@hyperdrive.bot/fleet-server 0.3.164 → 0.3.166

package/dist/server/server/state/state-schema.d.ts

@@ -0,0 +1,39 @@
+import type { DatabaseSync } from "node:sqlite";
+/**
+ * Schema for `$PASEO_HOME/state.sqlite`, the daemon's non-blob state.
+ *
+ * Deliberately a separate file from `paseo.sqlite` (the ingestion ledger, with
+ * its own versioning contract and one-handle rule) and from
+ * `session-index.sqlite` (a derived, rebuildable search index). A bad migration
+ * here must never be able to touch either.
+ *
+ * One table shape, so every store is the same generic code path: each table
+ * holds keyed JSON documents. `scope` groups children under a parent (a
+ * schedule's runs, a loop's logs, a room's messages, an extension's keys);
+ * top-level documents use the empty scope. Every write stamps `rev` from one
+ * daemon-wide sequence, and a table with tombstones keeps a deleted row as
+ * `deleted_at` + `rev` with a NULL body, so "what changed since rev N" is one
+ * indexed range scan that also reports deletions.
+ *
+ * The append-only jsonl ledgers (blockers, card moves, authorship) are not
+ * here on purpose: appends are already O(1), their reads are indexed
+ * incrementally (`JsonlCardIndex`), and other processes may append to them.
+ */
+export declare const STATE_SCHEMA_VERSION = 2;
+export declare const DOC_TABLES: readonly ["agents", "projects", "workspaces", "schedules", "schedule_runs", "loops", "loop_logs", "chat_rooms", "chat_messages", "fleet_decisions", "push_tokens", "extension_kv"];
+export type DocTableName = (typeof DOC_TABLES)[number];
+/**
+ * Tables that keep a tombstone on delete. Fixed per table, not per caller: the
+ * import opens these tables before the stores do, and the first opener used
+ * to decide for everyone (the workspace registry then hard-deleted rows).
+ */
+export declare const TOMBSTONED_TABLES: ReadonlySet<DocTableName>;
+/**
+ * Bring a file to the current schema. Idempotent: every statement is
+ * `IF NOT EXISTS`, so running it on a current file changes nothing. A file
+ * stamped with a NEWER version than this build knows is refused, which makes
+ * the caller fall back to the file stores instead of writing rows a newer
+ * daemon laid out differently.
+ */
+export declare function ensureStateSchema(db: DatabaseSync): void;
+//# sourceMappingURL=state-schema.d.ts.map

