lost. Fence the existing home before removing any
+ * copied files; an interrupted rebuild remains closed to productive opens. */
+export function rearmCompletedSnapshotImport(input) {
+    const guard = readImportGuard(input.home);
+    if (!guard)
+        return null;
+    if (guard.status !== "completed" || guard.project_root !== path.resolve(input.projectRoot)
+        || guard.workspace_root !== path.resolve(input.workspaceRoot)
+        || guard.source_manifest_sha256 !== input.sourceManifestSha256) {
+        throw new AppError("snapshot_import_incomplete", "Existing import does not match this completed fork; preserve it for diagnosis", 1, { guard_path: importGuardPath(input.home) });
+    }
+    const importId = crypto.randomUUID();
+    durableWrite(importGuardPath(input.home), `${JSON.stringify({ ...guard, import_id: importId, status: "in_progress" })}\n`, false);
+    return importId;
+}
+export function completeSnapshotImport(home, importId, completed) {
+    const guard = readImportGuard(home);
+    if (!guard || guard.import_id !== importId || guard.status !== "in_progress"
+        || guard.project_root !== path.resolve(completed.projectRoot)
+        || guard.workspace_root !== path.resolve(completed.workspaceRoot)
+        || guard.source_manifest_sha256 !== completed.sourceManifestSha256) {
+        throw new AppError("snapshot_import_incomplete", "Import completion does not match its source and target paths", 1, { guard_path: importGuardPath(home) });
+    }
+    durableWrite(importGuardPath(home), `${JSON.stringify({ ...guard, status: "completed" })}\n`, false);
+}

package/dist/storage/native-cleanup.js

@@ -0,0 +1,52 @@
+import { AppError, errorRecord } from "../shared/errors.js";
+/** Cleanup must not replace the operation's primary failure, including thrown null/undefined. */
+export function withStoreCleanup(operation, cleanup, details = () => ({})) {
+    let failed = false;
+    let primary;
+    let result;
+    try {
+        result = operation();
+    }
+    catch (error) {
+        failed = true;
+        primary = error;
+    }
+    try {
+        cleanup();
+    }
+    catch (error) {
+        const secondary = { ...details(), store_cleanup_errors: [errorRecord(error)] };
+        if (failed) {
+            const original = errorRecord(primary);
+            throw new AppError(original.code, original.message, original.exitCode, {
+                ...original.details, ...secondary,
+                store_cleanup_errors: [...(Array.isArray(original.details.store_cleanup_errors) ? original.details.store_cleanup_errors : []), ...secondary.store_cleanup_errors]
+            });
+        }
+        throw new AppError("store_cleanup_failed", "Store operation completed but cleanup failed", 1, secondary);
+    }
+    if (failed)
+        throw primary;
+    return result;
+}
+/** A failed rollback makes even an enclosing savepoint's connection unsafe to reuse. */
+export function rollbackStoreTransaction(db, sql, primary) {
+    try {
+        db.exec(sql);
+    }
+    catch (error) {
+        let closeError;
+        try {
+            db.close();
+        }
+        catch (close) {
+            closeError = errorRecord(close);
+        }
+        const original = errorRecord(primary);
+        throw new AppError(original.code, original.message, original.exitCode, {
+            ...original.details, transaction_cleanup_error: errorRecord(error),
+            ...(closeError ? { transaction_close_error: closeError } : {})
+        });
+    }
+    throw primary;
+}

