@deksden-com/dd-flow-cli 0.9.0-beta.144 → 0.9.0-beta.149

package/dist/storage/writer-migration.js

@@ -3,16 +3,21 @@ import path from "node:path";
 import crypto from "node:crypto";
 import { DatabaseSync } from "node:sqlite";
 import { AppError } from "../shared/errors.js";
-import { installStoreWriterContract, readStoreWriterContract, registerStoreWriter, STORE_WRITER_VERSION } from "./writer-contract.js";
+import { installStoreWriterContract, readStoreWriterContract, registerReconciliationWriter, STORE_WRITER_VERSION } from "./writer-contract.js";
 import { rollbackStoreTransaction, withStoreCleanup } from "./native-cleanup.js";
+import { captureStoreData, verifyStoreData } from "./data-preservation.js";
+import { publishImmutableInput } from "./immutable-input.js";
 /** Explicit one-store cutover. The caller must separately drain external owners. */
-export function migrateStoreWriter(file, backup) {
+export function migrateStoreWriter(file, backup, request) {
+    if (request !== undefined && !(request instanceof PreparedStoreWriterMigration))
+        throw new AppError("store_migration_request_invalid", "Migration request must be prepared", 1);
+    request?.assertBinding(file, backup);
     if (!path.isAbsolute(file) || !path.isAbsolute(backup) || file === backup || !fs.existsSync(file) || !fs.statSync(file).isFile())
         throw new AppError("store_migration_path_invalid", "Migration requires an existing database and a new absolute backup path", 1);
     const source = fs.realpathSync(file);
     const destination = path.join(fs.realpathSync(path.dirname(backup)), path.basename(backup));
-    if (fs.lstatSync(file).isSymbolicLink() || [source, `${source}-wal`, `${source}-shm`, `${source}-journal`].includes(destination))
-        throw new AppError("store_migration_path_invalid", "Backup cannot alias the source database or its SQLite sidecars", 1);
+    if (fs.lstatSync(file).isSymbolicLink() || fs.lstatSync(file).nlink !== 1 || [source, `${source}-wal`, `${source}-shm`, `${source}-journal`].includes(destination))
+        throw new AppError("store_migration_path_invalid", "Source must have one physical owner and backup cannot alias it or its SQLite sidecars", 1);
     let existing;
     try {
         existing = fs.lstatSync(backup);
@@ -26,60 +31,316 @@ export function migrateStoreWriter(file, backup) {
             throw new AppError("store_migration_path_invalid", "Backup path already exists", 1);
         const reader = new DatabaseSync(file, { readOnly: true });
         return withStoreCleanup(() => {
-            const recorded = reader.prepare("SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name = 'dd_flow_writer_migrations'").get()
-                ? reader.prepare("SELECT receipt_json FROM dd_flow_writer_migrations WHERE backup_path = ?").get(destination) : null;
-            const receipt = recorded ? JSON.parse(String(recorded.receipt_json)) : null;
+            const receipt = recordedMigration(reader, destination);
+            if (!receipt && request)
+                return null;
             if (!receipt || receipt.database !== file || receipt.backup !== backup || receipt.writer_version !== readStoreWriterContract(reader) || receipt.backup_sha256 !== crypto.createHash("sha256").update(fs.readFileSync(backup)).digest("hex")) {
                 throw new AppError("store_migration_path_invalid", "Existing backup has no matching committed migration receipt", 1);
             }
+            if (request && (receipt.request_sha256 !== request.sha256 || receipt.request_id !== request.requestId))
+                unknownOutcome("foreign_committed_receipt");
             return receipt;
-        }, () => reader.close());
-    }
-    const db = new DatabaseSync(file);
-    let committed = false;
-    return withStoreCleanup(() => {
-        db.exec("PRAGMA busy_timeout = 1000");
-        registerStoreWriter(db);
-        db.exec("BEGIN IMMEDIATE");
-        try {
-            const previous = readStoreWriterContract(db);
-            const tables = new Set(db.prepare("SELECT name FROM sqlite_schema WHERE type = 'table'").all().map(row => row.name));
-            const gates = [
-                ["managed_processes", "state IS NULL OR state NOT IN ('stopped','failed')"],
-                ["run_controllers", "status IS NULL OR status NOT IN ('completed','stop_target_reached','cancelled','superseded')"],
-                ["run_control_workers", "status IS NULL OR status NOT IN ('completed','failed','superseded')"],
-                ["work_sessions", "status IS NULL OR status NOT IN ('completed','failed','cancelled')"]
-            ];
-            for (const [table, predicate] of gates) {
-                if (tables.has(table) && db.prepare(`SELECT 1 FROM ${table} WHERE ${predicate} LIMIT 1`).get())
-                    throw new AppError("store_migration_not_drained", "Store still contains unresolved writer ownership", 1, { table });
+        }, () => reader.close()) ?? resumePrepared();
+    }
+    return resumePrepared();
+    function resumePrepared() {
+        const db = new DatabaseSync(file);
+        let committed = false;
+        return withStoreCleanup(() => {
+            db.exec("PRAGMA busy_timeout = 1000");
+            registerReconciliationWriter(db);
+            db.exec("BEGIN IMMEDIATE");
+            try {
+                const original = request?.assertOriginal(db);
+                const previous = readStoreWriterContract(db);
+                assertStoreWriterDrain(db);
+                const preservedData = original ?? captureStoreData(db);
+                // Explicit drained cutover, not a live-runtime writer path: keep backup, durability
+                // and hash inside this barrier so the receipt describes exactly the fenced source.
