@hyperdrive.bot/fleet-server 0.3.164 → 0.3.165

package/dist/server/server/state/state-db.js

@@ -0,0 +1,772 @@
+import { createRequire } from "node:module";
+import { mkdirSync } from "node:fs";
+import { dirname, join, resolve as resolvePath } from "node:path";
+import { LegacyManifest } from "./legacy-manifest.js";
+import { LegacyMirror } from "./legacy-mirror.js";
+import { StateWorker } from "./state-worker.js";
+import { ensureStateSchema, TOMBSTONED_TABLES } from "./state-schema.js";
+export const STATE_DB_FILENAME = "state.sqlite";
+/** Kill switch: `PASEO_STATE_SQLITE=0` keeps every store on its legacy files. */
+export const STATE_SQLITE_ENV = "PASEO_STATE_SQLITE";
+/** Kill switch: `PASEO_STATE_FILE_MIRROR=0` stops writing the legacy files. */
+export const STATE_FILE_MIRROR_ENV = "PASEO_STATE_FILE_MIRROR";
+/**
+ * Resolve `node:sqlite` lazily, like `ingestion/ledger.ts`: a static import
+ * would crash the daemon at load on a runtime without the module, while this
+ * moves the failure inside `openStateDb`'s try, where it becomes a fallback.
+ */
+function loadDatabaseSyncCtor() {
+    const req = createRequire(import.meta.url);
+    return req("node:sqlite").DatabaseSync;
+}
+const RECENT_TXN_SAMPLES = 512;
+/** Backoff for a batch whose transaction could not start or commit (SQLITE_BUSY, I/O). */
+const COMMIT_RETRY_BASE_MS = 50;
+const COMMIT_RETRY_MAX_MS = 5000;
+/** How long a batch keeps retrying before its writes reject. */
+const COMMIT_RETRY_BUDGET_MS = 30000;
+/**
+ * The main connection never waits long for the write lock: a wait holds the
+ * event loop. Contention is retried asynchronously instead (see `requeue`).
+ * The import's connection on the worker keeps the longer wait.
+ */
+const MAIN_BUSY_TIMEOUT_MS = 250;
+/**
+ * The one handle on `state.sqlite`.
+ *
+ * Writes are queued and committed together in one transaction per turn of the
+ * event loop (`setImmediate`), so a burst of 50 agent updates is one commit, not
+ * 50. Reads on the hot path never come here: every store keeps its in-memory
+ * index and treats this file as its durable log. The only reads are at load, in
+ * explicit paged queries, and in `listChangedSince`.
+ */
+export class StateDb {
+    constructor(options) {
+        this.statements = new Map();
+        this.docs = new Map();
+        this.pending = [];
+        this.waiters = [];
+        this.flushScheduled = false;
+        this.closed = false;
+        this.worker = null;
+        this.consecutiveFailures = 0;
+        this.retryAttempts = 0;
+        this.retryStartedAt = null;
+        this.retryTimer = null;
+        this.stats = {
+            transactions: 0,
+            rows: 0,
+            recentTxnMs: [],
+            maxTxnMs: 0,
+        };
+        this.db = options.db;
+        this.dbPath = options.dbPath;
+        this.logger = options.logger;
+        this.mirror = options.mirror;
+        this.manifest = new LegacyManifest(this, dirname(options.dbPath));
+        this.revCounter = Number(this.getMeta("rev") ?? "0");
+    }
+    prepare(sql) {
+        let statement = this.statements.get(sql);
+        if (!statement) {
+            statement = this.db.prepare(sql);
+            this.statements.set(sql, statement);
+        }
+        return statement;
+    }
+    doc(name, options = {}) {
+        let table = this.docs.get(name);
+        if (!table) {
+            table = new DocTable(this, name, options.tombstones === true || TOMBSTONED_TABLES.has(name));
+            this.docs.set(name, table);
+        }
+        return table;
+    }
+    /** Next value of the daemon-wide change sequence. Persisted with each commit. */
+    nextRev() {
+        this.revCounter += 1;
+        return this.revCounter;
+    }
+    get currentRev() {
+        return this.revCounter;
+    }
+    /**
+     * The rev a mirror write reflects: the last rev already committed. Commits
+     * are synchronous, so every row the caller's in-memory state was built from
+     * has a rev at or below it. Deliberately no flush: flushing here would stamp
+     * the file with revs of writes queued after its content was captured, and a
+     * crash would then leave a lagging file the boot catch-up cannot see
+     * (re-review R1). Capture it where the content is captured.