package/dist/storage/paths.js

@@ -15,6 +15,8 @@ export function resolveProjectRoot(root) {
     if (!fs.existsSync(absolute)) {
         throw new AppError("not_found", `Project root does not exist: ${absolute}`, 1);
     }
+    if (!fs.statSync(absolute).isDirectory())
+        throw new AppError("validation", "Project root must be a directory", 2, { project_root: absolute });
     return fs.realpathSync(absolute);
 }
 /** Resolve an existing path to its filesystem identity, or normalize a future path. */
@@ -24,10 +26,16 @@ export function canonicalPath(value, mustExist = true) {
         return fs.realpathSync(absolute);
     if (mustExist)
         throw new AppError("not_found", `Path does not exist: ${absolute}`, 1, { path: absolute });
-    const parent = path.dirname(absolute);
-    if (!fs.existsSync(parent))
-        return absolute;
-    return path.join(fs.realpathSync(parent), path.basename(absolute));
+    const missing = [];
+    let parent = absolute;
+    while (!fs.existsSync(parent)) {
+        missing.unshift(path.basename(parent));
+        const next = path.dirname(parent);
+        if (next === parent)
+            return absolute;
+        parent = next;
+    }
+    return path.join(fs.realpathSync(parent), ...missing);
 }
 export function assertPathWithin(root, candidate, label = "path") {
     const canonicalRoot = canonicalPath(root);
@@ -100,6 +108,11 @@ export function stateJsonPath(projectRoot, protocolId) {
 export function planJsonPath(projectRoot, protocolId) {
     return path.join(protocolDir(projectRoot, protocolId), "plan.json");
 }
+/** Project canonical plan takes precedence over a retained workspace location. */
+export function resolveProtocolPlanPath(projectRoot, protocolId, recordedPath) {
+    const canonical = planJsonPath(projectRoot, protocolId);
+    return fs.existsSync(canonical) ? canonical : recordedPath;
+}
 export function projectHome(ddFlowHome, projectId) {
     return path.join(ddFlowHome, "projects", projectId);
 }

package/dist/storage/projection-lock.js

@@ -0,0 +1,73 @@
+import fs from "node:fs";
+import path from "node:path";
+import crypto from "node:crypto";
+import { processStartedAt } from "../services/managed-processes.js";
+import { AppError, errorRecord } from "../shared/errors.js";
+/** One filesystem publisher per entity; no SQLite writer is held while waiting. */
+export function withProjectionLock(lockPath, operation) {
+    fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+    const owner = { pid: process.pid, started_at: selfStartedAt() };
+    const wait = new Int32Array(new SharedArrayBuffer(4));
+    const observed = new Map();
+    for (let tries = 0;; tries++) {
+        try {
+            fs.mkdirSync(lockPath);
+            try {
+                fs.writeFileSync(`${lockPath}/owner.json`, JSON.stringify(owner));
+            }
+            catch (error) {
+                fs.rmdirSync(lockPath);
+                throw error;
+            }
+            break;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            let stale = false;
+            let observedInode;
+            try {
+                observedInode = fs.statSync(lockPath).ino;
+                const current = JSON.parse(fs.readFileSync(`${lockPath}/owner.json`, "utf8"));
+                try {
+                    process.kill(current.pid, 0);
+                    if (!observed.has(current.pid))
+                        observed.set(current.pid, processStartedAt(current.pid));
+                    stale = Boolean(current.started_at && observed.get(current.pid) !== current.started_at);
+                }
+                catch (probe) {
+                    stale = probe.code === "ESRCH";
+                }
+            }
+            catch {
+                stale = false;
+            }
+            if (stale) {
+                try {
+                    if (observedInode !== undefined && fs.statSync(lockPath).ino === observedInode) {
+                        const moved = `${lockPath}.stale-${crypto.randomUUID()}`;
+                        fs.renameSync(lockPath, moved);
+                        fs.rmSync(moved, { recursive: true });
+                    }
+                }
+                catch { /* Another publisher may own it now. */ }
+                continue;
+            }
+            if (tries >= 80)
+                throw new AppError("publication_pending", "Projection publisher is busy", 1, { effect: "committed", lock_path: lockPath });
+            Atomics.wait(wait, 0, 0, 50);
+        }
+    }
+    try {
+        return operation();
+    }
+    catch (error) {
+        throw new AppError("publication_pending", "Committed projection needs reconciliation", 1, { effect: "committed", cause: errorRecord(error), lock_path: lockPath });
+    }
+    finally {
+        fs.rmSync(lockPath, { recursive: true, force: true });
+    }
+}
+let ownStart;
+function selfStartedAt() { if (ownStart === undefined)
+    ownStart = processStartedAt(process.pid); return ownStart; }

package/dist/storage/work-references.js

@@ -0,0 +1,23 @@
+import { AppError } from "../shared/errors.js";
+/** Read-only lookup; scope applies to exact IDs as well as short aliases. */
+export function resolveWorkReference(context, id, scope = {}) {
+    const clauses = ["1 = 1"];
+    const params = [];
+    if (scope.projectId) {
+        clauses.push("project_id = ?");
+        params.push(scope.projectId);
+    }
+    if (scope.runId) {
+        clauses.push("run_id = ?");
+        params.push(scope.runId);
+    }
+    const where = clauses.join(" AND ");
+    const exact = context.db.get(`SELECT * FROM works WHERE ${where} AND work_id = ?`, [...params, id]);
+    if (exact)
+        return exact;
+    const matches = /^WRK-\d{3,}$/.test(id)
+        ? context.db.all(`SELECT * FROM works WHERE ${where} AND work_id LIKE ? ORDER BY work_id`, [...params, `${id}-%`]) : [];
+    if (matches.length !== 1)
+        throw new AppError(matches.length ? "ambiguous_work_alias" : "not_found", matches.length ? "Short Work alias is ambiguous in the current RUN" : "Work is not registered in the current RUN", 1, { work_id: id, matches: matches.map(work => work.work_id) });
+    return matches[0];
+}

