@hearsay-tools/squawk 0.0.0-stage → 0.17.0-pr3058.5683

package/dist/runs/history-stream.d.ts

@@ -0,0 +1,2 @@
+/** Incremental decoded bytes: archived transcripts must not expand into an unbounded buffer. */
+export declare function streamHistoryAfter(dataDir: string, id: string, offset: number, signal: AbortSignal): AsyncGenerator<Buffer>;

package/dist/runs/history-stream.js

@@ -0,0 +1,62 @@
+import { createReadStream } from 'node:fs';
+import { stat } from 'node:fs/promises';
+import { addAbortSignal } from 'node:stream';
+import { createBrotliDecompress } from 'node:zlib';
+import { historyPaths } from './history-file.js';
+import { HistoryCursorError } from './event-history.js';
+/** Incremental decoded bytes: archived transcripts must not expand into an unbounded buffer. */
+export async function* streamHistoryAfter(dataDir, id, offset, signal) {
+    signal.throwIfAborted();
+    const { plain, compressed } = historyPaths(dataDir, id);
+    let path = plain;
+    let archive = false;
+    try {
+        const info = await stat(plain);
+        if (offset > info.size)
+            throw new HistoryCursorError(409, 'history cursor expired');
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+        path = compressed;
+        archive = true;
+        try {
+            await stat(path);
+        }
+        catch (missing) {
+            if (missing.code !== 'ENOENT')
+                throw missing;
+            if (offset > 0)
+                throw new HistoryCursorError(409, 'history cursor expired');
+            return;
+        }
+    }
+    signal.throwIfAborted();
+    const file = addAbortSignal(signal, createReadStream(path, { ...(archive ? {} : { start: offset }), highWaterMark: 64 * 1024 }));
+    const decoded = archive ? addAbortSignal(signal, createBrotliDecompress()) : file;
+    // pipe does not propagate source errors to the destination.
+    if (archive) {
+        file.on('error', error => decoded.destroy(error));
+        file.pipe(decoded);
+    }
+    let skip = archive ? offset : 0;
+    try {
+        for await (const raw of decoded) {
+            signal.throwIfAborted();
+            const chunk = raw;
+            if (skip >= chunk.length) {
+                skip -= chunk.length;
+                continue;
+            }
+            yield chunk.subarray(skip);
+            skip = 0;
+        }
+        if (skip > 0)
+            throw new HistoryCursorError(409, 'history cursor expired');
+    }
+    finally {
+        file.destroy();
+        decoded.destroy();
+    }
+}
+//# sourceMappingURL=history-stream.js.map

package/dist/runs/history-stream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"history-stream.js","sourceRoot":"","sources":["../../src/runs/history-stream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,gGAAgG;AAChG,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,kBAAkB,CAAC,OAAe,EAAE,EAAU,EAAE,MAAc,EAAE,MAAmB;IACxG,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,MAAM,GAAG,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QACpE,IAAI,GAAG,UAAU,CAAC;QAClB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QACzB,OAAO,OAAO,EAAE,CAAC;YACf,IAAK,OAAiC,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,OAAO,CAAC;YACxE,IAAI,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;IACH,CAAC;IACD,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,gBAAgB,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IACjI,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,4DAA4D;IAC5D,IAAI,OAAO,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,IAAI,CAAC,OAAoD,CAAC,CAAC;IAAC,CAAC;IACpI,IAAI,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAChC,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,GAAa,CAAC;YAC5B,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC7D,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,GAAG,CAAC,CAAC;QACX,CAAC;QACD,IAAI,IAAI,GAAG,CAAC;YAAE,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;IAC5E,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;AACH,CAAC"}

