@elpapi42/pi-fleet 0.1.0-beta.10 → 0.1.0-beta.13

package/dist/journal-sqlite-worker.mjs

@@ -0,0 +1,1110 @@
+// src/store/journal-sqlite-worker.ts
+import { parentPort, workerData } from "node:worker_threads";
+
+// src/store/journal-worker-dispatch.ts
+async function dispatchJournalStoreRequest(store2, request) {
+  switch (request.method) {
+    case "createAgent":
+      return store2.createAgent(request.args[0]);
+    case "createAgentWithOperation":
+      return store2.createAgentWithOperation(
+        request.args[0],
+        request.args[1]
+      );
+    case "rollbackProvisionalCreate":
+      return store2.rollbackProvisionalCreate(
+        request.args[0],
+        request.args[1]
+      );
+    case "getAgentByName":
+      return store2.getAgentByName(request.args[0]);
+    case "getAgentById":
+      return store2.getAgentById(request.args[0]);
+    case "listAgents":
+      return store2.listAgents();
+    case "putAgent":
+      return store2.putAgent(request.args[0]);
+    case "putOperation":
+      return store2.putOperation(request.args[0]);
+    case "getOperation":
+      return store2.getOperation(request.args[0]);
+    case "listPendingOperations":
+      return store2.listPendingOperations();
+    case "deleteOperation":
+      return store2.deleteOperation(request.args[0]);
+    case "putSend":
+      return store2.putSend(request.args[0]);
+    case "getSend":
+      return store2.getSend(request.args[0]);
+    case "nextSendOrdinal":
+      return store2.nextSendOrdinal(request.args[0]);
+    case "listNonterminalSends":
+      return store2.listNonterminalSends();
+    case "putCompact":
+      return store2.putCompact(request.args[0]);
+    case "getCompact":
+      return store2.getCompact(request.args[0]);
+    case "listNonterminalCompacts":
+      return store2.listNonterminalCompacts();
+    case "putIncarnation":
+      return store2.putIncarnation(request.args[0]);
+    case "listActiveIncarnations":
+      return store2.listActiveIncarnations();
+    case "putEpoch":
+      return store2.putEpoch(request.args[0]);
+    case "getEpochs":
+      return store2.getEpochs(request.args[0]);
+    case "beginIncarnation":
+      return store2.beginIncarnation(
+        request.args[0],
+        request.args[1],
+        request.args[2],
+        request.args[3]
+      );
+    case "append":
+      return store2.append(normalizeAppend(request.args[0]));
+    case "openReceive":
+      return store2.openReceive(request.args[0]);
+    case "readEvents":
+      return store2.readEvents(request.args[0]);
+    case "getProjectorState":
+      return store2.getProjectorState(
+        request.args[0],
+        request.args[1],
+        request.args[2]
+      );
+    case "getHighWater":
+      return store2.getHighWater(request.args[0]);
+    case "markIdle":
+      return store2.markIdle(request.args[0], request.args[1]);
+    case "getRawRecords":
+      return store2.getRawRecords(
+        request.args[0],
+        request.args[1],
+        request.args[2]
+      );
+    case "destroyAgent":
+      return store2.destroyAgent(
+        request.args[0],
+        request.args[1]
+      );
+    case "getDestroyReceipt":
+      return store2.getDestroyReceipt(request.args[0]);
+    case "maintain":
+      return store2.maintain(request.args[0]);
+    case "getDiagnostics":
+      return store2.getDiagnostics();
+    case "close":
+      return store2.close();
+    default:
+      throw new Error(`Unknown journal worker method ${request.method}`);
+  }
+}
+function normalizeAppend(value) {
+  const batch = value;
+  return {
+    ...batch,
+    records: batch.records.map((record) => ({ ...record, bytes: Buffer.from(record.bytes) }))
+  };
+}
+
+// src/store/sqlite-journal-store.ts
+import { mkdirSync } from "node:fs";
+import { dirname as dirname2 } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+
+// src/platform/shared/state-security.ts
+import { chmodSync, constants, lstatSync } from "node:fs";
+import { dirname, join, parse, resolve, sep } from "node:path";
+var PRIVATE_DIRECTORY_MODE = 448;
+var PRIVATE_FILE_MODE = 384;
+var GROUP_OR_OTHER_WRITE = 18;
+var STICKY_BIT = 512;
+var SAFE_ROOT_STICKY_DIRECTORIES = /* @__PURE__ */ new Set(["/tmp", "/var/tmp"]);
+function hardenPrivateDirectorySync(path) {
+  assertTrustedDirectoryComponentsSync(resolve(path));
+  const stats = lstatSync(path);
+  if (stats.isSymbolicLink() || !stats.isDirectory()) {
+    throw new Error(`Refusing unsafe pi-fleet directory ${path}`);
+  }
+  assertCurrentUser(path, stats.uid);
+  chmodSync(path, PRIVATE_DIRECTORY_MODE);
+}
+function hardenSqliteSidecarsSync(path) {
+  for (const candidate of [path, `${path}-wal`, `${path}-shm`]) {
+    let stats;
+    try {
+      stats = lstatSync(candidate);
+    } catch (error) {
+      if (error.code === "ENOENT") continue;
+      throw error;
+    }
+    if (stats.isSymbolicLink() || !stats.isFile()) {
+      throw new Error(`Refusing unsafe pi-fleet state file ${candidate}`);
+    }
+    assertCurrentUser(candidate, stats.uid);
+    chmodSync(candidate, PRIVATE_FILE_MODE);
+  }
+}
+function assertTrustedDirectoryComponentsSync(absolutePath) {
+  const root = parse(absolutePath).root;
+  let current = root;
+  const rootStats = lstatSync(root);
+  assertTrustedDirectoryAncestor(root, rootStats.uid, rootStats.mode);
+  for (const component of absolutePath.slice(root.length).split(sep).filter(Boolean)) {
+    current = join(current, component);
+    const stats = lstatSync(current);
+    if (stats.isSymbolicLink() || !stats.isDirectory()) {