package/dist/server/server/state/state-schema.js

@@ -0,0 +1,125 @@
+/**
+ * Schema for `$PASEO_HOME/state.sqlite`, the daemon's non-blob state.
+ *
+ * Deliberately a separate file from `paseo.sqlite` (the ingestion ledger, with
+ * its own versioning contract and one-handle rule) and from
+ * `session-index.sqlite` (a derived, rebuildable search index). A bad migration
+ * here must never be able to touch either.
+ *
+ * One table shape, so every store is the same generic code path: each table
+ * holds keyed JSON documents. `scope` groups children under a parent (a
+ * schedule's runs, a loop's logs, a room's messages, an extension's keys);
+ * top-level documents use the empty scope. Every write stamps `rev` from one
+ * daemon-wide sequence, and a table with tombstones keeps a deleted row as
+ * `deleted_at` + `rev` with a NULL body, so "what changed since rev N" is one
+ * indexed range scan that also reports deletions.
+ *
+ * The append-only jsonl ledgers (blockers, card moves, authorship) are not
+ * here on purpose: appends are already O(1), their reads are indexed
+ * incrementally (`JsonlCardIndex`), and other processes may append to them.
+ */
+export const STATE_SCHEMA_VERSION = 2;
+export const DOC_TABLES = [
+    "agents",
+    "projects",
+    "workspaces",
+    "schedules",
+    "schedule_runs",
+    "loops",
+    "loop_logs",
+    "chat_rooms",
+    "chat_messages",
+    "fleet_decisions",
+    "push_tokens",
+    "extension_kv",
+];
+/**
+ * Tables that keep a tombstone on delete. Fixed per table, not per caller: the
+ * import opens these tables before the stores do, and the first opener used
+ * to decide for everyone (the workspace registry then hard-deleted rows).
+ */
+export const TOMBSTONED_TABLES = new Set([
+    "agents",
+    "projects",
+    "workspaces",
+]);
+function docTableSql(name) {
+    return `
+    CREATE TABLE IF NOT EXISTS ${name} (
+      scope TEXT NOT NULL DEFAULT '',
+      id TEXT NOT NULL,
+      ord INTEGER NOT NULL DEFAULT 0,
+      rev INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      deleted_at INTEGER,
+      body TEXT,
+      PRIMARY KEY (scope, id)
+    ) WITHOUT ROWID;
+    CREATE INDEX IF NOT EXISTS ${name}_rev ON ${name}(rev);
+    CREATE INDEX IF NOT EXISTS ${name}_scope_ord ON ${name}(scope, ord);
+  `;
+}
+const V1_SQL = `
+  CREATE TABLE IF NOT EXISTS state_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);
+  CREATE TABLE IF NOT EXISTS state_import (
+    store TEXT PRIMARY KEY,
+    status TEXT NOT NULL,
+    cursor TEXT,
+    imported INTEGER NOT NULL DEFAULT 0,
+    skipped INTEGER NOT NULL DEFAULT 0,
+    started_at INTEGER,
+    finished_at INTEGER
+  );
+  ${DOC_TABLES.map(docTableSql).join("\n")}
+`;
+/**
+ * v2: the legacy file manifest. One row per legacy JSON file this daemon wrote
+ * (or imported): its content hash, size and mtime as it left them, and the
+ * daemon-wide rev the file reflects. A file that no longer matches its row was
+ * changed by someone else; a row whose file is gone was deleted by someone
+ * else. See `legacy-manifest.ts`. Paths are relative to PASEO_HOME.
+ */
+const V2_SQL = `
+  CREATE TABLE IF NOT EXISTS legacy_manifest (
+    path TEXT PRIMARY KEY,
+    store TEXT NOT NULL,
+    hash TEXT NOT NULL,
+    size INTEGER NOT NULL,
+    mtime_ms REAL NOT NULL,
+    rev INTEGER NOT NULL
+  ) WITHOUT ROWID;
+  CREATE INDEX IF NOT EXISTS legacy_manifest_store ON legacy_manifest(store);
+`;
+function readUserVersion(db) {
+    const row = db.prepare("PRAGMA user_version").get();
+    const value = row?.user_version;
+    return typeof value === "number" ? value : 0;
+}
+/**
+ * Bring a file to the current schema. Idempotent: every statement is
+ * `IF NOT EXISTS`, so running it on a current file changes nothing. A file
+ * stamped with a NEWER version than this build knows is refused, which makes
+ * the caller fall back to the file stores instead of writing rows a newer
+ * daemon laid out differently.
+ */
+export function ensureStateSchema(db) {
+    const current = readUserVersion(db);
+    if (current > STATE_SCHEMA_VERSION) {
+        throw new Error(`state.sqlite schema version ${current} is newer than this daemon supports (${STATE_SCHEMA_VERSION})`);
+    }
+    if (current < STATE_SCHEMA_VERSION) {
+        db.exec("BEGIN IMMEDIATE");
+        try {
+            if (current < 1)
+                db.exec(V1_SQL);
+            db.exec(V2_SQL);
+            db.exec(`PRAGMA user_version = ${STATE_SCHEMA_VERSION}`);
+            db.exec("COMMIT");
+        }
+        catch (error) {
+            db.exec("ROLLBACK");
+            throw error;
+        }
+    }
+}
+//# sourceMappingURL=state-schema.js.map