package/dist/runs/legacy-index.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Read and back up exact legacy-index bytes. Refuse import for a foreign live cockpit or changed
+ * input. A lockless old writer that stays idle during import is not detectable; its later writes
+ * are not imported.
+ */
+/** The legacy index (#779): read once, imported into `runs.db`, never written again. */
+export declare const LEGACY_INDEX_FILE = "runs.json";
+/** The exact bytes `runs.json` held when it was imported, kept beside it. */
+export declare const LEGACY_INDEX_BACKUP_FILE = "runs.json.pre-sqlite.bak";
+/** Enough of a file's identity to tell that it was replaced or rewritten. */
+interface FileIdentity {
+    dev: number;
+    ino: number;
+    size: number;
+    mtimeMs: number;
+}
+/** `runs.json` as one read saw it. */
+export interface LegacyIndexSnapshot {
+    bytes: Buffer;
+    sha256: string;
+    identity: FileIdentity;
+}
+/** `path` read in one go through one descriptor, so its bytes and identity belong together.
+ *  Undefined when there is no such file. */
+export declare function readLegacyIndex(path: string): LegacyIndexSnapshot | undefined;
+/**
+ * Keep exact snapshot bytes beside runs.json. Reuse a matching backup; preserve a different
+ * backup and use a digest-suffixed name. Called only after refusal checks inside the import
+ * transaction.
+ */
+export declare function backUpLegacyIndex(dataDir: string, snapshot: LegacyIndexSnapshot): string;
+/** An older cezar still writes `runs.json`, so it was not imported. */
+export declare class LegacyWriterError extends Error {
+    /** `cockpit`: a live cockpit other than this process holds `cockpit.lock`. `changed`: the file
+     *  changed between the read and the import. */
+    readonly reason: 'cockpit' | 'changed';
+    constructor(reason: 'cockpit' | 'changed', message: string);
+}
+/** Throw `LegacyWriterError` when a live cockpit other than this process owns `dataDir`. Cheap: one
+ *  small file read and a liveness probe, so the import asks it before it reads anything. */
+export declare function assertNoLegacyCockpit(dataDir: string): void;
+/**
+ * Throw `LegacyWriterError` when an older cezar may still be writing `runs.json`: another live
+ * cockpit owns `dataDir` (`assertNoLegacyCockpit`), or the file is no longer what `snapshot` read
+ * (undefined: there was none). Inside the import transaction, right before it commits, this is
+ * the authority; asked earlier it only saves the work of an import that could not commit.
+ */
+export declare function assertNoLegacyWriter(dataDir: string, snapshot: LegacyIndexSnapshot | undefined): void;
+export {};