+      throw new Error(`Refusing unsafe pi-fleet directory ${current}`);
+    }
+    assertTrustedDirectoryAncestor(current, stats.uid, stats.mode);
+  }
+}
+function assertTrustedDirectoryAncestor(path, ownerUid, mode, currentUid = process.getuid?.()) {
+  if (currentUid === void 0 || ownerUid === currentUid) return;
+  if (ownerUid === 0) {
+    const writable = (mode & GROUP_OR_OTHER_WRITE) !== 0;
+    if (!writable) return;
+    if ((mode & STICKY_BIT) !== 0 && SAFE_ROOT_STICKY_DIRECTORIES.has(path)) return;
+  }
+  throw new Error(`Refusing untrusted pi-fleet directory ancestor: ${path}`);
+}
+function assertCurrentUser(path, ownerUid) {
+  const uid = process.getuid?.();
+  if (uid !== void 0 && ownerUid !== uid) {
+    throw new Error(`Refusing pi-fleet path not owned by the current user: ${path}`);
+  }
+}
+
+// src/store/journal-store.ts
+function boundedSemanticEvents(events, range) {
+  if (!Number.isSafeInteger(range.limit) || range.limit <= 0) {
+    throw new Error("Journal event range limit must be positive");
+  }
+  if (!Number.isSafeInteger(range.maxBytes) || range.maxBytes <= 0) {
+    throw new Error("Journal event range byte limit must be positive");
+  }
+  if (!Number.isSafeInteger(range.maxEventBytes) || range.maxEventBytes <= 0) {
+    throw new Error("Journal semantic event limit must be positive");
+  }
+  const selected = [];
+  let selectedBytes = 0;
+  for (const stored of events) {
+    if (stored.agentId !== range.agentId || stored.event.epoch !== range.epoch) continue;
+    if (stored.position <= range.afterPosition) continue;
+    const bytes = Buffer.byteLength(JSON.stringify(stored));
+    if (bytes > range.maxEventBytes) throw new Error("Semantic event exceeds storage read limit");
+    if (selected.length > 0 && selectedBytes + bytes > range.maxBytes) break;
+    selected.push(stored);
+    selectedBytes += bytes;
+    if (selected.length >= range.limit || selectedBytes >= range.maxBytes) break;
+  }
+  return selected;
+}
+function sameJournalDestroyReceipt(left, right) {
+  return left.operationId === right.operationId && left.agentId === right.agentId && left.agentName === right.agentName && left.fingerprint === right.fingerprint && left.destroyedAt === right.destroyedAt && left.status === right.status;
+}
+function assertJournalAgentIdentity(agent) {
+  if (agent.summary.id !== agent.agentId || agent.summary.name !== agent.name) {
+    throw new Error("Journal agent identity does not match its summary");
+  }
+}
+function assertJournalAppend(batch, current, epoch) {
+  if (epoch === null) throw new Error("Journal append references an unknown continuity epoch");
+  if (epoch.state !== "open")
+    throw new Error("Journal append references a closed continuity epoch");
+  let rawPosition = current.rawPosition;
+  const appendedRawPositions = /* @__PURE__ */ new Set();
+  for (const record of batch.records) {
+    if (record.agentId !== batch.agentId) throw new Error("Raw record targets another agent");
+    if (record.incarnationId !== batch.incarnationId) {
+      throw new Error("Raw record targets another incarnation");
+    }
+    if (record.position !== ++rawPosition) throw new Error("Raw record position is not contiguous");
+    appendedRawPositions.add(record.position);
+  }
+  let eventPosition = current.eventPosition;
+  for (const stored of batch.events) {
+    if (stored.agentId !== batch.agentId || stored.event.agentId !== batch.agentId) {
+      throw new Error("Semantic event targets another agent");
+    }
+    if (stored.event.epoch !== batch.epoch) throw new Error("Semantic event epoch mismatch");
+    if (stored.position !== ++eventPosition) {
+      throw new Error("Semantic event position is not contiguous");
+    }
+    if (!appendedRawPositions.has(stored.event.sourceRawPosition)) {
+      throw new Error("Semantic event must reference a raw record from the same append and epoch");
+    }
+  }
+  if (batch.highWater.rawPosition !== rawPosition || batch.highWater.eventPosition !== eventPosition) {
+    throw new Error("Journal high-water position does not match the append");
+  }
+  if (batch.highWater.idleEventPosition !== null && batch.highWater.idleEventPosition > eventPosition) {
+    throw new Error("Idle high-water position exceeds committed events");
+  }
+}
+
+// src/store/sqlite-journal-store.ts
+var JOURNAL_SCHEMA_VERSION = 3;
+var JOURNAL_SCHEMA_CHECKSUM = "003_uuid_journal_v3";
+var LEGACY_JOURNAL_SCHEMA_CHECKSUMS = /* @__PURE__ */ new Map([
+  [1, "001_initial_v1"],
+  [2, "002_compact_v1"]
+]);
+function classifyJournalMigrationRows(rows) {
+  if (rows.length === 0) return "fresh";
+  for (const row of rows) {
+    if (!Number.isSafeInteger(row.version) || typeof row.checksum !== "string") {
+      throw new Error("pi-fleet database migration ledger is malformed");
+    }
+  }
+  if (rows.length === 1 && rows[0]?.version === JOURNAL_SCHEMA_VERSION) {
+    if (rows[0].checksum !== JOURNAL_SCHEMA_CHECKSUM) {
+      throw new Error(
+        `pi-fleet database migration ${String(JOURNAL_SCHEMA_VERSION)} checksum mismatch`
+      );
+    }
+    return "current";
+  }
+  const legacyOne = rows.length === 1 && rows[0]?.version === 1;
+  const legacyTwo = rows.length === 2 && rows[0]?.version === 1 && rows[1]?.version === 2;
+  if (legacyOne || legacyTwo) {
+    for (const row of rows) {
+      if (LEGACY_JOURNAL_SCHEMA_CHECKSUMS.get(row.version) !== row.checksum) {
+        throw new Error(`pi-fleet database migration ${String(row.version)} checksum mismatch`);
+      }
+    }
+    return "legacy";
+  }
+  const newer = rows.find((row) => row.version > JOURNAL_SCHEMA_VERSION);