package/dist/server/server/state/state-worker.d.ts

@@ -0,0 +1,48 @@
+import type { Logger } from "pino";
+/** One statement for `StateWorker.write`: SQL plus its positional parameters. */
+export interface WorkerStatement {
+    sql: string;
+    params: Array<string | number | null>;
+}
+/**
+ * A worker thread with its own connection to `state.sqlite`, for the two kinds
+ * of work that must not run on the daemon's event loop.
+ *
+ * WAL checkpoints. SQLite's automatic checkpoint runs inside whichever COMMIT
+ * crosses the threshold, on the committing thread, and includes the fsync. On
+ * the reference host (WSL2, load average over 40) that put 400ms at p99 and
+ * 1.4s at worst into a single 50-row commit. With `wal_autocheckpoint = 0` on
+ * the main connection, commits only append to the WAL; this worker folds it
+ * into the database file off the loop, every 2s when there were commits.
+ *
+ * Bulk writes (the first-boot import). A synchronous write stalls whenever the
+ * filesystem does, which on that host held the loop for 500ms at a time during
+ * an import whose own work was 5ms per batch. The import parses on the main
+ * thread and hands each batch here as one transaction.
+ */
+export declare class StateWorker {
+    private readonly worker;
+    private readonly timer;
+    private readonly writes;
+    private nextWriteId;
+    private dirty;
+    private inFlight;
+    private closed;
+    private paused;
+    private constructor();
+    /** Start the worker, or return null so the caller keeps doing both on its own thread. */
+    static start(dbPath: string, logger: Logger): StateWorker | null;
+    markDirty(): void;
+    /** Commit `statements` as one transaction on the worker's connection. */
+    write(statements: WorkerStatement[]): Promise<void>;
+    /**
+     * Hold checkpoints (the first-boot import): a checkpoint's fsync shares the
+     * filesystem journal with the import's WAL appends. The WAL just grows until
+     * `resume`, which checkpoints once.
+     */
+    pause(): void;
+    resume(): void;
+    private tick;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=state-worker.d.ts.map