package/dist/runs/legacy-index.js

@@ -0,0 +1,156 @@
+import { productName } from '../home/display.js';
+import { createHash, randomUUID } from 'node:crypto';
+import { closeSync, fstatSync, fsyncSync, linkSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { anotherCockpitOwner } from '../server/cockpit-ownership.js';
+/**
+ * Read and back up exact legacy-index bytes. Refuse import for a foreign live cockpit or changed
+ * input. A lockless old writer that stays idle during import is not detectable; its later writes
+ * are not imported.
+ */
+/** The legacy index (#779): read once, imported into `runs.db`, never written again. */
+export const LEGACY_INDEX_FILE = 'runs.json';
+/** The exact bytes `runs.json` held when it was imported, kept beside it. */
+export const LEGACY_INDEX_BACKUP_FILE = 'runs.json.pre-sqlite.bak';
+const identityOf = (stats) => ({ dev: stats.dev, ino: stats.ino, size: stats.size, mtimeMs: stats.mtimeMs });
+const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
+/** `path` read in one go through one descriptor, so its bytes and identity belong together.
+ *  Undefined when there is no such file. */
+export function readLegacyIndex(path) {
+    let fd;
+    try {
+        fd = openSync(path, 'r');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+    try {
+        const identity = identityOf(fstatSync(fd));
+        const bytes = readFileSync(fd);
+        return { bytes, sha256: sha256(bytes), identity };
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Whether `path` holds exactly `snapshot`'s bytes. */
+function holds(path, snapshot) {
+    try {
+        if (statSync(path).size !== snapshot.bytes.length)
+            return false;
+        return sha256(readFileSync(path)) === snapshot.sha256;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Create `path` holding `bytes`, durably and never half-written: a temp file is written and
+ * synced, then linked into place, which refuses a name that already exists. False when it does.
+ * The directory is synced too, so a crash cannot forget the new name. A file system without hard
+ * links gets a rename, guarded by an existence check instead.
+ */
+function createDurably(path, bytes) {
+    const temp = `${path}.${randomUUID()}.tmp`;
+    // Removed on every way out, a failed write (ENOSPC) included: the name is either linked or gone.
+    try {
+        const fd = openSync(temp, 'wx');
+        try {
+            for (let written = 0; written < bytes.length;)
+                written += writeSync(fd, bytes, written);
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        try {
+            linkSync(temp, path);
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === 'EEXIST')
+                return false;
+            if (code !== 'EPERM' && code !== 'ENOTSUP' && code !== 'EXDEV')
+                throw error;
+            if (statSync(path, { throwIfNoEntry: false }))
+                return false;
+            renameSync(temp, path);
+        }
+    }
+    finally {
+        try {
+            unlinkSync(temp);
+        }
+        catch { /* never created, or renamed into place */ }
+    }
+    syncDirectory(path);
+    return true;
+}
+function syncDirectory(path) {
+    let fd;
+    try {
+        fd = openSync(dirname(path), 'r');
+        fsyncSync(fd);
+    }
+    catch {
+        // Not every platform can sync a directory; the file itself is already synced.
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+/**
+ * Keep exact snapshot bytes beside runs.json. Reuse a matching backup; preserve a different
+ * backup and use a digest-suffixed name. Called only after refusal checks inside the import
+ * transaction.
+ */
+export function backUpLegacyIndex(dataDir, snapshot) {
+    for (const name of [LEGACY_INDEX_BACKUP_FILE, `runs.json.pre-sqlite.${snapshot.sha256.slice(0, 12)}.bak`]) {
+        const path = join(dataDir, name);
+        if (holds(path, snapshot))
+            return name;
+        // Re-checked only after creating it: a file this did not create may hold other bytes.
+        if (createDurably(path, snapshot.bytes) || holds(path, snapshot))
+            return name;
+    }
+    throw new Error(`cannot back up ${LEGACY_INDEX_FILE}: both backup names are taken by other contents`);
+}
+/** An older cezar still writes `runs.json`, so it was not imported. */
+export class LegacyWriterError extends Error {
+    /** `cockpit`: a live cockpit other than this process holds `cockpit.lock`. `changed`: the file
+     *  changed between the read and the import. */
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.name = 'LegacyWriterError';
+        this.reason = reason;
+    }
+}
+/** Throw `LegacyWriterError` when a live cockpit other than this process owns `dataDir`. Cheap: one
+ *  small file read and a liveness probe, so the import asks it before it reads anything. */
+export function assertNoLegacyCockpit(dataDir) {
+    const owner = anotherCockpitOwner(dataDir);
+    if (owner) {
+        throw new LegacyWriterError('cockpit', `An older ${productName('cezar')} (pid ${owner.pid}${owner.url ? ` at ${owner.url}` : ''}) still serves this project and writes ${LEGACY_INDEX_FILE}. Stop it, then restart ${productName('cezar')}: ${LEGACY_INDEX_FILE} is imported once, while nothing else writes it.`);
+    }
+}
+/**
+ * Throw `LegacyWriterError` when an older cezar may still be writing `runs.json`: another live
+ * cockpit owns `dataDir` (`assertNoLegacyCockpit`), or the file is no longer what `snapshot` read
+ * (undefined: there was none). Inside the import transaction, right before it commits, this is
+ * the authority; asked earlier it only saves the work of an import that could not commit.
+ */
+export function assertNoLegacyWriter(dataDir, snapshot) {
+    assertNoLegacyCockpit(dataDir);
+    const now = statSync(join(dataDir, LEGACY_INDEX_FILE), { throwIfNoEntry: false });
+    const read = snapshot?.identity;
+    const same = now === undefined ? read === undefined
+        : read !== undefined && now.dev === read.dev && now.ino === read.ino && now.size === read.size && now.mtimeMs === read.mtimeMs;
+    if (!same) {
+        throw new LegacyWriterError('changed', `${LEGACY_INDEX_FILE} changed while ${productName('cezar')} was importing it: an older ${productName('cezar')} process still writes it. Stop every older ${productName('cezar')} process for this project, then restart ${productName('cezar')}.`);
+    }
+}
+//# sourceMappingURL=legacy-index.js.map