+  if (newer !== void 0) {
+    throw new Error(`pi-fleet database schema ${String(newer.version)} is newer than this runtime`);
+  }
+  throw new Error("pi-fleet database migration ledger sequence is invalid");
+}
+function* parseSemanticEventRows(rows) {
+  for (const row of rows) yield JSON.parse(row.data_json);
+}
+var idleMaintenance = () => ({
+  state: "idle",
+  lastCheckpointAt: null,
+  busy: false,
+  logFrames: 0,
+  checkpointedFrames: 0,
+  autoVacuumMode: "none",
+  freelistPagesBefore: 0,
+  freelistPagesAfter: 0,
+  requestedReclaimPages: 0
+});
+var SqliteJournalStore = class {
+  #database;
+  #checkpointCommitInterval;
+  #reclaimPagesPerPass;
+  #now;
+  #commitsSinceCheckpoint = 0;
+  #lastAppendDurationMs = null;
+  #storageFailureLatched = false;
+  #maintenance = idleMaintenance();
+  #closed = false;
+  constructor(path, options2 = {}) {
+    const directory = dirname2(path);
+    mkdirSync(directory, { recursive: true, mode: 448 });
+    hardenPrivateDirectorySync(directory);
+    hardenSqliteSidecarsSync(path);
+    this.#checkpointCommitInterval = positiveInteger(
+      options2.checkpointCommitInterval ?? 128,
+      "Journal checkpoint commit interval"
+    );
+    this.#reclaimPagesPerPass = positiveInteger(
+      options2.reclaimPagesPerPass ?? 32,
+      "Journal reclaim pages per pass"
+    );
+    this.#now = options2.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+    this.#database = new DatabaseSync(path);
+    this.#database.exec(
+      "PRAGMA auto_vacuum=INCREMENTAL; PRAGMA foreign_keys=ON; PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL;"
+    );
+    hardenSqliteSidecarsSync(path);
+    try {
+      const integrity = this.#database.prepare("PRAGMA quick_check").get();
+      if (integrity?.quick_check !== "ok") throw new Error("pi-fleet database quick_check failed");
+      this.#migrate();
+      this.#database.prepare(
+        "UPDATE journal_runtime_health SET clean_shutdown = 0, started_at = ? WHERE singleton_key = 1"
+      ).run((/* @__PURE__ */ new Date()).toISOString());
+    } catch (error) {
+      this.#database.close();
+      this.#closed = true;
+      throw error;
+    }
+  }
+  async createAgent(agent) {
+    this.#assertOpen();
+    assertJournalAgentIdentity(agent);
+    const result = this.#database.prepare("INSERT OR IGNORE INTO journal_agents(agent_id, name, data_json) VALUES(?, ?, ?)").run(agent.agentId, agent.name, JSON.stringify(agent));
+    return result.changes === 1;
+  }
+  async createAgentWithOperation(agent, operation) {
+    this.#assertOpen();
+    assertJournalAgentIdentity(agent);
+    if (operation.agentId !== agent.agentId || operation.targetName !== agent.name) {
+      throw new Error("Create operation does not target the provisional agent");
+    }
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      const existing = await this.getOperation(operation.operationId);
+      if (existing !== null && (existing.method !== operation.method || existing.fingerprint !== operation.fingerprint || existing.agentId !== null && existing.agentId !== agent.agentId)) {
+        throw new Error("Operation was already used with a different request");
+      }
+      const created = this.#database.prepare(
+        "INSERT OR IGNORE INTO journal_agents(agent_id, name, data_json) VALUES(?, ?, ?)"
+      ).run(agent.agentId, agent.name, JSON.stringify(agent)).changes === 1;
+      if (created) this.#putOperationSync(operation);
+      this.#database.exec("COMMIT");
+      return created;
+    } catch (error) {
+      this.#database.exec("ROLLBACK");
+      throw error;
+    }
+  }
+  async rollbackProvisionalCreate(agentId, completedOperation) {
+    this.#assertOpen();
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      const existing = await this.getAgentById(agentId);
+      const pending = await this.getOperation(completedOperation.operationId);
+      if (existing === null) {
+        this.#database.exec("ROLLBACK");
+        return null;
+      }
+      if (pending === null || pending.method !== "create" || pending.state !== "pending" || pending.agentId !== agentId || pending.targetName !== existing.name || completedOperation.method !== "create" || completedOperation.state !== "completed" || completedOperation.agentId !== null || completedOperation.targetName !== existing.name || completedOperation.fingerprint !== pending.fingerprint) {
+        throw new Error("Provisional create rollback does not match the pending operation");
+      }
+      this.#database.prepare("DELETE FROM journal_operations WHERE agent_id = ? AND operation_id <> ?").run(agentId, completedOperation.operationId);
+      this.#putOperationSync(completedOperation);
+      this.#database.prepare("DELETE FROM journal_agents WHERE agent_id = ?").run(agentId);
+      this.#database.exec("COMMIT");
+      return existing;
+    } catch (error) {
+      this.#database.exec("ROLLBACK");
+      throw error;
+    }
+  }
+  async getAgentByName(name) {
+    return this.#readJson(
+      "SELECT data_json FROM journal_agents WHERE name = ?",
+      name
+    );
+  }
+  async getAgentById(agentId) {
+    return this.#readJson(
+      "SELECT data_json FROM journal_agents WHERE agent_id = ?",
+      agentId
+    );
+  }
+  async listAgents() {
+    return this.#readJsonRows("SELECT data_json FROM journal_agents ORDER BY name");
+  }
+  async putAgent(agent) {
+    this.#assertOpen();
+    assertJournalAgentIdentity(agent);
+    this.#database.prepare(
+      `INSERT INTO journal_agents(agent_id, name, data_json) VALUES(?, ?, ?)