package/dist/storage/writer-contract.js

@@ -0,0 +1,77 @@
+import crypto from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { rollbackStoreTransaction } from "./native-cleanup.js";
+export const STORE_WRITER_VERSION = 2;
+const version = STORE_WRITER_VERSION;
+const table = "dd_flow_writer_contract";
+const quote = (name) => `"${name.replaceAll('"', '""')}"`;
+/** Publish additive schema and its writer fences in the same transaction. */
+export function executeStoreSchema(db, sql, initialize = false) {
+    const ownsTransaction = !db.isTransaction;
+    db.exec(ownsTransaction ? "BEGIN IMMEDIATE" : "SAVEPOINT dd_flow_schema_change");
+    try {
+        const protectedStore = readStoreWriterContract(db) !== null;
+        if (initialize && !protectedStore && db.prepare("SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name NOT LIKE 'sqlite_%' LIMIT 1").get()) {
+            throw new AppError("store_initialization_conflict", "Another writer initialized this store; explicit migration is required", 1);
+        }
+        const before = db.prepare("PRAGMA schema_version").get();
+        if (typeof sql === "string")
+            db.exec(sql);
+        else
+            sql();
+        const after = db.prepare("PRAGMA schema_version").get();
+        if (initialize || (protectedStore && before.schema_version !== after.schema_version))
+            installStoreWriterContract(db);
+        db.exec(ownsTransaction ? "COMMIT" : "RELEASE dd_flow_schema_change");
+    }
+    catch (error) {
+        rollbackStoreTransaction(db, ownsTransaction ? "ROLLBACK" : "ROLLBACK TO dd_flow_schema_change; RELEASE dd_flow_schema_change", error);
+    }
+}
+/** Registration is connection-local and never changes historical input bytes. */
+export function registerStoreWriter(db) {
+    const current = readStoreWriterContract(db);
+    if (current !== null && current !== version)
+        throw new AppError("store_writer_incompatible", "This CLI cannot write the store's required contract", 1, { required: current, supported: version });
+    db.function("dd_flow_writer_version", () => version);
+}
+export function readStoreWriterContract(db) {
+    if (!db.prepare("SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name = ?").get(table))
+        return null;
+    const rows = db.prepare(`SELECT id, version FROM ${table}`).all();
+    if (rows.length !== 1 || rows[0]?.id !== 1 || !Number.isSafeInteger(rows[0].version) || rows[0].version < 1)
+        throw new AppError("store_writer_contract_invalid", "Store writer contract is malformed", 1);
+    return rows[0].version;
+}
+/** Install only at an explicit migration boundary; ordinary reads never call it. */
+export function installStoreWriterContract(db) {
+    registerStoreWriter(db);
+    const ownsTransaction = !db.isTransaction;
+    if (ownsTransaction)
+        db.exec("BEGIN IMMEDIATE");
+    try {
+        db.exec(`CREATE TABLE IF NOT EXISTS ${table} (id INTEGER PRIMARY KEY CHECK (id = 1), version INTEGER NOT NULL);
+      INSERT OR IGNORE INTO ${table} (id, version) VALUES (1, ${version});`);
+        if (readStoreWriterContract(db) !== version)
+            throw new AppError("store_writer_incompatible", "Store writer contract changed before migration", 1);
+        const tables = db.prepare("SELECT name FROM sqlite_schema WHERE type = 'table' AND name NOT LIKE 'sqlite_%'").all();
+        for (const target of tables) {
+            const key = crypto.createHash("sha256").update(target.name).digest("hex").slice(0, 24);
+            for (const action of ["INSERT", "UPDATE", "DELETE"]) {
+                const trigger = quote(`dd_flow_writer_${key}_${action.toLowerCase()}`);
+                db.exec(`DROP TRIGGER IF EXISTS ${trigger};
+          CREATE TRIGGER ${trigger} BEFORE ${action} ON ${quote(target.name)} BEGIN
+          SELECT CASE WHEN dd_flow_writer_version() <> (SELECT version FROM ${table} WHERE id = 1)
+            OR (SELECT COUNT(*) FROM ${table}) <> 1 THEN RAISE(ABORT, 'store_writer_incompatible') END;
+        END;`);
+            }
+        }
+        if (ownsTransaction)
+            db.exec("COMMIT");
+    }
+    catch (error) {
+        if (ownsTransaction)
+            rollbackStoreTransaction(db, "ROLLBACK", error);
+        throw error;
+    }
+}