+     */
+    mirrorRev() {
+        return this.revCounter;
+    }
+    /**
+     * Shutdown has begun (SIGTERM, SIGINT, the updater stopping the daemon):
+     * commit the queue and start every pending legacy file write now, instead of
+     * after the rest of the daemon has wound down.
+     */
+    beginShutdown() {
+        if (this.closed)
+            return Promise.resolve();
+        this.flushSync();
+        return this.mirror.beginShutdown();
+    }
+    /**
+     * Queue a write for the next batched commit. The promise settles when that
+     * commit lands. When a batch fails, its ops are retried one transaction each,
+     * so only the op that actually fails rejects.
+     */
+    enqueue(op) {
+        if (this.closed) {
+            return Promise.reject(new Error("state.sqlite is closed"));
+        }
+        this.pending.push(op);
+        const promise = new Promise((resolve, reject) => {
+            this.waiters.push({ resolve, reject });
+        });
+        // While a failed batch waits out its backoff, new writes join it.
+        if (!this.flushScheduled && this.retryTimer === null) {
+            this.flushScheduled = true;
+            setImmediate(() => this.flushSync());
+        }
+        return promise;
+    }
+    /** Commit everything queued, now. Safe to call with nothing queued. */
+    flushSync() {
+        // A batch is waiting out a lock-retry backoff: reads serve what is
+        // committed and never retry the commit on the event loop themselves.
+        if (this.retryTimer !== null) {
+            return;
+        }
+        this.commitPending();
+    }
+    commitPending() {
+        this.flushScheduled = false;
+        if (this.pending.length === 0) {
+            return;
+        }
+        const ops = this.pending;
+        const waiters = this.waiters;
+        this.pending = [];
+        this.waiters = [];
+        const started = performance.now();
+        let opFailed = false;
+        try {
+            this.transaction(() => {
+                for (const op of ops) {
+                    try {
+                        op();
+                    }
+                    catch (error) {
+                        opFailed = true;
+                        throw error;
+                    }
+                }
+                this.setMetaInTransaction("rev", String(this.revCounter));
+            });
+        }
+        catch (error) {
+            if (!opFailed) {
+                // The transaction itself failed (SQLITE_BUSY from another connection
+                // holding the write lock, an I/O error at BEGIN or COMMIT): no op is
+                // at fault. Keep the whole batch queued, in order, and retry off the
+                // event loop with backoff instead of busy-waiting per write here.
+                this.requeue(ops, waiters, error);
+                return;
+            }
+            this.retryStartedAt = null;
+            if (ops.length === 1) {
+                this.recordFailure(error, 1);
+                waiters[0].reject(error);
+                return;
+            }
+            // One bad op must not take every other store's write down with it:
+            // retry each on its own, so only the ones that fail again reject.
+            this.logger.warn({ err: error, rows: ops.length }, "state.sqlite batch commit failed; retrying each write on its own");
+            ops.forEach((op, index) => {
+                try {
+                    this.transaction(() => {
+                        op();
+                        this.setMetaInTransaction("rev", String(this.revCounter));
+                    });
+                    waiters[index].resolve();
+                }
+                catch (opError) {
+                    this.recordFailure(opError, 1);
+                    waiters[index].reject(opError);
+                }
+            });
+            this.recordTxn(performance.now() - started, ops.length);
+            return;
+        }
+        this.consecutiveFailures = 0;
+        this.retryAttempts = 0;
+        this.retryStartedAt = null;
+        this.recordTxn(performance.now() - started, ops.length);
+        for (const waiter of waiters)
+            waiter.resolve();
+    }
+    /**
+     * Put a batch whose transaction failed back at the head of the queue and
+     * retry it after a backoff. Once the batch has been failing for
+     * `COMMIT_RETRY_BUDGET_MS` it rejects, so a writer that holds the lock for good surfaces as
+     * failed writes and `failedCommits`, not as a queue that grows forever.