+         ON CONFLICT(agent_id) DO UPDATE SET name=excluded.name, data_json=excluded.data_json`
+    ).run(agent.agentId, agent.name, JSON.stringify(agent));
+  }
+  async putOperation(operation) {
+    this.#putOperationSync(operation);
+  }
+  async getOperation(operationId) {
+    return this.#readJson(
+      "SELECT data_json FROM journal_operations WHERE operation_id = ?",
+      operationId
+    );
+  }
+  async listPendingOperations() {
+    return this.#readJsonRows(
+      "SELECT data_json FROM journal_operations WHERE json_extract(data_json, '$.state') = 'pending' ORDER BY rowid"
+    );
+  }
+  async deleteOperation(operationId) {
+    this.#assertOpen();
+    this.#database.prepare("DELETE FROM journal_operations WHERE operation_id = ?").run(operationId);
+  }
+  async putSend(send) {
+    this.#putOwned("journal_sends", "send_id", send.sendId, send.agentId, send);
+  }
+  async getSend(sendId) {
+    return this.#readJson(
+      "SELECT data_json FROM journal_sends WHERE send_id = ?",
+      sendId
+    );
+  }
+  async nextSendOrdinal(agentId) {
+    const row = this.#database.prepare(
+      `SELECT COALESCE(MAX(CAST(json_extract(data_json, '$.ordinal') AS INTEGER)), 0) + 1 AS ordinal
+         FROM journal_sends WHERE agent_id = ?`
+    ).get(agentId);
+    return row.ordinal;
+  }
+  async listNonterminalSends() {
+    return this.#readJsonRows(
+      `SELECT data_json FROM journal_sends
+       WHERE json_extract(data_json, '$.state') IN ('pending', 'dispatching')
+       ORDER BY CAST(json_extract(data_json, '$.ordinal') AS INTEGER), rowid`
+    );
+  }
+  async putCompact(compact) {
+    this.#putOwned("journal_compacts", "compact_id", compact.compactId, compact.agentId, compact);
+  }
+  async getCompact(compactId) {
+    return this.#readJson(
+      "SELECT data_json FROM journal_compacts WHERE compact_id = ?",
+      compactId
+    );
+  }
+  async listNonterminalCompacts() {
+    return this.#readJsonRows(
+      `SELECT data_json FROM journal_compacts
+       WHERE json_extract(data_json, '$.state') IN ('pending', 'dispatching') ORDER BY rowid`
+    );
+  }
+  async putIncarnation(incarnation) {
+    this.#putOwned(
+      "journal_incarnations",
+      "incarnation_id",
+      incarnation.incarnationId,
+      incarnation.agentId,
+      incarnation
+    );
+  }
+  async listActiveIncarnations() {
+    return this.#readJsonRows(
+      `SELECT data_json FROM journal_incarnations
+       WHERE json_extract(data_json, '$.state') IN
+         ('starting', 'live', 'stopping', 'cleanup_uncertain') ORDER BY rowid`
+    );
+  }
+  async putEpoch(epoch) {
+    this.#assertOpen();
+    this.#database.prepare(
+      `INSERT INTO journal_epochs(agent_id, epoch, state, data_json) VALUES(?, ?, ?, ?)
+         ON CONFLICT(agent_id, epoch) DO UPDATE SET
+           state=excluded.state, data_json=excluded.data_json`
+    ).run(epoch.agentId, epoch.epoch, epoch.state, JSON.stringify(epoch));
+  }
+  async getEpochs(agentId) {
+    return this.#readJsonRows(
+      "SELECT data_json FROM journal_epochs WHERE agent_id = ? ORDER BY epoch",
+      agentId
+    );
+  }
+  async beginIncarnation(agentId, incarnationId, epoch, projectorState) {
+    this.#assertOpen();
+    const incarnation = this.#database.prepare("SELECT 1 FROM journal_incarnations WHERE agent_id = ? AND incarnation_id = ?").get(agentId, incarnationId);
+    const epochRow = this.#database.prepare("SELECT state FROM journal_epochs WHERE agent_id = ? AND epoch = ?").get(agentId, epoch);
+    if (incarnation === void 0) {
+      throw new Error("Projector binding references an unknown incarnation");
+    }
+    if (epochRow?.state !== "open") {
+      throw new Error("Projector binding requires an open continuity epoch");
+    }
+    this.#database.prepare(
+      `INSERT INTO journal_projector_state(
+           agent_id, incarnation_id, epoch, data_json
+         ) VALUES(?, ?, ?, ?)
+         ON CONFLICT(agent_id) DO UPDATE SET
+           incarnation_id=excluded.incarnation_id,
+           epoch=excluded.epoch,
+           data_json=excluded.data_json`
+    ).run(agentId, incarnationId, epoch, JSON.stringify(projectorState));
+  }
+  async append(batch) {
+    this.#assertOpen();
+    const startedAt = performance.now();
+    let transactionOpen = false;
+    try {
+      this.#database.exec("BEGIN IMMEDIATE");
+      transactionOpen = true;
+      const current = this.#getHighWaterSync(batch.agentId) ?? {
+        rawPosition: 0,
+        eventPosition: 0,
+        idleEventPosition: null
+      };
+      const epochRow = this.#database.prepare("SELECT data_json FROM journal_epochs WHERE agent_id = ? AND epoch = ?").get(batch.agentId, batch.epoch);
+      assertJournalAppend(
+        batch,
+        current,
+        epochRow === void 0 ? null : JSON.parse(epochRow.data_json)
+      );
+      const projectorBinding = this.#database.prepare(
+        `SELECT incarnation_id, epoch FROM journal_projector_state
+           WHERE agent_id = ?`
+      ).get(batch.agentId);
+      if (projectorBinding?.incarnation_id !== batch.incarnationId || projectorBinding.epoch !== batch.epoch) {
+        throw new Error("Journal append does not match the active projector incarnation");
+      }
+      const putRecord = this.#database.prepare(
+        `INSERT INTO journal_raw_records(
+          agent_id, raw_position, incarnation_id, epoch, observed_at, record_bytes
+        ) VALUES(?, ?, ?, ?, ?, ?)`
+      );
+      for (const record of batch.records) {
+        putRecord.run(
+          record.agentId,
+          record.position,
+          record.incarnationId,
+          batch.epoch,
+          record.observedAt,
+          record.bytes
+        );
+      }
+      const putEvent = this.#database.prepare(
+        `INSERT INTO journal_semantic_events(
+          agent_id, event_position, event_id, event_epoch, raw_position, event_type, data_json
+        ) VALUES(?, ?, ?, ?, ?, ?, ?)`
+      );
+      for (const stored of batch.events) {
+        putEvent.run(
+          stored.agentId,
+          stored.position,
+          stored.event.id,
+          stored.event.epoch,
+          stored.event.sourceRawPosition,
+          stored.event.type,
+          JSON.stringify(stored)
+        );
+      }
+      this.#database.prepare(
+        `UPDATE journal_projector_state SET data_json = ?