package/dist/server/server/state/state-worker.js

@@ -0,0 +1,165 @@
+import { Worker } from "node:worker_threads";
+/** How often the worker looks for committed work to fold into the db file. */
+const CHECKPOINT_INTERVAL_MS = 2000;
+// Plain CommonJS so it runs as an eval worker under the bundled daemon, tsx and
+// vitest alike, with no second entry point to ship.
+const WORKER_SOURCE = `
+const { parentPort, workerData } = require("node:worker_threads");
+const { DatabaseSync } = require("node:sqlite");
+const db = new DatabaseSync(workerData.dbPath);
+db.exec("PRAGMA busy_timeout = 5000");
+db.exec("PRAGMA synchronous = NORMAL");
+db.exec("PRAGMA wal_autocheckpoint = 0");
+const statements = new Map();
+function prepare(sql) {
+  let statement = statements.get(sql);
+  if (!statement) {
+    statement = db.prepare(sql);
+    statements.set(sql, statement);
+  }
+  return statement;
+}
+parentPort.on("message", (message) => {
+  if (message.type === "close") {
+    db.close();
+    parentPort.close();
+    return;
+  }
+  if (message.type === "write") {
+    try {
+      db.exec("BEGIN IMMEDIATE");
+      try {
+        for (const statement of message.statements) {
+          prepare(statement.sql).run(...statement.params);
+        }
+        db.exec("COMMIT");
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
+      parentPort.postMessage({ type: "write", id: message.id, ok: true });
+    } catch (error) {
+      parentPort.postMessage({ type: "write", id: message.id, ok: false, error: String(error) });
+    }
+    return;
+  }
+  try {
+    db.prepare("PRAGMA wal_checkpoint(PASSIVE)").get();
+    parentPort.postMessage({ type: "checkpoint", ok: true });
+  } catch (error) {
+    parentPort.postMessage({ type: "checkpoint", ok: false, error: String(error) });
+  }
+});
+`;
+/**
+ * A worker thread with its own connection to `state.sqlite`, for the two kinds
+ * of work that must not run on the daemon's event loop.
+ *
+ * WAL checkpoints. SQLite's automatic checkpoint runs inside whichever COMMIT
+ * crosses the threshold, on the committing thread, and includes the fsync. On
+ * the reference host (WSL2, load average over 40) that put 400ms at p99 and
+ * 1.4s at worst into a single 50-row commit. With `wal_autocheckpoint = 0` on
+ * the main connection, commits only append to the WAL; this worker folds it
+ * into the database file off the loop, every 2s when there were commits.
+ *
+ * Bulk writes (the first-boot import). A synchronous write stalls whenever the
+ * filesystem does, which on that host held the loop for 500ms at a time during
+ * an import whose own work was 5ms per batch. The import parses on the main
+ * thread and hands each batch here as one transaction.
+ */
+export class StateWorker {
+    constructor(worker, logger) {
+        this.writes = new Map();
+        this.nextWriteId = 1;
+        this.dirty = false;
+        this.inFlight = false;
+        this.closed = false;
+        this.paused = false;
+        this.worker = worker;
+        this.worker.unref();
+        this.worker.on("message", (message) => {
+            if (message.type === "write") {
+                const pending = this.writes.get(message.id);
+                this.writes.delete(message.id);
+                if (message.ok)
+                    pending?.resolve();
+                else
+                    pending?.reject(new Error(message.error ?? "state.sqlite worker write failed"));
+                return;
+            }
+            this.inFlight = false;
+            if (!message.ok) {
+                logger.warn({ error: message.error }, "state.sqlite WAL checkpoint failed");
+            }
+        });
+        this.worker.on("error", (error) => {
+            this.inFlight = false;
+            logger.warn({ err: error }, "state.sqlite worker failed");
+            for (const pending of this.writes.values())
+                pending.reject(error);
+            this.writes.clear();
+        });
+        this.timer = setInterval(() => this.tick(), CHECKPOINT_INTERVAL_MS);
+        this.timer.unref();
+    }
+    /** Start the worker, or return null so the caller keeps doing both on its own thread. */
+    static start(dbPath, logger) {
+        try {
+            const worker = new Worker(WORKER_SOURCE, { eval: true, workerData: { dbPath } });
+            return new StateWorker(worker, logger);
+        }
+        catch (error) {
+            logger.warn({ err: error }, "state.sqlite worker unavailable");
+            return null;
+        }
+    }
+    markDirty() {
+        this.dirty = true;
+    }
+    /** Commit `statements` as one transaction on the worker's connection. */
+    write(statements) {
+        if (this.closed) {
+            return Promise.reject(new Error("state.sqlite worker is closed"));
+        }
+        const id = this.nextWriteId++;
+        this.dirty = true;
+        return new Promise((resolve, reject) => {
+            this.writes.set(id, { resolve, reject });
+            // A worker_threads port, not a window: there is no origin to target.
+            // oxlint-disable-next-line unicorn/require-post-message-target-origin
+            this.worker.postMessage({ type: "write", id, statements });
+        });
+    }
+    /**
+     * Hold checkpoints (the first-boot import): a checkpoint's fsync shares the
+     * filesystem journal with the import's WAL appends. The WAL just grows until
+     * `resume`, which checkpoints once.
+     */
+    pause() {
+        this.paused = true;
+    }
+    resume() {
+        this.paused = false;
+        this.tick();
+    }
+    tick() {
+        if (!this.dirty || this.inFlight || this.closed || this.paused) {
+            return;
+        }
+        this.dirty = false;
+        this.inFlight = true;
+        // oxlint-disable-next-line unicorn/require-post-message-target-origin
+        this.worker.postMessage({ type: "checkpoint" });
+    }
+    async close() {
+        if (this.closed) {
+            return;
+        }
+        this.closed = true;
+        clearInterval(this.timer);
+        // oxlint-disable-next-line unicorn/require-post-message-target-origin
+        this.worker.postMessage({ type: "close" });
+        await this.worker.terminate();
+    }
+}
+//# sourceMappingURL=state-worker.js.map