+     */
+    requeue(ops, waiters, error) {
+        this.retryAttempts += 1;
+        this.retryStartedAt ?? (this.retryStartedAt = Date.now());
+        this.recordFailure(error, ops.length);
+        if (Date.now() - this.retryStartedAt >= COMMIT_RETRY_BUDGET_MS) {
+            this.retryAttempts = 0;
+            this.retryStartedAt = null;
+            for (const waiter of waiters)
+                waiter.reject(error);
+            this.commitPending();
+            return;
+        }
+        this.pending = [...ops, ...this.pending];
+        this.waiters = [...waiters, ...this.waiters];
+        const delay = Math.min(COMMIT_RETRY_MAX_MS, COMMIT_RETRY_BASE_MS * 2 ** (this.retryAttempts - 1));
+        this.retryTimer = setTimeout(() => {
+            this.retryTimer = null;
+            if (!this.closed)
+                this.commitPending();
+        }, delay);
+        this.retryTimer.unref?.();
+    }
+    clearRetry() {
+        if (this.retryTimer)
+            clearTimeout(this.retryTimer);
+        this.retryTimer = null;
+    }
+    /** Commits that failed in a row; a health signal once it keeps climbing. */
+    get failedCommits() {
+        return this.consecutiveFailures;
+    }
+    recordFailure(error, rows) {
+        this.consecutiveFailures += 1;
+        this.logger.error({ err: error, rows, consecutiveFailures: this.consecutiveFailures }, "state.sqlite write failed");
+    }
+    /**
+     * Move WAL checkpoints and bulk writes to a worker thread (see
+     * `StateWorker`). If the worker cannot start, SQLite keeps checkpointing
+     * inside commits and bulk writes run here, as usual.
+     */
+    startWorker() {
+        this.worker = StateWorker.start(this.dbPath, this.logger);
+        if (this.worker) {
+            this.db.exec("PRAGMA wal_autocheckpoint = 0");
+        }
+    }
+    /** See `StateWorker.pause`. */
+    pauseCheckpoints() {
+        this.worker?.pause();
+    }
+    resumeCheckpoints() {
+        this.worker?.resume();
+    }
+    /**
+     * Commit a bulk batch as one transaction, off the event loop when the worker
+     * is up. Only for work nothing else is writing concurrently (the import runs
+     * before any store exists); the rev counter is persisted with the batch.
+     */
+    async commitBatch(statements) {
+        const all = [...statements, this.metaStatement("rev", String(this.revCounter))];
+        if (this.worker) {
+            await this.worker.write(all);
+            return;
+        }
+        this.transaction(() => {
+            for (const statement of all) {
+                this.prepare(statement.sql).run(...statement.params);
+            }
+        });
+    }
+    metaStatement(key, value) {
+        return {
+            sql: "INSERT INTO state_meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value",
+            params: [key, value],
+        };
+    }
+    /** Run `fn` in one IMMEDIATE transaction, rolling back on throw. */
+    transaction(fn) {
+        this.db.exec("BEGIN IMMEDIATE");
+        try {
+            const result = fn();
+            this.db.exec("COMMIT");
+            this.worker?.markDirty();
+            return result;
+        }
+        catch (error) {
+            try {
+                this.db.exec("ROLLBACK");
+            }
+            catch {
+                // The original error is the one worth reporting.
+            }
+            throw error;
+        }
+    }
+    getMeta(key) {
+        const row = this.prepare("SELECT value FROM state_meta WHERE key = ?").get(key);
+        return typeof row?.value === "string" ? row.value : null;
+    }
+    setMeta(key, value) {
+        this.flushSync();
+        this.setMetaInTransaction(key, value);
+    }
+    /** Every meta entry whose key starts with `prefix`, keyed by the rest of the key. */
+    getMetaWithPrefix(prefix) {
+        const rows = this.prepare("SELECT key, value FROM state_meta WHERE key >= ? AND key < ? ORDER BY key").all(prefix, `${prefix}\uffff`);
+        return new Map(rows.map((row) => [String(row.key).slice(prefix.length), String(row.value)]));
+    }
+    deleteMeta(key) {
+        this.flushSync();
+        this.prepare("DELETE FROM state_meta WHERE key = ?").run(key);
+    }
+    /** `setMeta` for use inside an open transaction. */
+    setMetaInTransaction(key, value) {
+        this.prepare("INSERT INTO state_meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(key, value);
+    }
+    getImportMarker(store) {
+        const row = this.prepare("SELECT status, cursor, imported, skipped FROM state_import WHERE store = ?").get(store);