+           WHERE agent_id = ? AND incarnation_id = ? AND epoch = ?`
+      ).run(JSON.stringify(batch.projectorState), batch.agentId, batch.incarnationId, batch.epoch);
+      this.#database.prepare(
+        `INSERT INTO journal_high_water(
+             agent_id, raw_position, event_position, idle_event_position
+           ) VALUES(?, ?, ?, ?)
+           ON CONFLICT(agent_id) DO UPDATE SET
+             raw_position=excluded.raw_position,
+             event_position=excluded.event_position,
+             idle_event_position=excluded.idle_event_position`
+      ).run(
+        batch.agentId,
+        batch.highWater.rawPosition,
+        batch.highWater.eventPosition,
+        batch.highWater.idleEventPosition
+      );
+      this.#database.prepare(
+        `UPDATE journal_runtime_health SET last_commit_at = ?
+           WHERE singleton_key = 1`
+      ).run((/* @__PURE__ */ new Date()).toISOString());
+      this.#database.exec("COMMIT");
+      transactionOpen = false;
+    } catch (error) {
+      if (transactionOpen) {
+        try {
+          this.#database.exec("ROLLBACK");
+        } catch {
+        }
+      }
+      this.#latchStorageFailure();
+      throw error;
+    } finally {
+      this.#lastAppendDurationMs = Math.max(0, performance.now() - startedAt);
+    }
+    this.#commitsSinceCheckpoint += 1;
+    if (this.#commitsSinceCheckpoint >= this.#checkpointCommitInterval) {
+      await this.maintain(0);
+    }
+  }
+  async openReceive(agentId) {
+    this.#assertOpen();
+    this.#database.exec("BEGIN");
+    try {
+      const agent = this.#readJson(
+        "SELECT data_json FROM journal_agents WHERE agent_id = ?",
+        agentId
+      );
+      if (agent === null) {
+        this.#database.exec("COMMIT");
+        return null;
+      }
+      const snapshot = {
+        agent,
+        epochs: this.#readJsonRows(
+          "SELECT data_json FROM journal_epochs WHERE agent_id = ? ORDER BY epoch",
+          agentId
+        ),
+        highWater: this.#getHighWaterSync(agentId) ?? {
+          rawPosition: 0,
+          eventPosition: 0,
+          idleEventPosition: null
+        }
+      };
+      this.#database.exec("COMMIT");
+      return snapshot;
+    } catch (error) {
+      this.#database.exec("ROLLBACK");
+      throw error;
+    }
+  }
+  async readEvents(range) {
+    const rows = this.#database.prepare(
+      `SELECT data_json FROM journal_semantic_events
+         WHERE agent_id = ? AND event_epoch = ? AND event_position > ?
+         ORDER BY event_position LIMIT ?`
+    ).iterate(range.agentId, range.epoch, range.afterPosition, range.limit);
+    return boundedSemanticEvents(parseSemanticEventRows(rows), range);
+  }
+  async getProjectorState(agentId, incarnationId, epoch) {
+    this.#assertOpen();
+    const row = this.#database.prepare(
+      `SELECT incarnation_id, epoch, data_json FROM journal_projector_state
+         WHERE agent_id = ?`
+    ).get(agentId);
+    if (row === void 0) return null;
+    if (row.incarnation_id !== incarnationId || row.epoch !== epoch) {
+      throw new Error("Projector state belongs to another incarnation or continuity epoch");
+    }
+    return JSON.parse(row.data_json);
+  }
+  async getHighWater(agentId) {
+    return this.#getHighWaterSync(agentId);
+  }
+  async markIdle(agentId, epoch) {
+    this.#assertOpen();
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      const epochRow = this.#database.prepare("SELECT state FROM journal_epochs WHERE agent_id = ? AND epoch = ?").get(agentId, epoch);
+      if (epochRow?.state !== "open") throw new Error("Idle marker requires an open epoch");
+      const current = this.#getHighWaterSync(agentId) ?? {
+        rawPosition: 0,
+        eventPosition: 0,
+        idleEventPosition: null
+      };
+      this.#database.prepare(
+        `INSERT INTO journal_high_water(
+             agent_id, raw_position, event_position, idle_event_position
+           ) VALUES(?, ?, ?, ?)
+           ON CONFLICT(agent_id) DO UPDATE SET
+             idle_event_position=excluded.idle_event_position`
+      ).run(agentId, current.rawPosition, current.eventPosition, current.eventPosition);
+      this.#database.prepare("UPDATE journal_runtime_health SET last_commit_at = ? WHERE singleton_key = 1").run((/* @__PURE__ */ new Date()).toISOString());
+      this.#database.exec("COMMIT");
+      return current.eventPosition;
+    } catch (error) {
+      this.#database.exec("ROLLBACK");
+      this.#latchStorageFailure();
+      throw error;
+    }
+  }
+  async getRawRecords(agentId, afterPosition, limit) {
+    this.#assertPositiveLimit(limit);
+    const rows = this.#database.prepare(
+      `SELECT raw_position, incarnation_id, observed_at, record_bytes
+         FROM journal_raw_records WHERE agent_id = ? AND raw_position > ?