package/dist/runs/legacy-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-index.js","sourceRoot":"","sources":["../../src/runs/legacy-index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAc,MAAM,SAAS,CAAC;AACrJ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE;;;;GAIG;AAEH,wFAAwF;AACxF,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAC7C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAiBnE,MAAM,UAAU,GAAG,CAAC,KAAY,EAAgB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;AAClI,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE3F;4CAC4C;AAC5C,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACpD,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,uDAAuD;AACvD,SAAS,KAAK,CAAC,IAAY,EAAE,QAA6B;IACxD,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAChE,OAAO,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,QAAQ,CAAC,MAAM,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;IAC3C,iGAAiG;IACjG,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM;gBAAG,OAAO,IAAI,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACxF,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;QACD,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;YACnD,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACpC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO;gBAAE,MAAM,KAAK,CAAC;YAC5E,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC5D,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,0CAA0C,CAAC,CAAC;IAChF,CAAC;IACD,aAAa,CAAC,IAAI,CAAC,CAAC;IACpB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QAClC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,8EAA8E;IAChF,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,QAA6B;IAC9E,KAAK,MAAM,IAAI,IAAI,CAAC,wBAAwB,EAAE,wBAAwB,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1G,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,sFAAsF;QACtF,IAAI,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IAChF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,kBAAkB,iBAAiB,iDAAiD,CAAC,CAAC;AACxG,CAAC;AAED,uEAAuE;AACvE,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C;mDAC+C;IACtC,MAAM,CAAwB;IAEvC,YAAY,MAA6B,EAAE,OAAe;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;4FAC4F;AAC5F,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,YAAY,WAAW,CAAC,OAAO,CAAC,SAAS,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,0CAA0C,iBAAiB,2BAA2B,WAAW,CAAC,OAAO,CAAC,KAAK,iBAAiB,kDAAkD,CAAC,CAAC;IACrT,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,QAAyC;IAC7F,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,QAAQ,EAAE,QAAQ,CAAC;IAChC,MAAM,IAAI,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS;QACjD,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC;IACjI,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,GAAG,iBAAiB,kBAAkB,WAAW,CAAC,OAAO,CAAC,+BAA+B,WAAW,CAAC,OAAO,CAAC,8CAA8C,WAAW,CAAC,OAAO,CAAC,2CAA2C,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5R,CAAC;AACH,CAAC"}

package/dist/runs/legacy-run-rows.d.ts

@@ -0,0 +1,12 @@
+import type { parseRunRecords } from './store.ts';
+import type { RunRowInput } from './run-database.ts';
+/** `runs.json`'s records as rows, and how many of its entries were left out. Each row's `data` is
+ *  the record's own JSON as `runs.json` held it, so nothing this cezar's schema does not know is lost
+ *  (raw-record.ts); its summary and columns come from the parsed record, which is what decoding that
+ *  JSON gives back. An entry that does not parse is skipped and costs that entry only, as an
+ *  unreadable row does once it is in the database. Undefined when the file is not a JSON array. */
+export declare function legacyIndexRows(bytes: Buffer, parse: typeof parseRunRecords): {
+    rows: RunRowInput[];
+    skipped: number;
+    total: number;
+} | undefined;