+                // A separate reader sees committed WAL while this connection prevents new writes.
+                const backupSha256 = verifiedBackup(file, backup, !existing, previous, preservedData, request);
+                const receipt = { database: file, backup, backup_sha256: backupSha256, previous_version: previous, writer_version: STORE_WRITER_VERSION,
+                    ...(request ? { request_id: request.requestId, request_sha256: request.sha256 } : {}),
+                    data_preservation: { schema_id: "dd-flow/store-data-preservation@1", tables: preservedData } };
+                db.exec("CREATE TABLE IF NOT EXISTS dd_flow_writer_migrations (backup_path TEXT PRIMARY KEY, receipt_json TEXT NOT NULL)");
+                // Upgrade only the known historical writer contract. Its existing fence
+                // admits this connection as v1 until the row changes in this transaction;
+                // install then registers v2 and publishes replacement fences atomically.
+                if (previous === 1)
+                    db.prepare("UPDATE dd_flow_writer_contract SET version=? WHERE id=1 AND version=1").run(STORE_WRITER_VERSION);
+                installStoreWriterContract(db);
+                db.prepare("INSERT INTO dd_flow_writer_migrations VALUES (?, ?)").run(destination, JSON.stringify(receipt));
+                verifyStoreData(db, preservedData);
+                db.exec("COMMIT");
+                committed = true;
+                return receipt;
             }
-            // Explicit drained cutover, not a live-runtime writer path: keep backup, durability
-            // and hash inside this barrier so the receipt describes exactly the fenced source.
-            // A separate reader sees committed WAL while this connection prevents new writes.
-            const reader = new DatabaseSync(file, { readOnly: true });
-            withStoreCleanup(() => reader.exec(`VACUUM INTO '${backup.replaceAll("'", "''")}'`), () => reader.close());
-            const descriptor = fs.openSync(backup, "r");
-            withStoreCleanup(() => fs.fsyncSync(descriptor), () => fs.closeSync(descriptor));
-            const directory = fs.openSync(path.dirname(backup), "r");
-            withStoreCleanup(() => fs.fsyncSync(directory), () => fs.closeSync(directory));
-            const verification = new DatabaseSync(backup, { readOnly: true });
-            withStoreCleanup(() => {
-                const check = verification.prepare("PRAGMA integrity_check").get();
-                if (Object.values(check)[0] !== "ok" || readStoreWriterContract(verification) !== previous)
-                    throw new AppError("store_migration_backup_invalid", "Backup failed integrity or contract verification", 1);
-            }, () => verification.close());
-            const receipt = { database: file, backup, backup_sha256: crypto.createHash("sha256").update(fs.readFileSync(backup)).digest("hex"), previous_version: previous, writer_version: STORE_WRITER_VERSION };
-            db.exec("CREATE TABLE IF NOT EXISTS dd_flow_writer_migrations (backup_path TEXT PRIMARY KEY, receipt_json TEXT NOT NULL)");
-            db.prepare("INSERT INTO dd_flow_writer_migrations VALUES (?, ?)").run(destination, JSON.stringify(receipt));
-            installStoreWriterContract(db);
-            db.exec("COMMIT");
-            committed = true;
-            return receipt;
+            catch (error) {
+                rollbackStoreTransaction(db, "ROLLBACK", error);
+            }
+        }, () => { if (db.isOpen)
+            db.close(); }, () => ({ effect: committed ? "committed" : "uncommitted" }));
+    }
+}
+/** Caller holds the source writer barrier; a separate reader includes committed
+ * WAL in the durable copy. Shared by backup-only preparation and cutover. */
+function verifiedBackup(file, backup, create, previous, preservedData, request) {