+         ORDER BY raw_position LIMIT ?`
+    ).all(agentId, afterPosition, limit);
+    return rows.map((row) => ({
+      agentId,
+      incarnationId: row.incarnation_id,
+      position: row.raw_position,
+      observedAt: row.observed_at,
+      bytes: Buffer.from(row.record_bytes)
+    }));
+  }
+  async destroyAgent(agentId, receipt) {
+    this.#assertOpen();
+    if (receipt.agentId !== agentId) throw new Error("Destroy receipt targets another agent");
+    let destroyed = null;
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      const priorReceipt = await this.getDestroyReceipt(receipt.operationId);
+      if (priorReceipt !== null) {
+        if (!sameJournalDestroyReceipt(priorReceipt, receipt)) {
+          throw new Error("Destroy operation was already used");
+        }
+        this.#database.exec("ROLLBACK");
+        return null;
+      }
+      const existing = await this.getAgentById(agentId);
+      if (existing === null) {
+        this.#database.exec("ROLLBACK");
+        return null;
+      }
+      this.#database.prepare("DELETE FROM journal_operations WHERE agent_id = ?").run(agentId);
+      this.#database.prepare("DELETE FROM journal_agents WHERE agent_id = ?").run(agentId);
+      this.#database.prepare(
+        `INSERT INTO journal_destroy_receipts(
+             operation_id, agent_id, agent_name, fingerprint, destroyed_at, status
+           ) VALUES(?, ?, ?, ?, ?, ?)
+           ON CONFLICT(operation_id) DO NOTHING`
+      ).run(
+        receipt.operationId,
+        receipt.agentId,
+        receipt.agentName,
+        receipt.fingerprint,
+        receipt.destroyedAt,
+        receipt.status
+      );
+      this.#database.exec("COMMIT");
+      destroyed = existing;
+    } catch (error) {
+      this.#database.exec("ROLLBACK");
+      throw error;
+    }
+    await this.maintain(this.#reclaimPagesPerPass);
+    return destroyed;
+  }
+  async getDestroyReceipt(operationId) {
+    const row = this.#database.prepare(
+      `SELECT operation_id, agent_id, agent_name, fingerprint, destroyed_at, status
+         FROM journal_destroy_receipts WHERE operation_id = ?`
+    ).get(operationId);
+    return row === void 0 ? null : {
+      operationId: row.operation_id,
+      agentId: row.agent_id,
+      agentName: row.agent_name,
+      fingerprint: row.fingerprint,
+      destroyedAt: row.destroyed_at,
+      status: row.status
+    };
+  }
+  async maintain(reclaimPages = this.#reclaimPagesPerPass) {
+    this.#assertOpen();
+    if (!Number.isSafeInteger(reclaimPages) || reclaimPages < 0) {
+      throw new Error("Journal reclaim page limit must be a non-negative integer");
+    }
+    this.#maintenance = {
+      ...this.#maintenance,
+      state: "running",
+      requestedReclaimPages: reclaimPages
+    };
+    try {
+      const checkpoint = this.#database.prepare("PRAGMA wal_checkpoint(PASSIVE)").get();
+      const autoVacuumValue = pragmaInteger(this.#database, "auto_vacuum");
+      const freelistPagesBefore = pragmaInteger(this.#database, "freelist_count");
+      if (reclaimPages > 0 && autoVacuumValue === 2 && freelistPagesBefore > 0) {
+        this.#database.exec(`PRAGMA incremental_vacuum(${String(reclaimPages)})`);
+      }
+      const result = {
+        state: "idle",
+        lastCheckpointAt: this.#now(),
+        busy: checkpoint.busy !== 0,
+        logFrames: checkpoint.log,
+        checkpointedFrames: checkpoint.checkpointed,
+        autoVacuumMode: autoVacuumMode(autoVacuumValue),
+        freelistPagesBefore,
+        freelistPagesAfter: pragmaInteger(this.#database, "freelist_count"),
+        requestedReclaimPages: reclaimPages
+      };
+      this.#maintenance = result;
+      this.#commitsSinceCheckpoint = 0;
+      return { ...result };
+    } catch (error) {
+      this.#maintenance = { ...this.#maintenance, state: "failed" };
+      this.#latchStorageFailure();
+      throw error;
+    }
+  }
+  async getDiagnostics() {
+    const retainedByAgent = this.#database.prepare(
+      `SELECT a.agent_id,
+          (SELECT COUNT(*) FROM journal_raw_records r
+             WHERE r.agent_id = a.agent_id) AS raw_record_count,
+          (SELECT COALESCE(SUM(length(r.record_bytes)), 0) FROM journal_raw_records r
+             WHERE r.agent_id = a.agent_id) AS raw_bytes,
+          (SELECT COUNT(*) FROM journal_semantic_events e
+             WHERE e.agent_id = a.agent_id) AS semantic_event_count
+         FROM journal_agents a ORDER BY a.agent_id`
+    ).all();
+    const row = this.#database.prepare(
+      `SELECT
+          (SELECT COUNT(*) FROM journal_raw_records) AS raw_record_count,
+          (SELECT COALESCE(SUM(length(record_bytes)), 0) FROM journal_raw_records) AS raw_bytes,
+          (SELECT COUNT(*) FROM journal_semantic_events) AS semantic_event_count,
+          (SELECT COUNT(*) FROM journal_agents) AS agent_count,
+          (SELECT COALESCE(SUM(json_array_length(data_json, '$.openActivities')), 0)
+             FROM journal_projector_state) AS open_projector_activities,
+          (SELECT COUNT(*) FROM journal_epochs
+             WHERE state = 'closed'
+               AND json_extract(data_json, '$.reason') = 'observation_uncertain')
+             AS continuity_gap_count,
+          (SELECT storage_state FROM journal_runtime_health WHERE singleton_key = 1) AS storage_state,
+          (SELECT last_commit_at FROM journal_runtime_health WHERE singleton_key = 1) AS last_commit_at`
+    ).get();
+    return {
+      rawRecordCount: row.raw_record_count,
+      rawBytes: row.raw_bytes,
+      semanticEventCount: row.semantic_event_count,
+      agentCount: row.agent_count,
+      retainedByAgent: retainedByAgent.map((agent) => ({