package/dist/runs/legacy-run-rows.js

@@ -0,0 +1,33 @@
+import { encodeRunRow } from './run-row.js';
+/** `runs.json`'s records as rows, and how many of its entries were left out. Each row's `data` is
+ *  the record's own JSON as `runs.json` held it, so nothing this cezar's schema does not know is lost
+ *  (raw-record.ts); its summary and columns come from the parsed record, which is what decoding that
+ *  JSON gives back. An entry that does not parse is skipped and costs that entry only, as an
+ *  unreadable row does once it is in the database. Undefined when the file is not a JSON array. */
+export function legacyIndexRows(bytes, parse) {
+    let raw;
+    try {
+        raw = JSON.parse(bytes.toString('utf8'));
+    }
+    catch {
+        return undefined;
+    }
+    if (!Array.isArray(raw))
+        return undefined;
+    // A hand-edited index may repeat an id; the last one won when it loaded into a map, so it still does.
+    const rows = new Map();
+    let skipped = 0;
+    for (const entry of raw) {
+        // `parseRunRecords`' salvage rewrites top-level keys: the stored JSON is taken from a copy.
+        const stored = entry !== null && typeof entry === 'object' && !Array.isArray(entry) ? { ...entry } : entry;
+        const parsed = parse([entry]);
+        if (!parsed.success) {
+            skipped += 1;
+            continue;
+        }
+        const run = parsed.data[0];
+        rows.set(run.id, encodeRunRow(run, JSON.stringify(stored)));
+    }
+    return { rows: [...rows.values()], skipped, total: raw.length };
+}
+//# sourceMappingURL=legacy-run-rows.js.map

package/dist/runs/legacy-run-rows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-run-rows.js","sourceRoot":"","sources":["../../src/runs/legacy-run-rows.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C;;;;mGAImG;AACnG,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,KAA6B;IAC1E,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,sGAAsG;IACtG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,GAAgB,EAAE,CAAC;QACrC,4FAA4F;QAC5F,MAAM,MAAM,GAAG,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3G,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,CAAC;YACb,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AAClE,CAAC"}