package/dist/server/server/websocket-server.js

@@ -11,6 +11,7 @@ import { isHostnameAllowed } from "./hostnames.js";
 import { Session } from "./session.js";
 import { buildWorkspaceGitMetadataFromSnapshot } from "./workspace-git-metadata.js";
 import { PushTokenStore } from "./push/token-store.js";
+import { stateDbFor } from "./state/state-db.js";
 import { createPushNotificationSender } from "./push/notifications.js";
 import { computeNotificationPlan, isPushEligibleAttentionReason, } from "./agent-attention-policy.js";
 import { buildAgentAttentionNotificationPayload, findLatestPermissionRequest, } from "@hyperdrive.bot/fleet-protocol/agent-attention-notification";
@@ -348,7 +349,7 @@ export class VoiceAssistantWebSocketServer {
             this.broadcastDaemonConfigChanged(config);
         });
         const pushLogger = this.logger.child({ module: "push" });
-        this.pushTokenStore = new PushTokenStore(pushLogger, join(paseoHome, "push-tokens.json"));
+        this.pushTokenStore = new PushTokenStore(pushLogger, join(paseoHome, "push-tokens.json"), stateDbFor(paseoHome));
         // pushNotificationSender accepts an override from bootstrap (used in tests
         // to inject a mock); otherwise create the default one from the token store.
         this.pushNotificationSender =

package/dist/server/server/workspace/session-openable.js

@@ -2,10 +2,17 @@ import { promises as fsp } from "node:fs";
 import * as path from "node:path";
 import { resolvePaseoHome } from "../paseo-home.js";
 import { findClaudeSessionJsonl } from "../agent/providers/claude/resume-source.js";
+import { stateDbFor } from "../state/state-db.js";
 async function defaultClaudeJsonlExists(sid) {
     return (await findClaudeSessionJsonl(sid)) !== null;
 }
 async function defaultPaseoAgentExists(sid) {
+    // Agent records live in state.sqlite when the daemon has it; the files are
+    // only a lagging mirror (and absent under PASEO_STATE_FILE_MIRROR=0).
+    const stateDb = stateDbFor(resolvePaseoHome());
+    if (stateDb) {
+        return stateDb.doc("agents", { tombstones: true }).get("", sid) !== null;
+    }
     const agentsRoot = path.join(resolvePaseoHome(), "agents");
     let slugs;
     try {

package/dist/server/server/workspace-reconciliation-service.js

@@ -215,10 +215,14 @@ export class WorkspaceReconciliationService {
             project.displayName !== currentGit.projectDisplayName) {
             projectUpdates.displayName = currentGit.projectDisplayName;
         }
-        if (Object.keys(projectUpdates).length > 0) {
+        const latestProject = Object.keys(projectUpdates).length > 0
+            ? await this.projectRegistry.get(project.projectId)
+            : null;
+        if (latestProject) {
+            // Same stale-snapshot guard as for the workspaces below.
             const timestamp = new Date().toISOString();
             await this.projectRegistry.upsert({
-                ...project,
+                ...latestProject,
                 ...projectUpdates,
                 updatedAt: timestamp,
             });
@@ -244,9 +248,16 @@ export class WorkspaceReconciliationService {
             if (Object.keys(workspaceUpdates).length === 0) {
                 return;
             }
+            // Re-read after the git await: a record changed meanwhile (openProject
+            // reclassifying this workspace under its parent repo) must not be
+            // overwritten by the snapshot this pass started from.
+            const latest = await this.workspaceRegistry.get(workspace.workspaceId);
+            if (!latest) {
+                return;
+            }
             const timestamp = new Date().toISOString();
             await this.workspaceRegistry.upsert({
-                ...workspace,
+                ...latest,
                 ...workspaceUpdates,
                 updatedAt: timestamp,
             });