+        agentId: agent.agent_id,
+        rawRecordCount: agent.raw_record_count,
+        rawBytes: agent.raw_bytes,
+        semanticEventCount: agent.semantic_event_count
+      })),
+      openProjectorActivities: row.open_projector_activities,
+      continuityGapCount: row.continuity_gap_count,
+      storageState: this.#storageFailureLatched ? "failed" : row.storage_state,
+      lastCommitAt: row.last_commit_at,
+      lastAppendDurationMs: this.#lastAppendDurationMs,
+      maintenance: { ...this.#maintenance }
+    };
+  }
+  #latchStorageFailure() {
+    this.#storageFailureLatched = true;
+    try {
+      this.#database.prepare(
+        "UPDATE journal_runtime_health SET storage_state = 'failed' WHERE singleton_key = 1"
+      ).run();
+    } catch {
+    }
+  }
+  async close() {
+    if (this.#closed) return;
+    this.#database.prepare("UPDATE journal_runtime_health SET clean_shutdown = 1 WHERE singleton_key = 1").run();
+    this.#database.close();
+    this.#closed = true;
+  }
+  #migrate() {
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      this.#database.exec(
+        `CREATE TABLE IF NOT EXISTS schema_migrations(
+          version INTEGER PRIMARY KEY,
+          checksum TEXT NOT NULL,
+          applied_at TEXT NOT NULL
+        )`
+      );
+      const applied = this.#database.prepare("SELECT version, checksum FROM schema_migrations ORDER BY version").all();
+      const migrationState = classifyJournalMigrationRows(applied);
+      if (migrationState === "current") {
+        this.#database.exec("COMMIT");
+        return;
+      }
+      this.#replaceLegacySchema();
+      this.#database.prepare("DELETE FROM schema_migrations").run();
+      this.#database.prepare("INSERT INTO schema_migrations(version, checksum, applied_at) VALUES(?, ?, ?)").run(JOURNAL_SCHEMA_VERSION, JOURNAL_SCHEMA_CHECKSUM, (/* @__PURE__ */ new Date()).toISOString());
+      this.#database.exec("COMMIT");
+    } catch (error) {
+      this.#database.exec("ROLLBACK");
+      throw error;
+    }
+  }
+  #replaceLegacySchema() {
+    this.#database.exec(`
+      DROP TABLE IF EXISTS compact_records;
+      DROP TABLE IF EXISTS send_records;
+      DROP TABLE IF EXISTS incarnations;
+      DROP TABLE IF EXISTS operations;
+      DROP TABLE IF EXISTS agents;
+      DROP TABLE IF EXISTS runtime_metadata;
+
+      CREATE TABLE journal_agents(
+        agent_id TEXT PRIMARY KEY,
+        name TEXT NOT NULL UNIQUE,
+        data_json TEXT NOT NULL CHECK(json_valid(data_json))
+      );
+      CREATE TABLE journal_operations(
+        operation_id TEXT PRIMARY KEY,
+        agent_id TEXT REFERENCES journal_agents(agent_id),
+        data_json TEXT NOT NULL CHECK(json_valid(data_json))
+      );
+      CREATE TABLE journal_sends(
+        send_id TEXT PRIMARY KEY,
+        agent_id TEXT NOT NULL REFERENCES journal_agents(agent_id) ON DELETE CASCADE,
+        data_json TEXT NOT NULL CHECK(json_valid(data_json))
+      );
+      CREATE TABLE journal_compacts(
+        compact_id TEXT PRIMARY KEY,
+        agent_id TEXT NOT NULL REFERENCES journal_agents(agent_id) ON DELETE CASCADE,
+        data_json TEXT NOT NULL CHECK(json_valid(data_json))
+      );
+      CREATE TABLE journal_incarnations(
+        incarnation_id TEXT PRIMARY KEY,
+        agent_id TEXT NOT NULL REFERENCES journal_agents(agent_id) ON DELETE CASCADE,
+        data_json TEXT NOT NULL CHECK(json_valid(data_json)),
+        UNIQUE(agent_id, incarnation_id)
+      );
+      CREATE TABLE journal_epochs(
+        agent_id TEXT NOT NULL REFERENCES journal_agents(agent_id) ON DELETE CASCADE,
+        epoch INTEGER NOT NULL,
+        state TEXT NOT NULL CHECK(state IN ('open', 'closed')),
+        data_json TEXT NOT NULL CHECK(json_valid(data_json)),
+        PRIMARY KEY(agent_id, epoch)
+      );
+      CREATE TABLE journal_raw_records(
+        agent_id TEXT NOT NULL REFERENCES journal_agents(agent_id) ON DELETE CASCADE,
+        raw_position INTEGER NOT NULL,
+        incarnation_id TEXT NOT NULL,
+        epoch INTEGER NOT NULL,
+        observed_at TEXT NOT NULL,
+        record_bytes BLOB NOT NULL,
+        PRIMARY KEY(agent_id, raw_position),
+        UNIQUE(agent_id, raw_position, epoch),
+        FOREIGN KEY(agent_id, epoch) REFERENCES journal_epochs(agent_id, epoch),
+        FOREIGN KEY(agent_id, incarnation_id)
+          REFERENCES journal_incarnations(agent_id, incarnation_id)
+      );
+      CREATE TABLE journal_semantic_events(
+        agent_id TEXT NOT NULL REFERENCES journal_agents(agent_id) ON DELETE CASCADE,
+        event_position INTEGER NOT NULL,
+        event_id TEXT NOT NULL UNIQUE,
+        event_epoch INTEGER NOT NULL,
+        raw_position INTEGER NOT NULL,
+        event_type TEXT NOT NULL,
+        data_json TEXT NOT NULL CHECK(json_valid(data_json)),
+        PRIMARY KEY(agent_id, event_position),
+        FOREIGN KEY(agent_id, event_epoch) REFERENCES journal_epochs(agent_id, epoch),
+        FOREIGN KEY(agent_id, raw_position, event_epoch)
+          REFERENCES journal_raw_records(agent_id, raw_position, epoch)
+      );
+      CREATE TABLE journal_projector_state(
+        agent_id TEXT PRIMARY KEY REFERENCES journal_agents(agent_id) ON DELETE CASCADE,
+        incarnation_id TEXT NOT NULL,
+        epoch INTEGER NOT NULL,
+        data_json TEXT NOT NULL CHECK(json_valid(data_json)),
+        FOREIGN KEY(agent_id, incarnation_id)
+          REFERENCES journal_incarnations(agent_id, incarnation_id),
+        FOREIGN KEY(agent_id, epoch) REFERENCES journal_epochs(agent_id, epoch)
+      );
+      CREATE TABLE journal_high_water(
+        agent_id TEXT PRIMARY KEY REFERENCES journal_agents(agent_id) ON DELETE CASCADE,