package/dist/runs/legacy-waits.d.ts

@@ -0,0 +1,64 @@
+import type { CiWait, PrWaitEntry, RunRecord, WorkerWait, WorkerWaitEntry } from '../contract/index.js';
+export declare const UNREADABLE_WAIT = "Wait unavailable \u2014 a saved wait is unreadable; register a new wait.";
+export declare function hasLegacyWaitFields(row: unknown): boolean;
+/** A legacy `CiWait` as a wait entry. Its wake input's id was the wait's own (`wakeId`, which
+ *  `run.ts` set to the wait id), so the entry keeps that id and delivery still finds the input. */
+export declare function ciWaitEntry(wait: CiWait): PrWaitEntry;
+/**
+ * A legacy agent `delegation.wait` as a worker wait entry (store schema 6, hearsay-tools/cezarion#1235),
+ * judged from the wait alone: what became of its wake input is `upgradeLegacyWaits`' to apply.
+ * `registered`/`parked` → open; `wake-pending` → resolved with its `outcome`/`timeout` reason, or
+ * cancelled. Undefined for the `message` stand-in, which was never an agent's wait: a message no
+ * longer resolves a wait, and its input still wakes the run on its own.
+ *
+ * Deterministic, never read from the clock: a row is upgraded on every read until open rewrites
+ * it, and two reads must agree. A `WorkerWait` kept no registration time, so `timeoutSeconds` is
+ * the 600 default, `registeredAt` is 600 s before the original deadline (kept as it was), and the
+ * settled stamps come from the wait itself: `resolvedAt` is the latest observation it holds, else
+ * its deadline, and `cancelledAt` is its deadline. `now` is only the fallback for a deadline that
+ * does not read, which the wait schema never admits.
+ */
+export declare function workerWaitEntry(wait: WorkerWait, now: string): WorkerWaitEntry | undefined;
+/** Whether a record is a root still parked on its workers: an open or resolved worker wait in the
+ *  list. Such a root has its pending human question re-read from the transcript before a manager
+ *  parks it. Every stored `delegation.wait`, the completion gate's included, is read into the list
+ *  on open (store schema 7, hearsay-tools/cezarion#1301), so the list is the only place to look. */
+export declare function holdsWorkerWait(run: Pick<RunRecord, 'delegation' | 'waits'>): boolean;
+/**
+ * Upgrade-on-read (store schema 4, spec 2026-10-17-unified-waits): read a schema-3 record's CI and
+ * monitoring fields into its wait list, then delete them. Mutates `row`, before validation.
+ *
+ * - `ciWait`: `registered`/`parked` → an open `pr` checks wait, `wake-pending` → resolved (resolved when
+ *   its result was observed), `delivered`/`withdrawn` → `lastWaits` as delivered/cancelled.
+ * - `lastCiWait` → `lastWaits`: `delivered` stays delivered, anything else was withdrawn intent and
+ *   reads as cancelled. `lastCiWaitError` → `lastWaitsError`.
+ * - `activity: 'monitoring'` on a live run: with `monitoringWakeAt`, an open timer due then
+ *   (`seconds` is what remains, clamped to a timer's bounds); without one, no wait. Either way a
+ *   `running` run parks as `waiting`, its running step with it, as every waiting park writes it.
+ *   On a finished run the fields are stale and only dropped.
+ * - `hasPendingHumanAsk: true` on a `waiting` run with no open human wait (phase 4b,
+ *   hearsay-tools/cezarion#1236): an open `human` wait, `ask-line`, with no `askSeq`. Recovery shows
+ *   it (`surfaceHumanWait`), which attaches it to the question still pending in the transcript
+ *   instead of raising a second card. Anywhere else the summary is dropped: the human wait it stood
+ *   beside since phase 2 already says the same.
+ *
+ * - `delegation.wait`/`lastWait` registered by the agent (store schema 6, hearsay-tools/cezarion#1235)
+ *   → `workerWaitEntry`, then settled by what became of the wake input (`wakeId`, else the wait's own
+ *   id): a wait whose input was delivered reads as delivered, a `wake-pending` one whose input is
+ *   still queued stays resolved and records it as `wakeInputId`, so it is delivered once, and a
+ *   `lastWait` that was never delivered reads as cancelled. The `message` stand-in is dropped. No
+ *   input is added or removed: a cancelled receipt's undelivered wake stays queued and is delivered
+ *   as an ordinary input. The completion gate's wait (store schema 7, hearsay-tools/cezarion#1301) becomes a
+ *   `source: 'cezar'`, `via: 'completion'` entry the same way, and `delegation.completion` is dropped. A current wait
+ *   (the stand-in included) whose wake a provider took on a `waiting` run is the old engine's crash
+ *   between the delivery checkpoint and the resume: the run reads `running`, so recovery resumes
+ *   it. A wake an inbox read acknowledged, or one beside a pending question, resumes nothing.
+ *
+ * - A `waits`/`lastWaits` entry of kind `ci` (hearsay-tools/cezarion#1425) → kind `pr` with
+ *   `until: 'checks'` and `wakeOnConflict: true`, what a `ci` wait did.
+ *
+ * An unreadable legacy CI wait gets the per-entry salvage `parseRunRecords` gives `waits`: it is
+ * dropped, `lastWaitsError` says so, and the status is left alone. A `waiting` run with no open
+ * wait reads as Needs you, which a human can resume.
+ */
+export declare function upgradeLegacyWaits(row: Record<string, unknown>): void;