+    const reader = new DatabaseSync(file, { readOnly: true });
+    withStoreCleanup(() => { if (create)
+        reader.exec(`VACUUM INTO '${backup.replaceAll("'", "''")}'`); }, () => reader.close());
+    const descriptor = fs.openSync(backup, "r");
+    withStoreCleanup(() => fs.fsyncSync(descriptor), () => fs.closeSync(descriptor));
+    const directory = fs.openSync(path.dirname(backup), "r");
+    withStoreCleanup(() => fs.fsyncSync(directory), () => fs.closeSync(directory));
+    const verification = new DatabaseSync(backup, { readOnly: true });
+    withStoreCleanup(() => {
+        const check = verification.prepare("PRAGMA integrity_check").get();
+        if (Object.values(check)[0] !== "ok" || readStoreWriterContract(verification) !== previous)
+            throw new AppError("store_migration_backup_invalid", "Backup failed integrity or contract verification", 1);
+        verifyStoreData(verification, preservedData);
+        request?.assertBackup(verification);
+    }, () => verification.close());
+    return crypto.createHash("sha256").update(fs.readFileSync(backup)).digest("hex");
+}
+function assertStoreWriterDrain(db) {
+    const tables = new Set(db.prepare("SELECT name FROM sqlite_schema WHERE type='table'").all().map(row => String(row.name)));
+    const gates = [
+        ["managed_processes", "state IS NULL OR state NOT IN ('stopped','failed')"],
+        ["run_controllers", "status IS NULL OR status NOT IN ('completed','stop_target_reached','cancelled','superseded')"],
+        ["run_control_workers", "status IS NULL OR status NOT IN ('completed','failed','superseded')"],
+        ["merge_requests", "status IS NULL OR status NOT IN ('completed','failed','cancelled','superseded')"],
+        ["work_sessions", "status IS NULL OR status NOT IN ('completed','failed','cancelled')"]
+    ];
+    for (const [table, predicate] of gates)
+        if (tables.has(table) && db.prepare(`SELECT 1 FROM ${table} WHERE ${predicate} LIMIT 1`).get())
+            throw new AppError("store_migration_not_drained", "Store still contains unresolved writer ownership", 1, { table });
+}
+function recordedMigration(db, backup) {
+    const row = db.prepare("SELECT 1 FROM sqlite_schema WHERE type='table' AND name='dd_flow_writer_migrations'").get()
+        ? db.prepare("SELECT receipt_json FROM dd_flow_writer_migrations WHERE backup_path=?").get(backup) : null;
+    return row ? JSON.parse(String(row.receipt_json)) : null;
+}
+function unknownOutcome(reason) {
+    throw new AppError("store_migration_outcome_unknown", "Reconcile this exact migration request before another apply or explicit recovery", 1, { reason, effect: "unknown", next_action: "reconcile_exact_request" });
+}
+const requestHash = (bytes) => crypto.createHash("sha256").update(bytes).digest("hex");
+function footprintExists(file) {
+    try {
+        fs.lstatSync(file);
+        return true;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+function sourceState(db) {
+    return { writer_version: readStoreWriterContract(db), tables: captureStoreData(db),
+        metadata: { user_version: db.prepare("PRAGMA user_version").get(), application_id: db.prepare("PRAGMA application_id").get(), encoding: db.prepare("PRAGMA encoding").get() },
+        schema: db.prepare("SELECT type,name,tbl_name,sql FROM sqlite_schema ORDER BY type,name").all(),
+        migration_receipts: db.prepare("SELECT 1 FROM sqlite_schema WHERE name='dd_flow_writer_migrations' AND type='table'").get()
+            ? db.prepare("SELECT backup_path,receipt_json FROM dd_flow_writer_migrations ORDER BY backup_path").all() : [] };
+}
+/** One-store request dependency, not shared physical drain or engine-schema
+ * migration. Its immutable intent lives outside the migrated DB. Restore needs
+ * the independently retained digest, never a freshly selected replacement plan.