+        if (!row) {
+            return null;
+        }
+        return {
+            status: row.status === "done" ? "done" : "running",
+            cursor: typeof row.cursor === "string" ? row.cursor : null,
+            imported: Number(row.imported ?? 0),
+            skipped: Number(row.skipped ?? 0),
+        };
+    }
+    /** Write an import marker. Call inside `transaction` to commit it with the rows it covers. */
+    putImportMarker(store, marker) {
+        const statement = this.importMarkerStatement(store, marker);
+        this.prepare(statement.sql).run(...statement.params);
+    }
+    /** `putImportMarker` as a statement for `commitBatch`, to commit with its rows. */
+    importMarkerStatement(store, marker) {
+        const now = Date.now();
+        return {
+            sql: `INSERT INTO state_import (store, status, cursor, imported, skipped, started_at, finished_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT(store) DO UPDATE SET status = excluded.status, cursor = excluded.cursor,
+         imported = excluded.imported, skipped = excluded.skipped,
+         finished_at = excluded.finished_at`,
+            params: [
+                store,
+                marker.status,
+                marker.cursor,
+                marker.imported,
+                marker.skipped,
+                now,
+                marker.status === "done" ? now : null,
+            ],
+        };
+    }
+    get writeStats() {
+        return { ...this.stats, recentTxnMs: [...this.stats.recentTxnMs] };
+    }
+    recordTxn(ms, rows) {
+        this.stats.transactions += 1;
+        this.stats.rows += rows;
+        this.stats.maxTxnMs = Math.max(this.stats.maxTxnMs, ms);
+        this.stats.recentTxnMs.push(ms);
+        if (this.stats.recentTxnMs.length > RECENT_TXN_SAMPLES) {
+            this.stats.recentTxnMs.shift();
+        }
+    }
+    /** Flush queued writes and the legacy mirror, then close the handle. */
+    async close() {
+        if (this.closed) {
+            return;
+        }
+        this.clearRetry();
+        this.flushSync();
+        await this.mirror.flush();
+        this.clearRetry();
+        this.flushSync();
+        this.clearRetry();
+        // Anything still queued could not commit (the lock never came free).
+        for (const waiter of this.waiters.splice(0)) {
+            waiter.reject(new Error("state.sqlite closed with writes that could not commit"));
+        }
+        this.pending = [];
+        this.closed = true;
+        await this.worker?.close();
+        try {
+            this.db.exec("PRAGMA optimize");
+        }
+        catch {
+            // Advisory only.
+        }
+        this.db.close();
+    }
+    /**
+     * Close without flushing the mirror or the queue, and drop pending mirror
+     * writes. Tests use it to simulate a kill -9.
+     */
+    closeImmediately() {
+        this.clearRetry();
+        this.mirror.discard();
+        this.pending = [];
+        this.waiters = [];
+        this.closed = true;
+        void this.worker?.close();
+        this.db.close();
+    }
+}
+/** A keyed-document table. See `state-schema.ts`. */
+export class DocTable {
+    constructor(state, name, tombstones) {
+        this.state = state;
+        this.name = name;
+        this.tombstones = tombstones;
+    }
+    /** Serialize now (so later mutation of `value` cannot leak in) and queue the upsert. */
+    put(scope, id, value, ord = 0) {
+        return this.putRaw(scope, id, JSON.stringify(value), ord);
+    }
+    putRaw(scope, id, body, ord = 0) {
+        return this.state.enqueue(() => this.putNow(scope, id, body, ord));
+    }
+    /** `put`, resolving with the rev the row was committed at. */
+    async putWithRev(scope, id, value) {
+        const body = JSON.stringify(value);
+        let rev = 0;
+        await this.state.enqueue(() => {
+            const statement = this.putStatement(scope, id, body);
+            rev = Number(statement.params[3]);
+            this.state.prepare(statement.sql).run(...statement.params);
+        });
+        return rev;
+    }
+    /** Upsert inside the caller's transaction. */
+    putNow(scope, id, body, ord = 0) {
+        const statement = this.putStatement(scope, id, body, ord);
+        this.state.prepare(statement.sql).run(...statement.params);
+    }
+    /** The upsert as a statement for `StateDb.commitBatch`; takes its rev now. */
+    putStatement(scope, id, body, ord = 0) {
+        return {
+            sql: `INSERT INTO ${this.name} (scope, id, ord, rev, updated_at, deleted_at, body)
+         VALUES (?, ?, ?, ?, ?, NULL, ?)