package/dist/server/server/workspace-registry.d.ts

@@ -1,5 +1,6 @@
 import type { Logger } from "pino";
 import { z } from "zod";
+import { type ChangedRow, type StateDb } from "./state/state-db.js";
 import type { PersistedProjectKind, PersistedWorkspaceKind } from "./workspace-registry-model.js";
 declare const PersistedProjectRecordSchema: z.ZodObject<{
     projectId: z.ZodString;
@@ -31,6 +32,36 @@ declare const PersistedWorkspaceRecordSchema: z.ZodObject<{
     updatedAt: z.ZodString;
     archivedAt: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
+export declare const PersistedProjectRecordListSchema: z.ZodArray<z.ZodObject<{
+    projectId: z.ZodString;
+    rootPath: z.ZodString;
+    kind: z.ZodEnum<{
+        git: "git";
+        non_git: "non_git";
+    }>;
+    displayName: z.ZodString;
+    customName: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | null, string | null | undefined>>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    archivedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>>;
+export declare const PersistedWorkspaceRecordListSchema: z.ZodArray<z.ZodObject<{
+    workspaceId: z.ZodString;
+    projectId: z.ZodString;
+    cwd: z.ZodString;
+    kind: z.ZodEnum<{
+        local_checkout: "local_checkout";
+        worktree: "worktree";
+        directory: "directory";
+    }>;
+    displayName: z.ZodString;
+    title: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | null, string | null | undefined>>;
+    branch: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | null, string | null | undefined>>;
+    baseBranch: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | null, string | null | undefined>>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    archivedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>>;
 export type PersistedProjectRecord = z.infer<typeof PersistedProjectRecordSchema>;
 export type PersistedWorkspaceRecord = z.infer<typeof PersistedWorkspaceRecordSchema>;
 export interface ProjectRegistry {
@@ -60,12 +91,15 @@ declare class FileBackedRegistry<TRecord extends RegistryRecord> {
     private loaded;
     private readonly cache;
     private persistQueue;
+    private readonly sqlite;
     constructor(options: {
         filePath: string;
         logger: Logger;
         schema: z.ZodType<TRecord, unknown>;
         getId: (record: TRecord) => string;
         component: string;
+        stateDb?: StateDb | null;
+        tableName: "projects" | "workspaces";
     });
     initialize(): Promise<void>;
     existsOnDisk(): Promise<boolean>;
@@ -76,13 +110,22 @@ declare class FileBackedRegistry<TRecord extends RegistryRecord> {
     remove(id: string): Promise<void>;
     private load;
     private persist;
+    /**
+     * Rows changed after a daemon-wide revision, tombstones included. Null on
+     * the file backend. Internal until the delta protocol ships.
+     */
+    listChangedSince(rev: number, limit?: number): ChangedRow[] | null;
     private enqueuePersist;
 }
 export declare class FileBackedProjectRegistry extends FileBackedRegistry<PersistedProjectRecord> implements ProjectRegistry {
-    constructor(filePath: string, logger: Logger);
+    constructor(filePath: string, logger: Logger, options?: {
+        stateDb?: StateDb | null;
+    });
 }
 export declare class FileBackedWorkspaceRegistry extends FileBackedRegistry<PersistedWorkspaceRecord> implements WorkspaceRegistry {
-    constructor(filePath: string, logger: Logger);
+    constructor(filePath: string, logger: Logger, options?: {
+        stateDb?: StateDb | null;
+    });
 }
 export declare function createPersistedProjectRecord(input: {
     projectId: string;