+ */
+export class PreparedStoreWriterMigration {
+    sha256;
+    requestId;
+    #file;
+    #intent;
+    #bytes;
+    constructor(file, intent) {
+        this.#file = file;
+        this.#intent = structuredClone(intent);
+        this.#bytes = JSON.stringify(intent);
+        if (Buffer.byteLength(this.#bytes) > 4 * 1024 * 1024)
+            throw new AppError("store_migration_request_invalid", "Migration request exceeds its supported bound", 1);
+        this.sha256 = requestHash(this.#bytes);
+        this.requestId = intent.request_id;
+        Object.freeze(this);
+    }
+    static prepare(input) {
+        if (typeof input.requestId !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,95}$/.test(input.requestId))
+            throw new AppError("store_migration_request_invalid", "Invalid migration request ID", 2);
+        for (const file of [input.database, input.backup, input.requestFile]) {
+            if (!path.isAbsolute(file) || path.join(fs.realpathSync(path.dirname(file)), path.basename(file)) !== file)
+                throw new AppError("store_migration_request_invalid", "Migration requires canonical absolute paths", 2);
+        }
+        if (new Set([input.database, input.backup, input.requestFile]).size !== 3 || footprintExists(input.backup) || footprintExists(input.requestFile))
+            throw new AppError("store_migration_request_invalid", "Restore an existing request; do not replace its plan or backup", 1);
+        if ([input.database, input.backup].some(file => ["-wal", "-shm", "-journal"].some(suffix => [input.backup, input.requestFile].includes(file + suffix))))
+            throw new AppError("store_migration_request_invalid", "Request and backup must not alias SQLite sidecars", 1);
+        const owner = fs.lstatSync(input.database);
+        if (!owner.isFile() || owner.nlink !== 1)
+            throw new AppError("store_migration_path_invalid", "Migration requires one regular source owner", 1);
+        const db = new DatabaseSync(input.database, { readOnly: true });
+        return withStoreCleanup(() => {
+            db.exec("BEGIN");
+            assertStoreWriterDrain(db);
+            const source = sourceState(db);
+            if (source.writer_version !== null && ![1, STORE_WRITER_VERSION].includes(source.writer_version))
+                throw new AppError("store_writer_incompatible", "Unsupported source writer contract", 1);
+            return new PreparedStoreWriterMigration(input.requestFile, { schema_id: "dd-flow/store-writer-migration-request@1", request_id: input.requestId,
+                database: input.database, backup: input.backup, source_owner: { dev: owner.dev, ino: owner.ino }, source, writer_version: STORE_WRITER_VERSION });
+        }, () => db.close());
+    }
+    static restore(requestFile, expectedSha256) {
+        const stat = fs.lstatSync(requestFile);
+        if (!stat.isFile() || stat.size > 4 * 1024 * 1024)
+            unknownOutcome("invalid_request_file");
+        const bytes = fs.readFileSync(requestFile, "utf8");
+        return this.restoreInput(requestFile, bytes, expectedSha256);
+    }
+    /** A paired request retains these exact child bytes before any cutover. */
+    static restoreInput(requestFile, bytes, expectedSha256) {
+        if (!path.isAbsolute(requestFile) || Buffer.byteLength(bytes) > 4 * 1024 * 1024)
+            unknownOutcome("invalid_request_file");
+        if (!/^[a-f0-9]{64}$/.test(expectedSha256) || requestHash(bytes) !== expectedSha256)
+            unknownOutcome("request_changed");
+        const intent = JSON.parse(bytes);
+        if (!intent || Object.keys(intent).sort().join() !== "backup,database,request_id,schema_id,source,source_owner,writer_version"
+            || intent.schema_id !== "dd-flow/store-writer-migration-request@1" || intent.writer_version !== STORE_WRITER_VERSION
+            || typeof intent.request_id !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,95}$/.test(intent.request_id)
+            || !intent.source || !Array.isArray(intent.source.tables) || !Array.isArray(intent.source.schema) || !Array.isArray(intent.source.migration_receipts)
+            || !intent.source_owner || !Number.isSafeInteger(intent.source_owner.dev) || !Number.isSafeInteger(intent.source_owner.ino)
+            || !path.isAbsolute(intent.database) || !path.isAbsolute(intent.backup))
+            unknownOutcome("invalid_request");
+        const prepared = new PreparedStoreWriterMigration(requestFile, intent);
+        if (prepared.sha256 !== expectedSha256)
+            unknownOutcome("noncanonical_request");
+        return prepared;
+    }
+    inputArtifact() { return { path: this.#file, sha256: this.sha256, base64: Buffer.from(this.#bytes).toString("base64") }; }
+    assertBinding(file, backup) {
+        if (file !== this.#intent.database || backup !== this.#intent.backup)
+            unknownOutcome("foreign_store_scope");
+        const owner = fs.lstatSync(file);
+        if (!owner.isFile() || owner.nlink !== 1 || owner.dev !== this.#intent.source_owner.dev || owner.ino !== this.#intent.source_owner.ino)
+            unknownOutcome("source_owner_changed");