package/dist/storage/writer-migration.js

@@ -0,0 +1,85 @@
+import fs from "node:fs";
+import path from "node:path";
+import crypto from "node:crypto";
+import { DatabaseSync } from "node:sqlite";
+import { AppError } from "../shared/errors.js";
+import { installStoreWriterContract, readStoreWriterContract, registerStoreWriter, STORE_WRITER_VERSION } from "./writer-contract.js";
+import { rollbackStoreTransaction, withStoreCleanup } from "./native-cleanup.js";
+/** Explicit one-store cutover. The caller must separately drain external owners. */
+export function migrateStoreWriter(file, backup) {
+    if (!path.isAbsolute(file) || !path.isAbsolute(backup) || file === backup || !fs.existsSync(file) || !fs.statSync(file).isFile())
+        throw new AppError("store_migration_path_invalid", "Migration requires an existing database and a new absolute backup path", 1);
+    const source = fs.realpathSync(file);
+    const destination = path.join(fs.realpathSync(path.dirname(backup)), path.basename(backup));
+    if (fs.lstatSync(file).isSymbolicLink() || [source, `${source}-wal`, `${source}-shm`, `${source}-journal`].includes(destination))
+        throw new AppError("store_migration_path_invalid", "Backup cannot alias the source database or its SQLite sidecars", 1);
+    let existing;
+    try {
+        existing = fs.lstatSync(backup);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    if (existing) {
+        if (!existing.isFile() || existing.isSymbolicLink())
+            throw new AppError("store_migration_path_invalid", "Backup path already exists", 1);
+        const reader = new DatabaseSync(file, { readOnly: true });
+        return withStoreCleanup(() => {
+            const recorded = reader.prepare("SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name = 'dd_flow_writer_migrations'").get()
+                ? reader.prepare("SELECT receipt_json FROM dd_flow_writer_migrations WHERE backup_path = ?").get(destination) : null;
+            const receipt = recorded ? JSON.parse(String(recorded.receipt_json)) : null;
+            if (!receipt || receipt.database !== file || receipt.backup !== backup || receipt.writer_version !== readStoreWriterContract(reader) || receipt.backup_sha256 !== crypto.createHash("sha256").update(fs.readFileSync(backup)).digest("hex")) {
+                throw new AppError("store_migration_path_invalid", "Existing backup has no matching committed migration receipt", 1);
+            }
+            return receipt;
+        }, () => reader.close());
+    }
+    const db = new DatabaseSync(file);
+    let committed = false;
+    return withStoreCleanup(() => {
+        db.exec("PRAGMA busy_timeout = 1000");
+        registerStoreWriter(db);
+        db.exec("BEGIN IMMEDIATE");
+        try {
+            const previous = readStoreWriterContract(db);
+            const tables = new Set(db.prepare("SELECT name FROM sqlite_schema WHERE type = 'table'").all().map(row => row.name));
+            const gates = [
+                ["managed_processes", "state IS NULL OR state NOT IN ('stopped','failed')"],
+                ["run_controllers", "status IS NULL OR status NOT IN ('completed','stop_target_reached','cancelled','superseded')"],
+                ["run_control_workers", "status IS NULL OR status NOT IN ('completed','failed','superseded')"],
+                ["work_sessions", "status IS NULL OR status NOT IN ('completed','failed','cancelled')"]
+            ];
+            for (const [table, predicate] of gates) {
+                if (tables.has(table) && db.prepare(`SELECT 1 FROM ${table} WHERE ${predicate} LIMIT 1`).get())
+                    throw new AppError("store_migration_not_drained", "Store still contains unresolved writer ownership", 1, { table });
+            }
+            // Explicit drained cutover, not a live-runtime writer path: keep backup, durability
+            // and hash inside this barrier so the receipt describes exactly the fenced source.
+            // A separate reader sees committed WAL while this connection prevents new writes.
+            const reader = new DatabaseSync(file, { readOnly: true });
+            withStoreCleanup(() => reader.exec(`VACUUM INTO '${backup.replaceAll("'", "''")}'`), () => reader.close());
+            const descriptor = fs.openSync(backup, "r");
+            withStoreCleanup(() => fs.fsyncSync(descriptor), () => fs.closeSync(descriptor));
+            const directory = fs.openSync(path.dirname(backup), "r");
+            withStoreCleanup(() => fs.fsyncSync(directory), () => fs.closeSync(directory));
+            const verification = new DatabaseSync(backup, { readOnly: true });
+            withStoreCleanup(() => {
+                const check = verification.prepare("PRAGMA integrity_check").get();
+                if (Object.values(check)[0] !== "ok" || readStoreWriterContract(verification) !== previous)
+                    throw new AppError("store_migration_backup_invalid", "Backup failed integrity or contract verification", 1);
+            }, () => verification.close());
+            const receipt = { database: file, backup, backup_sha256: crypto.createHash("sha256").update(fs.readFileSync(backup)).digest("hex"), previous_version: previous, writer_version: STORE_WRITER_VERSION };
+            db.exec("CREATE TABLE IF NOT EXISTS dd_flow_writer_migrations (backup_path TEXT PRIMARY KEY, receipt_json TEXT NOT NULL)");
+            db.prepare("INSERT INTO dd_flow_writer_migrations VALUES (?, ?)").run(destination, JSON.stringify(receipt));
+            installStoreWriterContract(db);
+            db.exec("COMMIT");
+            committed = true;
+            return receipt;
+        }
+        catch (error) {
+            rollbackStoreTransaction(db, "ROLLBACK", error);
+        }
+    }, () => { if (db.isOpen)
+        db.close(); }, () => ({ effect: committed ? "committed" : "uncommitted" }));
+}