package/dist/server/server/workspace-registry.js

@@ -1,6 +1,7 @@
 import { promises as fs } from "node:fs";
 import { z } from "zod";
 import { writeJsonFileAtomic } from "./atomic-file.js";
+import { ScopeSync } from "./state/state-db.js";
 const PersistedProjectRecordSchema = z.object({
     projectId: z.string(),
     rootPath: z.string(),
@@ -51,12 +52,62 @@ const PersistedWorkspaceRecordSchema = z.object({
     updatedAt: z.string(),
     archivedAt: z.string().nullable(),
 });
+export const PersistedProjectRecordListSchema = z.array(PersistedProjectRecordSchema);
+export const PersistedWorkspaceRecordListSchema = z.array(PersistedWorkspaceRecordSchema);
+/**
+ * Registry rows in `state.sqlite` (`projects` / `workspaces`), each with a
+ * daemon-wide `rev` and a tombstone on removal. The registry still persists
+ * "the whole set" on every change; `ScopeSync` turns that into writes of only
+ * the rows that changed. The legacy JSON array is mirrored for the scripts that
+ * read it (loops run-agent.sh, paseo-new-host provision.sh).
+ */
+class SqliteRegistryStore {
+    constructor(state, tableName, filePath, getId) {
+        this.state = state;
+        this.filePath = filePath;
+        this.getId = getId;
+        this.table = state.doc(tableName, { tombstones: true });
+        this.store = tableName;
+        this.sync = new ScopeSync(this.table);
+    }
+    load() {
+        const rows = this.table.loadAll("");
+        this.sync.seed(rows);
+        const records = rows.map((row) => JSON.parse(row.body));
+        // The process died before the mirror caught the file up: write it now, so
+        // a rollback or a script does not read the older list.
+        const mirrored = this.state.manifest.get(this.filePath)?.rev ?? -1;
+        if (this.table.maxRev() > mirrored)
+            this.mirror(records);
+        return records;
+    }
+    mirror(records) {
+        const rev = this.state.mirrorRev();
+        this.state.mirror.write(`registry:${this.filePath}`, async () => {
+            await writeJsonFileAtomic(this.filePath, records);
+            await this.state.manifest.record(this.store, this.filePath, rev);
+        });
+    }
+    async save(records) {
+        await this.sync.sync("", records.map((record) => ({ id: this.getId(record), value: record })), { prune: true });
+        this.mirror(records);
+    }
+    listChangedSince(rev, limit) {
+        return this.table.listChangedSince(rev, limit);
+    }
+    hasRows() {
+        return this.table.count() > 0;
+    }
+}
 class FileBackedRegistry {
     constructor(options) {
         this.loaded = false;
         this.cache = new Map();
         this.persistQueue = Promise.resolve();
         this.filePath = options.filePath;
+        this.sqlite = options.stateDb
+            ? new SqliteRegistryStore(options.stateDb, options.tableName, options.filePath, options.getId)
+            : null;
         this.schema = options.schema;
         this.getId = options.getId;
         this.logger = options.logger.child({
@@ -68,6 +119,9 @@ class FileBackedRegistry {
         await this.load();
     }
     async existsOnDisk() {
+        if (this.sqlite?.hasRows()) {
+            return true;
+        }
         try {
             await fs.access(this.filePath);
             return true;
@@ -117,8 +171,10 @@ class FileBackedRegistry {
         }
         this.cache.clear();
         try {
-            const raw = await fs.readFile(this.filePath, "utf8");
-            const parsed = z.array(this.schema).parse(JSON.parse(raw));
+            const raw = this.sqlite
+                ? this.sqlite.load()
+                : JSON.parse(await fs.readFile(this.filePath, "utf8"));
+            const parsed = z.array(this.schema).parse(raw);
             for (const record of parsed) {
                 this.cache.set(this.getId(record), record);
             }
@@ -133,8 +189,19 @@ class FileBackedRegistry {
     }
     async persist() {
         const records = Array.from(this.cache.values());
+        if (this.sqlite) {
+            await this.sqlite.save(records);
+            return;
+        }
         await writeJsonFileAtomic(this.filePath, records);
     }
+    /**
+     * Rows changed after a daemon-wide revision, tombstones included. Null on
+     * the file backend. Internal until the delta protocol ships.
+     */
+    listChangedSince(rev, limit) {
+        return this.sqlite?.listChangedSince(rev, limit) ?? null;
+    }
     async enqueuePersist() {
         const nextPersist = this.persistQueue.then(() => this.persist());
         this.persistQueue = nextPersist.catch(() => { });
@@ -142,24 +209,28 @@ class FileBackedRegistry {
     }
 }
 export class FileBackedProjectRegistry extends FileBackedRegistry {
-    constructor(filePath, logger) {
+    constructor(filePath, logger, options = {}) {
         super({
             filePath,
             logger,
             schema: PersistedProjectRecordSchema,
             getId: (record) => record.projectId,
             component: "projects",
+            stateDb: options.stateDb,
+            tableName: "projects",
         });
     }
 }
 export class FileBackedWorkspaceRegistry extends FileBackedRegistry {
-    constructor(filePath, logger) {
+    constructor(filePath, logger, options = {}) {
         super({
             filePath,
             logger,
             schema: PersistedWorkspaceRecordSchema,
             getId: (record) => record.workspaceId,
             component: "workspaces",
+            stateDb: options.stateDb,
+            tableName: "workspaces",
         });
     }
 }