+        if (footprintExists(backup) && !fs.lstatSync(backup).isFile())
+            unknownOutcome("invalid_backup_path");
+        if (requestHash(fs.readFileSync(this.#file)) !== this.sha256)
+            unknownOutcome("request_changed");
+    }
+    assertOriginal(db) {
+        const owner = fs.lstatSync(this.#intent.database);
+        const current = sourceState(db);
+        if (owner.dev !== this.#intent.source_owner.dev || owner.ino !== this.#intent.source_owner.ino || owner.nlink !== 1
+            || requestHash(JSON.stringify(current)) !== requestHash(JSON.stringify(this.#intent.source)))
+            unknownOutcome("source_changed");
+        return current.tables;
+    }
+    assertBackup(db) {
+        if (requestHash(JSON.stringify(sourceState(db))) !== requestHash(JSON.stringify(this.#intent.source)))
+            unknownOutcome("backup_not_original");
+    }
+    /** Read-only outcome inspection; unknown never authorizes another apply. */
+    reconcile() {
+        try {
+            this.assertBinding(this.#intent.database, this.#intent.backup);
+            const db = new DatabaseSync(this.#intent.database, { readOnly: true });
+            return withStoreCleanup(() => {
+                db.exec("BEGIN");
+                const receipt = recordedMigration(db, this.#intent.backup);
+                if (receipt) {
+                    if (receipt.request_sha256 !== this.sha256 || receipt.request_id !== this.requestId || receipt.database !== this.#intent.database
+                        || receipt.backup !== this.#intent.backup || receipt.writer_version !== readStoreWriterContract(db)
+                        || receipt.backup_sha256 !== requestHash(fs.readFileSync(this.#intent.backup)))
+                        unknownOutcome("committed_receipt_changed");
+                    return { status: "applied", receipt };
+                }
+                this.assertOriginal(db);
+                if (fs.existsSync(this.#intent.backup)) {
+                    const backup = new DatabaseSync(this.#intent.backup, { readOnly: true });
+                    withStoreCleanup(() => {
+                        const check = backup.prepare("PRAGMA integrity_check").get();
+                        if (!check || Object.values(check)[0] !== "ok")
+                            unknownOutcome("backup_invalid");
+                        this.assertBackup(backup);
+                    }, () => backup.close());
+                }
+                return { status: "not_applied" };
+            }, () => db.close());
         }
         catch (error) {
-            rollbackStoreTransaction(db, "ROLLBACK", error);
+            return { status: "unknown", reason: error instanceof AppError ? String(error.details.reason ?? error.code) : "outcome_unavailable" };
         }
-    }, () => { if (db.isOpen)
-        db.close(); }, () => ({ effect: committed ? "committed" : "uncommitted" }));
+    }
+    /** Publish a plan without cutover. Retention is not current drain/readiness. */
+    retain() {
+        publishImmutableInput(this.#file, Buffer.from(this.#bytes), "store_migration_request_conflict");
+        return { request_id: this.requestId, request_file: this.#file, sha256: this.sha256 };
+    }
+    recoveryReference() {
+        this.assertBinding(this.#intent.database, this.#intent.backup);
+        return { database: this.#intent.database, backup: this.#intent.backup, migration_sha256: this.sha256 };
+    }
+    /** Read back the actual original backup, not caller-proposed evidence. */
+    backupFacts() {
+        this.assertBinding(this.#intent.database, this.#intent.backup);
+        const db = new DatabaseSync(this.#intent.backup, { readOnly: true });
+        withStoreCleanup(() => {
+            const check = db.prepare("PRAGMA integrity_check").get();
+            if (!check || Object.values(check)[0] !== "ok")
+                unknownOutcome("backup_invalid");
+            this.assertBackup(db);
+        }, () => db.close());
+        return { database: this.#intent.database, backup: this.#intent.backup, backup_sha256: requestHash(fs.readFileSync(this.#intent.backup)),
+            source_request_sha256: this.sha256, source_writer_version: this.#intent.source.writer_version,
+            source_data_sha256: requestHash(JSON.stringify(this.#intent.source.tables)) };
+    }
+    /** Called after cutover and before admitting other runtime writes. */
+    verifyAppliedData() {
+        const observed = this.reconcile();
+        if (observed.status !== "applied")
+            unknownOutcome("applied_receipt_missing");
+        const db = new DatabaseSync(this.#intent.database, { readOnly: true });
+        withStoreCleanup(() => {
+            db.exec("BEGIN");
+            if (db.prepare("PRAGMA quick_check").get()?.quick_check !== "ok" || db.prepare("PRAGMA foreign_key_check").get()
+                || readStoreWriterContract(db) !== STORE_WRITER_VERSION)
+                unknownOutcome("applied_integrity_failed");
+            verifyStoreData(db, this.#intent.source.tables);
+        }, () => db.close());
+        return { database: this.#intent.database, source_request_sha256: this.sha256, writer_version: STORE_WRITER_VERSION,