package/package.json

@@ -1,10 +1,16 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.11",
+  "version": "0.9.0-beta.111",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "bin": {
-    "dd-flow": "./dist/cli.js"
+    "dd-flow": "dist/cli.js",
+    "dd-codex": "dist/harness-runtime/bin/dd-codex.mjs",
+    "dd-zcode": "dist/harness-runtime/bin/dd-zcode.mjs",
+    "dd-grok": "dist/harness-runtime/bin/dd-grok.mjs",
+    "dd-opencode": "dist/harness-runtime/bin/dd-opencode.mjs",
+    "dd-agy": "dist/harness-runtime/bin/dd-agy.mjs",
+    "dd-droid": "dist/harness-runtime/bin/dd-droid.mjs"
   },
   "files": [
     "dist",
@@ -16,6 +22,20 @@
     "node": ">=26.0.0",
     "pnpm": ">=10.0.0"
   },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && node scripts/generate-build-info.mjs && node scripts/copy-assets.mjs",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint . --max-warnings=0",
+    "test": "pnpm test:release && pnpm test:integration && pnpm test:runtime-sensitive",
+    "test:release": "node --test scripts/verify-release-build.test.mjs && vitest run --pool=forks --no-file-parallelism test/publish-release.test.ts",
+    "test:integration": "vitest run --pool=forks --no-file-parallelism --exclude test/publish-release.test.ts --exclude test/run-control-worker.test.ts --exclude test/native-adapter-contracts.test.ts",
+    "test:runtime-sensitive": "vitest run --pool=forks --no-file-parallelism test/run-control-worker.test.ts test/native-adapter-contracts.test.ts",
+    "changeset": "changeset",
+    "version-packages": "changeset version",
+    "release:candidate:pack": "node scripts/release-candidate.mjs pack",
+    "release:candidate:accept": "node scripts/release-candidate.mjs accept",
+    "release:publish": "node scripts/publish-release.mjs"
+  },
   "devDependencies": {
     "@changesets/cli": "^2.31.0",
     "@eslint/js": "^9.39.1",
@@ -34,14 +54,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "license": "MIT",
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json && node scripts/generate-build-info.mjs && node scripts/copy-assets.mjs",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint . --max-warnings=0",
-    "test": "vitest run",
-    "changeset": "changeset",
-    "version-packages": "changeset version",
-    "release": "pnpm run build && changeset publish"
-  }
-}
+  "license": "MIT"
+}