+         ON CONFLICT(scope, id) DO UPDATE SET ord = excluded.ord, rev = excluded.rev,
+           updated_at = excluded.updated_at, deleted_at = NULL, body = excluded.body`,
+            params: [scope, id, ord, this.state.nextRev(), Date.now(), body],
+        };
+    }
+    remove(scope, id) {
+        return this.state.enqueue(() => this.removeNow(scope, id));
+    }
+    removeNow(scope, id) {
+        const statement = this.removeStatement(scope, id);
+        this.state.prepare(statement.sql).run(...statement.params);
+    }
+    /** The removal (a tombstone on a tombstoned table) as a batch statement; takes its rev now. */
+    removeStatement(scope, id) {
+        if (this.tombstones) {
+            const now = Date.now();
+            return {
+                sql: `UPDATE ${this.name} SET rev = ?, updated_at = ?, deleted_at = ?, body = NULL
+           WHERE scope = ? AND id = ? AND deleted_at IS NULL`,
+                params: [this.state.nextRev(), now, now, scope, id],
+            };
+        }
+        return { sql: `DELETE FROM ${this.name} WHERE scope = ? AND id = ?`, params: [scope, id] };
+    }
+    /**
+     * Rows, tombstones included, optionally narrowed to one scope and one id. No
+     * flush: for reconciliation, which runs before any store writes.
+     */
+    storedRows(filter = {}) {
+        const where = [];
+        const params = [];
+        if (filter.scope !== undefined) {
+            where.push("scope = ?");
+            params.push(filter.scope);
+        }
+        if (filter.id !== undefined) {
+            where.push("id = ?");
+            params.push(filter.id);
+        }
+        return this.state
+            .prepare(`SELECT scope, id, rev, deleted_at, body FROM ${this.name}${where.length > 0 ? ` WHERE ${where.join(" AND ")}` : ""}`)
+            .all(...params)
+            .map((row) => ({
+            scope: String(row.scope),
+            id: String(row.id),
+            rev: Number(row.rev),
+            deletedAt: row.deleted_at === null ? null : Number(row.deleted_at),
+            body: row.body === null ? null : String(row.body),
+        }));
+    }
+    /** Drop every row of a scope (a deleted schedule's runs). Never tombstoned. */
+    removeScope(scope) {
+        return this.state.enqueue(() => {
+            this.state.prepare(`DELETE FROM ${this.name} WHERE scope = ?`).run(scope);
+        });
+    }
+    /** Live rows, ordered by scope, ord, id. Flushes queued writes first. */
+    loadAll(scope) {
+        this.state.flushSync();
+        return this.loadAllInTransaction(scope);
+    }
+    /** `loadAll` for use inside an open transaction (no flush). */
+    loadAllInTransaction(scope) {
+        const rows = scope === undefined
+            ? this.state
+                .prepare(`SELECT scope, id, body, rev FROM ${this.name} WHERE deleted_at IS NULL ORDER BY scope, ord, id`)
+                .all()
+            : this.state
+                .prepare(`SELECT scope, id, body, rev FROM ${this.name} WHERE scope = ? AND deleted_at IS NULL ORDER BY ord, id`)
+                .all(scope);
+        return rows.map((row) => ({
+            scope: String(row.scope),
+            id: String(row.id),
+            body: String(row.body),
+            rev: Number(row.rev),
+        }));
+    }
+    get(scope, id) {
+        this.state.flushSync();
+        return this.getInTransaction(scope, id);
+    }
+    /** `get` for use inside an open transaction (no flush). */
+    getInTransaction(scope, id) {
+        const row = this.state
+            .prepare(`SELECT body FROM ${this.name} WHERE scope = ? AND id = ? AND deleted_at IS NULL`)
+            .get(scope, id);
+        return typeof row?.body === "string" ? row.body : null;
+    }
+    /**
+     * Drop tombstones deleted before `before`, except ids in `keep`. Returns how
+     * many went.