+            source_data_sha256: requestHash(JSON.stringify(this.#intent.source.tables)), integrity: "ok", foreign_key_violations: 0 };
+    }
+    /** Durable verified copy without changing schema or writer contract. */
+    backup() {
+        this.retain();
+        const outcome = this.reconcile();
+        if (outcome.status === "unknown")
+            unknownOutcome(outcome.reason ?? "outcome_unavailable");
+        if (outcome.status === "applied")
+            return;
+        const db = new DatabaseSync(this.#intent.database);
+        withStoreCleanup(() => {
+            db.exec("PRAGMA busy_timeout=1000");
+            registerReconciliationWriter(db);
+            db.exec("BEGIN IMMEDIATE");
+            try {
+                this.assertBinding(this.#intent.database, this.#intent.backup);
+                const data = this.assertOriginal(db);
+                assertStoreWriterDrain(db);
+                verifiedBackup(this.#intent.database, this.#intent.backup, !fs.existsSync(this.#intent.backup), readStoreWriterContract(db), data, this);
+                db.exec("COMMIT");
+            }
+            catch (error) {
+                rollbackStoreTransaction(db, "ROLLBACK", error);
+            }
+        }, () => db.close());
+    }
+    apply() {
+        this.retain();
+        const outcome = this.reconcile();
+        if (outcome.status === "unknown")
+            unknownOutcome(outcome.reason ?? "outcome_unavailable");
+        if (outcome.status === "applied")
+            return outcome.receipt;
+        return migrateStoreWriter(this.#intent.database, this.#intent.backup, this);
+    }
 }
+export { sourceState as captureStoreMigrationState, assertStoreWriterDrain };

package/dist/storage/writer-restore.js

@@ -0,0 +1,217 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { DatabaseSync } from "node:sqlite";
+import { AppError } from "../shared/errors.js";
+import { PreparedStoreWriterMigration, captureStoreMigrationState, assertStoreWriterDrain } from "./writer-migration.js";
+import { registerReconciliationWriter } from "./writer-contract.js";
+import { publishImmutableInput } from "./immutable-input.js";
+import { rollbackStoreTransaction, withStoreCleanup } from "./native-cleanup.js";
+const hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const quote = (name) => `"${name.replaceAll('"', '""')}"`;
+function refuse(reason) {
+    throw new AppError("store_restore_outcome_unknown", "Restore requires its exact recorded recovery scope and verified old backup", 1, { reason, effect: "unknown", next_action: "reconcile_exact_recovery" });
+}
+function state(db) {
+    const snapshot = captureStoreMigrationState(db);
+    // Empty SQLite housekeeping left by a dropped AUTOINCREMENT/statistics table
+    // is not product state. Nonempty sequence values remain preservation facts.
+    return { ...snapshot, schema: snapshot.schema.filter(row => !String(row.name).startsWith("sqlite_")),
+        tables: snapshot.tables.filter(table => !table.table.startsWith("sqlite_") || table.row_count > 0) };
+}
+function supported(db) {
+    if (db.prepare("SELECT 1 FROM sqlite_schema WHERE type='table' AND upper(sql) LIKE 'CREATE VIRTUAL TABLE%' LIMIT 1").get())
+        throw new AppError("store_restore_schema_unsupported", "Transactional runtime restoration does not execute virtual-table modules", 1);
+}
+/** Explicit single-store rollback, never an apply retry. External/shared
+ * physical drain is the bootstrap owner's dependency; logical store ownership
+ * is checked here before preparation and again inside the exclusive writer.
+ * File identity stays unchanged; all schema/data replacement is one transaction.
+ */
+export class PreparedStoreWriterRestore {
+    sha256;
+    #migration;
+    #file;
+    #intent;
+    #bytes;
+    constructor(migration, file, intent) {
+        this.#migration = migration;
+        this.#file = file;
+        this.#intent = structuredClone(intent);
+        this.#bytes = JSON.stringify(intent);
+        this.sha256 = hash(this.#bytes);
+        Object.freeze(this);
+    }
+    static prepare(migration, input) {
+        if (!(migration instanceof PreparedStoreWriterMigration) || typeof input.recoveryId !== "string"
+            || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,95}$/.test(input.recoveryId))
+            refuse("unprepared_recovery_scope");
+        const reference = migration.recoveryReference();
+        if (!path.isAbsolute(input.requestFile) || path.join(fs.realpathSync(path.dirname(input.requestFile)), path.basename(input.requestFile)) !== input.requestFile)
+            refuse("noncanonical_recovery_path");
+        const paths = [reference.database, reference.backup].flatMap(file => [file, file + "-wal", file + "-shm", file + "-journal"]);
+        if (paths.includes(input.requestFile) || paths.includes(input.requestFile + ".result.json"))
+            refuse("recovery_path_alias");
+        for (const file of [input.requestFile, input.requestFile + ".result.json"]) {
+            try {
+                fs.lstatSync(file);
+            }
+            catch (error) {
+                if (error.code === "ENOENT")
+                    continue;