+        raw_position INTEGER NOT NULL,
+        event_position INTEGER NOT NULL,
+        idle_event_position INTEGER
+      );
+      CREATE TABLE journal_runtime_health(
+        singleton_key INTEGER PRIMARY KEY CHECK(singleton_key = 1),
+        storage_state TEXT NOT NULL CHECK(storage_state IN ('healthy', 'failed')),
+        last_commit_at TEXT,
+        clean_shutdown INTEGER NOT NULL CHECK(clean_shutdown IN (0, 1)),
+        started_at TEXT
+      );
+      INSERT INTO journal_runtime_health(
+        singleton_key, storage_state, last_commit_at, clean_shutdown, started_at
+      ) VALUES(1, 'healthy', NULL, 1, NULL);
+      CREATE TABLE journal_destroy_receipts(
+        operation_id TEXT PRIMARY KEY,
+        agent_id TEXT NOT NULL,
+        agent_name TEXT NOT NULL,
+        fingerprint TEXT NOT NULL,
+        destroyed_at TEXT NOT NULL,
+        status TEXT NOT NULL CHECK(status = 'destroyed')
+      );
+      CREATE INDEX journal_events_range
+        ON journal_semantic_events(agent_id, event_position);
+      CREATE INDEX journal_raw_range
+        ON journal_raw_records(agent_id, raw_position);
+    `);
+  }
+  #putOperationSync(operation) {
+    this.#assertOpen();
+    if (operation.agentId !== null && this.#readJson(
+      "SELECT data_json FROM journal_agents WHERE agent_id = ?",
+      operation.agentId
+    ) === null) {
+      throw new Error("Operation targets an unknown agent generation");
+    }
+    const existing = this.#database.prepare("SELECT agent_id, data_json FROM journal_operations WHERE operation_id = ?").get(operation.operationId);
+    if (existing !== void 0) {
+      const prior = JSON.parse(existing.data_json);
+      if (existing.agent_id !== null && operation.agentId !== null && existing.agent_id !== operation.agentId) {
+        throw new Error("Agent-owned record cannot change generations");
+      }
+      if (prior.method !== operation.method || prior.fingerprint !== operation.fingerprint) {
+        throw new Error("Operation was already used with a different request");
+      }
+    }
+    this.#database.prepare(
+      `INSERT INTO journal_operations(operation_id, agent_id, data_json) VALUES(?, ?, ?)
+         ON CONFLICT(operation_id) DO UPDATE SET
+           agent_id=excluded.agent_id, data_json=excluded.data_json`
+    ).run(operation.operationId, operation.agentId, JSON.stringify(operation));
+  }
+  #putOwned(table, idColumn, id, agentId, value) {
+    this.#assertOpen();
+    const existing = this.#database.prepare(`SELECT agent_id FROM ${table} WHERE ${idColumn} = ?`).get(id);
+    if (existing !== void 0 && existing.agent_id !== agentId) {
+      throw new Error("Agent-owned record cannot change generations");
+    }
+    this.#database.prepare(
+      `INSERT INTO ${table}(${idColumn}, agent_id, data_json) VALUES(?, ?, ?)
+         ON CONFLICT(${idColumn}) DO UPDATE SET data_json=excluded.data_json`
+    ).run(id, agentId, JSON.stringify(value));
+  }
+  #readJson(sql, value) {
+    this.#assertOpen();
+    const row = this.#database.prepare(sql).get(value);
+    return row === void 0 ? null : JSON.parse(row.data_json);
+  }
+  #readJsonRows(sql, ...values) {
+    this.#assertOpen();
+    const rows = this.#database.prepare(sql).all(...values);
+    return rows.map((row) => JSON.parse(row.data_json));
+  }
+  #getHighWaterSync(agentId) {
+    this.#assertOpen();
+    const row = this.#database.prepare(
+      `SELECT raw_position, event_position, idle_event_position
+         FROM journal_high_water WHERE agent_id = ?`
+    ).get(agentId);
+    return row === void 0 ? null : {
+      rawPosition: row.raw_position,
+      eventPosition: row.event_position,
+      idleEventPosition: row.idle_event_position
+    };
+  }
+  #assertPositiveLimit(limit) {
+    if (!Number.isSafeInteger(limit) || limit <= 0)
+      throw new Error("Journal range limit must be positive");
+  }
+  #assertOpen() {
+    if (this.#closed) throw new Error("pi-fleet journal store is closed");
+  }
+};
+function positiveInteger(value, label) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error(`${label} must be a positive integer`);
+  }
+  return value;
+}
+function pragmaInteger(database, name) {
+  const row = database.prepare(`PRAGMA ${name}`).get();
+  const value = row?.[name];
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
+    throw new Error(`SQLite PRAGMA ${name} returned an invalid value`);
+  }
+  return value;
+}
+function autoVacuumMode(value) {
+  if (value === 0) return "none";
+  if (value === 1) return "full";
+  if (value === 2) return "incremental";
+  throw new Error("SQLite returned an unsupported auto_vacuum mode");
+}
+
+// src/store/journal-sqlite-worker.ts
+var port = parentPort;
+if (port === null) throw new Error("Journal SQLite worker requires a parent port");
+var options = workerData;
+if (typeof options.path !== "string") {
+  throw new Error("Journal SQLite worker requires a database path");
+}
+if (typeof options.checkpointCommitInterval !== "number" || typeof options.reclaimPagesPerPass !== "number") {
+  throw new Error("Journal SQLite worker requires maintenance limits");
+}
+var store = new SqliteJournalStore(options.path, {
+  checkpointCommitInterval: options.checkpointCommitInterval,
+  reclaimPagesPerPass: options.reclaimPagesPerPass
+});
+port.on("message", (request) => {
+  void dispatchJournalStoreRequest(store, request).then((value) => port.postMessage({ id: request.id, ok: true, value })).catch(
+    (error) => port.postMessage({
+      id: request.id,
+      ok: false,
+      error: error instanceof Error ? error.message : "Journal SQLite worker failed"
+    })
+  );
+});
+//# sourceMappingURL=journal-sqlite-worker.mjs.map