+     */
+    purgeTombstones(before, keep = new Set()) {
+        this.state.flushSync();
+        const rows = this.state
+            .prepare(`SELECT scope, id FROM ${this.name} WHERE deleted_at IS NOT NULL AND deleted_at < ?`)
+            .all(before)
+            .filter((row) => !keep.has(String(row.id)));
+        if (rows.length === 0)
+            return 0;
+        this.state.transaction(() => {
+            const statement = this.state.prepare(`DELETE FROM ${this.name} WHERE scope = ? AND id = ? AND deleted_at IS NOT NULL`);
+            for (const row of rows)
+                statement.run(String(row.scope), String(row.id));
+        });
+        return rows.length;
+    }
+    /** Highest rev in the table, tombstones included (0 when empty). */
+    maxRev() {
+        this.state.flushSync();
+        const row = this.state.prepare(`SELECT MAX(rev) AS rev FROM ${this.name}`).get();
+        return Number(row?.rev ?? 0);
+    }
+    count() {
+        this.state.flushSync();
+        const row = this.state
+            .prepare(`SELECT COUNT(*) AS n FROM ${this.name} WHERE deleted_at IS NULL`)
+            .get();
+        return Number(row?.n ?? 0);
+    }
+    /**
+     * Rows (live and tombstoned) whose rev is greater than `rev`, oldest change
+     * first. Internal for now; the delta protocol exposes it in a later release.
+     */
+    listChangedSince(rev, limit = 1000) {
+        this.state.flushSync();
+        return this.state
+            .prepare(`SELECT scope, id, rev, deleted_at, body FROM ${this.name} WHERE rev > ? ORDER BY rev LIMIT ?`)
+            .all(rev, limit)
+            .map((row) => ({
+            scope: String(row.scope),
+            id: String(row.id),
+            rev: Number(row.rev),
+            deletedAt: row.deleted_at === null ? null : Number(row.deleted_at),
+            body: row.body === null ? null : String(row.body),
+        }));
+    }
+}
+/**
+ * Keeps a scope's rows in step with an in-memory list, writing only what
+ * changed. The last-written body per row is remembered, so a store that
+ * persists "everything" on each change (loops, chat, registries) costs one
+ * stringify per row and zero writes for the rows that did not move.
+ *
+ * A write that fails to commit is forgotten again (unless a later sync already
+ * replaced it), so the next sync writes that row instead of skipping it as
+ * already on disk.
+ */
+/** Never equal to a JSON body, so a row marked with it is always rewritten. */
+const UNKNOWN_BODY = "\u0000unknown";
+export class ScopeSync {
+    constructor(table) {
+        this.table = table;
+        this.written = new Map();
+    }
+    /** Seed from rows already in the table, so the first sync does not rewrite them. */
+    seed(rows) {
+        for (const row of rows) {
+            this.scopeMap(row.scope).set(row.id, row.body);
+        }
+    }
+    /** Queue the diff inside the next batch. `prune` removes rows no longer listed. */
+    sync(scope, items, options) {
+        const previous = this.scopeMap(scope);
+        const next = new Map();
+        const writes = [];
+        items.forEach((item, index) => {
+            const body = JSON.stringify(item.value);
+            next.set(item.id, body);
+            if (previous.get(item.id) !== body) {
+                writes.push({ id: item.id, body, ord: index });
+            }
+        });
+        const removals = options.prune ? [...previous.keys()].filter((id) => !next.has(id)) : [];
+        if (!options.prune) {
+            for (const [id, body] of previous) {
+                if (!next.has(id))
+                    next.set(id, body);
+            }
+        }
+        this.written.set(scope, next);
+        if (writes.length === 0 && removals.length === 0) {
+            return Promise.resolve();
+        }
+        const forgetOnFailure = (id, body) => (error) => {
+            const map = this.written.get(scope);
+            if (!map)
+                throw error;
+            if (body === null) {
+                // A failed removal: mark the row unknown so a prune tries again.
+                if (!map.has(id))
+                    map.set(id, UNKNOWN_BODY);
+            }
+            else if (map.get(id) === body) {
+                map.delete(id);
+            }
+            throw error;
+        };
+        return Promise.all([
+            ...writes.map((write) => this.table
+                .putRaw(scope, write.id, write.body, write.ord)
+                .catch(forgetOnFailure(write.id, write.body))),
+            ...removals.map((id) => this.table.remove(scope, id).catch(forgetOnFailure(id, null))),
+        ]).then(() => undefined);
+    }
+    /**
+     * Drop every tracked scope not in `live` (a deleted room's messages, a
+     * deleted loop's logs), so children never outlive their parent.