+                throw error;
+            }
+            refuse("restore_existing_recovery_request");
+        }
+        const backup = new DatabaseSync(reference.backup, { readOnly: true });
+        const restored = withStoreCleanup(() => {
+            backup.exec("BEGIN");
+            migration.assertBackup(backup);
+            supported(backup);
+            if (backup.prepare("PRAGMA integrity_check").get()?.integrity_check !== "ok" || backup.prepare("PRAGMA foreign_key_check").get())
+                refuse("backup_invalid");
+            return hash(JSON.stringify(state(backup)));
+        }, () => backup.close());
+        const current = new DatabaseSync(reference.database, { readOnly: true });
+        const before = withStoreCleanup(() => {
+            current.exec("BEGIN");
+            assertStoreWriterDrain(current);
+            supported(current);
+            return hash(JSON.stringify(state(current)));
+        }, () => current.close());
+        return new PreparedStoreWriterRestore(migration, input.requestFile, { schema_id: "dd-flow/store-writer-restore-request@1", recovery_id: input.recoveryId,
+            ...reference, backup_sha256: hash(fs.readFileSync(reference.backup)), before_sha256: before, restored_sha256: restored });
+    }
+    static restore(migration, file, expectedSha256) {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.size > 16 * 1024)
+            refuse("invalid_recovery_request");
+        const bytes = fs.readFileSync(file, "utf8");
+        migration.recoveryReference();
+        return this.restoreInput(migration, file, bytes, expectedSha256);
+    }
+    static restoreInput(migration, file, bytes, expectedSha256) {
+        if (!(migration instanceof PreparedStoreWriterMigration) || !path.isAbsolute(file) || Buffer.byteLength(bytes) > 16 * 1024)
+            refuse("invalid_recovery_request");
+        if (!/^[a-f0-9]{64}$/.test(expectedSha256) || hash(bytes) !== expectedSha256)
+            refuse("recovery_request_changed");
+        const original = JSON.parse(Buffer.from(migration.inputArtifact().base64, "base64").toString("utf8"));
+        const value = JSON.parse(bytes), reference = { database: original.database, backup: original.backup, migration_sha256: migration.sha256 };
+        if (!value || Object.keys(value).sort().join() !== "backup,backup_sha256,before_sha256,database,migration_sha256,recovery_id,restored_sha256,schema_id"
+            || value.schema_id !== "dd-flow/store-writer-restore-request@1" || value.database !== reference.database || value.backup !== reference.backup
+            || value.migration_sha256 !== reference.migration_sha256 || typeof value.recovery_id !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,95}$/.test(value.recovery_id)
+            || [value.backup_sha256, value.before_sha256, value.restored_sha256].some(digest => typeof digest !== "string" || !/^[a-f0-9]{64}$/.test(digest)))
+            refuse("foreign_recovery_request");
+        const prepared = new PreparedStoreWriterRestore(migration, file, value);
+        if (prepared.sha256 !== expectedSha256)
+            refuse("noncanonical_recovery_request");
+        return prepared;
+    }
+    inputArtifact() { return { path: this.#file, sha256: this.sha256, base64: Buffer.from(this.#bytes).toString("base64") }; }
+    retain() {
+        publishImmutableInput(this.#file, Buffer.from(this.#bytes), "store_restore_request_conflict");
+        return { request_file: this.#file, sha256: this.sha256, recovery_id: this.#intent.recovery_id };
+    }
+    assertInputs(retained = true) {
+        this.#migration.recoveryReference();
+        if (["-wal", "-shm", "-journal"].some(suffix => fs.existsSync(this.#intent.backup + suffix)))
+            refuse("backup_has_live_sidecars");
+        if (retained && hash(fs.readFileSync(this.#file)) !== this.sha256 || hash(fs.readFileSync(this.#intent.backup)) !== this.#intent.backup_sha256)
+            refuse("recovery_inputs_changed");
+    }
+    observe(retained) {
+        try {
+            this.assertInputs(retained);
+            const db = new DatabaseSync(this.#intent.database, { readOnly: true });
+            return withStoreCleanup(() => {
+                db.exec("BEGIN");
+                const actual = hash(JSON.stringify(state(db)));
+                if (actual === this.#intent.restored_sha256)
+                    return { status: "restored" };
+                return actual === this.#intent.before_sha256 ? { status: "not_restored" } : { status: "unknown", reason: "target_changed" };
+            }, () => db.close());
+        }
+        catch (error) {
+            return { status: "unknown", reason: error instanceof AppError ? String(error.details.reason ?? error.code) : "outcome_unavailable" };
+        }
+    }
+    reconcile() { return this.observe(true); }
+    /** Check a prepared child before a paired parent publishes recovery custody. */
+    revalidatePrepared() { const observed = this.observe(false); if (observed.status === "unknown")
+        refuse(observed.reason ?? "target_changed"); }
+    finish() {
+        const receipt = { schema_id: "dd-flow/store-writer-restore-receipt@1", recovery_id: this.#intent.recovery_id, request_sha256: this.sha256,