+     */
+    dropScopesExcept(live) {
+        const stale = [...this.written.keys()].filter((scope) => !live.has(scope));
+        return Promise.all(stale.map((scope) => this.dropScope(scope))).then(() => undefined);
+    }
+    dropScope(scope) {
+        this.written.delete(scope);
+        return this.table.removeScope(scope);
+    }
+    scopeMap(scope) {
+        let map = this.written.get(scope);
+        if (!map) {
+            map = new Map();
+            this.written.set(scope, map);
+        }
+        return map;
+    }
+}
+/**
+ * Open and probe `state.sqlite`, or return null so every store stays on its
+ * legacy files. Never throws: a runtime without `node:sqlite` (Node 20, Node
+ * 22 before 22.13 without the flag), a locked or corrupt file, or a schema
+ * newer than this build all degrade to the file stores with one warning.
+ */
+export function openStateDb(options) {
+    const env = options.env ?? process.env;
+    const logger = options.logger.child({ module: "state-db" });
+    if (env[STATE_SQLITE_ENV] === "0") {
+        logger.info(`${STATE_SQLITE_ENV}=0: daemon state stays on the legacy file stores`);
+        return null;
+    }
+    const dbPath = join(options.paseoHome, STATE_DB_FILENAME);
+    let db = null;
+    try {
+        mkdirSync(options.paseoHome, { recursive: true });
+        const Ctor = (options.loadCtor ?? loadDatabaseSyncCtor)();
+        db = new Ctor(dbPath);
+        // busy_timeout first: switching to WAL needs a lock too, and without a
+        // timeout a checkpoint still finishing elsewhere fails the open at once.
+        db.exec("PRAGMA busy_timeout = 5000");
+        db.exec("PRAGMA journal_mode = WAL");
+        db.exec("PRAGMA synchronous = NORMAL");
+        db.exec("PRAGMA temp_store = MEMORY");
+        ensureStateSchema(db);
+        // Probe a real write and read back before any store trusts this file.
+        const probe = String(Date.now());
+        db.prepare("INSERT INTO state_meta (key, value) VALUES ('probe', ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(probe);
+        const readBack = db.prepare("SELECT value FROM state_meta WHERE key = 'probe'").get();
+        if (readBack?.value !== probe) {
+            throw new Error("state.sqlite probe read back a different value");
+        }
+        db.exec(`PRAGMA busy_timeout = ${MAIN_BUSY_TIMEOUT_MS}`);
+    }
+    catch (error) {
+        try {
+            db?.close();
+        }
+        catch {
+            // Already failing; the warning below is the report.
+        }
+        logger.warn({ err: error, dbPath }, "state.sqlite unavailable; daemon state stays on the legacy file stores");
+        return null;
+    }
+    const mirror = new LegacyMirror({
+        enabled: env[STATE_FILE_MIRROR_ENV] !== "0",
+        logger,
+        debounceMs: options.mirrorDebounceMs,
+    });
+    const stateDb = new StateDb({ db, dbPath, logger, mirror });
+    if (options.worker !== false) {
+        stateDb.startWorker();
+    }
+    return stateDb;
+}
+const attached = new Map();
+/**
+ * Stores constructed deep inside other services (schedules, fleet decisions,
+ * push tokens, extension storage) find the daemon's handle by PASEO_HOME
+ * instead of having it threaded through every constructor in between. Nothing
+ * attached means file stores, which is also what every unit test gets.
+ */
+export function attachStateDb(paseoHome, stateDb) {
+    attached.set(resolvePath(paseoHome), stateDb);
+    installBeforeExitFlush();
+}
+let beforeExitInstalled = false;
+/**
+ * Mirror timers are unref'd so they never hold the process open, which means a
+ * process that simply runs out of work would exit with writes still debounced.
+ * `beforeExit` fires exactly then, and async work started here runs to the end.
+ */
+function installBeforeExitFlush() {
+    if (beforeExitInstalled)
+        return;
+    beforeExitInstalled = true;
+    process.on("beforeExit", () => {
+        for (const stateDb of attached.values()) {
+            if (stateDb.mirror.pendingCount > 0)
+                void stateDb.beginShutdown();
+        }
+    });
+}
+export function detachStateDb(paseoHome) {
+    attached.delete(resolvePath(paseoHome));
+}
+export function stateDbFor(paseoHome) {
+    return attached.get(resolvePath(paseoHome)) ?? null;
+}
+//# sourceMappingURL=state-db.js.map