+            migration_sha256: this.#intent.migration_sha256, database: this.#intent.database, backup: this.#intent.backup, backup_sha256: this.#intent.backup_sha256,
+            restored_sha256: this.#intent.restored_sha256, status: "restored", changed: this.#intent.before_sha256 !== this.#intent.restored_sha256 };
+        try {
+            publishImmutableInput(this.#file + ".result.json", Buffer.from(JSON.stringify(receipt)), "store_restore_receipt_conflict");
+        }
+        catch (error) {
+            throw new AppError("store_restore_publication_pending", "Database restoration is committed; reconcile the same recovery to publish its receipt", 1, { effect: "committed", reason: error instanceof AppError ? error.code : "receipt_publication_failed", next_action: "reconcile_exact_recovery" });
+        }
+        return receipt;
+    }
+    apply() {
+        this.retain();
+        const observed = this.reconcile();
+        if (observed.status === "unknown")
+            refuse(observed.reason ?? "outcome_unavailable");
+        if (observed.status === "restored")
+            return this.finish();
+        let committed = false;
+        const backup = new DatabaseSync(this.#intent.backup, { readOnly: true });
+        withStoreCleanup(() => {
+            backup.exec("BEGIN");
+            this.#migration.assertBackup(backup);
+            supported(backup);
+            const db = new DatabaseSync(this.#intent.database);
+            withStoreCleanup(() => {
+                db.exec("PRAGMA busy_timeout=1000; PRAGMA foreign_keys=OFF");
+                registerReconciliationWriter(db);
+                db.exec("BEGIN EXCLUSIVE");
+                try {
+                    this.assertInputs();
+                    assertStoreWriterDrain(db);
+                    if (hash(JSON.stringify(state(db))) !== this.#intent.before_sha256)
+                        refuse("target_changed_before_restore");
+                    supported(db);
+                    for (const row of db.prepare("SELECT name FROM sqlite_schema WHERE type='view'").all())
+                        db.exec(`DROP VIEW ${quote(String(row.name))}`);
+                    for (const row of db.prepare("SELECT name FROM sqlite_schema WHERE type='table' AND name NOT LIKE 'sqlite_%'").all())
+                        db.exec(`DROP TABLE ${quote(String(row.name))}`);
+                    for (const row of backup.prepare("SELECT name,sql FROM sqlite_schema WHERE type='table' AND name NOT LIKE 'sqlite_%' ORDER BY name").all()) {
+                        const name = String(row.name);
+                        db.exec(String(row.sql));
+                        const columns = backup.prepare(`PRAGMA table_info(${quote(name)})`).all().map(column => String(column.name));
+                        const read = backup.prepare(`SELECT ${columns.map(quote).join(",")} FROM ${quote(name)}`);
+                        read.setReadBigInts(true);
+                        const insert = db.prepare(`INSERT INTO ${quote(name)} (${columns.map(quote).join(",")}) VALUES (${columns.map(() => "?").join(",")})`);
+                        for (const values of read.iterate())
+                            insert.run(...columns.map(column => values[column]));
+                    }
+                    if (db.prepare("SELECT 1 FROM sqlite_schema WHERE name='sqlite_sequence'").get()) {
+                        db.exec("DELETE FROM sqlite_sequence");
+                        if (backup.prepare("SELECT 1 FROM sqlite_schema WHERE name='sqlite_sequence'").get()) {
+                            const insert = db.prepare("INSERT INTO sqlite_sequence(name,seq) VALUES (?,?)"), read = backup.prepare("SELECT name,seq FROM sqlite_sequence");
+                            read.setReadBigInts(true);
+                            for (const row of read.iterate())
+                                insert.run(row.name, row.seq);
+                        }
+                    }
+                    for (const row of backup.prepare("SELECT sql FROM sqlite_schema WHERE type IN ('index','view','trigger') AND sql IS NOT NULL ORDER BY CASE type WHEN 'index' THEN 0 WHEN 'view' THEN 1 ELSE 2 END,name").all())
+                        db.exec(String(row.sql));
+                    for (const pragma of ["user_version", "application_id"])
+                        db.exec(`PRAGMA ${pragma}=${Number(backup.prepare(`PRAGMA ${pragma}`).get()[pragma])}`);
+                    if (hash(JSON.stringify(state(db))) !== this.#intent.restored_sha256 || db.prepare("PRAGMA foreign_key_check").get())
+                        refuse("restored_readback_failed");
+                    db.exec("COMMIT");
+                    committed = true;
+                }
+                catch (error) {
+                    rollbackStoreTransaction(db, "ROLLBACK", error);
+                }
+            }, () => db.close(), () => ({ effect: committed ? "committed" : "uncommitted", database: this.#intent.database }));
+        }, () => backup.close(), () => ({ effect: committed ? "committed" : "uncommitted", database: this.#intent.database }));
+        return this.finish();
+    }
+}