@meterbility/collector 0.3.1

package/dist/index.js

@@ -0,0 +1,1475 @@
+// src/store.ts
+import { mkdir as mkdir2 } from "fs/promises";
+import { mkdirSync } from "fs";
+import { dirname as dirname2 } from "path";
+import Database from "better-sqlite3";
+import { dbPath, meterHome } from "@meterbility/shared";
+
+// src/schema.ts
+var SCHEMA_VERSION = 5;
+function ensureSchema(db) {
+  db.pragma("journal_mode = WAL");
+  db.pragma("synchronous = NORMAL");
+  db.pragma("foreign_keys = ON");
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS meta (
+      key TEXT PRIMARY KEY,
+      value TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS projects (
+      project_id TEXT PRIMARY KEY,
+      name TEXT NOT NULL,
+      cwd TEXT NOT NULL UNIQUE,
+      created_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS agents (
+      agent_id TEXT PRIMARY KEY,
+      project_id TEXT NOT NULL REFERENCES projects(project_id),
+      name TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      UNIQUE(project_id, name)
+    );
+
+    CREATE TABLE IF NOT EXISTS runs (
+      run_id TEXT PRIMARY KEY,
+      agent_id TEXT NOT NULL REFERENCES agents(agent_id),
+      project_id TEXT NOT NULL REFERENCES projects(project_id),
+      source_session_id TEXT,
+      source_runtime TEXT NOT NULL,
+      title TEXT,
+      status TEXT NOT NULL,
+      started_at TEXT NOT NULL,
+      ended_at TEXT,
+      git_branch TEXT,
+      cwd TEXT,
+      fork_origin_run_id TEXT REFERENCES runs(run_id),
+      fork_origin_step_id TEXT,
+      tokens_total_input INTEGER NOT NULL DEFAULT 0,
+      tokens_total_output INTEGER NOT NULL DEFAULT 0,
+      tokens_total_cached INTEGER NOT NULL DEFAULT 0,
+      cost_cents REAL NOT NULL DEFAULT 0,
+      step_count INTEGER NOT NULL DEFAULT 0,
+      tags TEXT NOT NULL DEFAULT '[]'
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_runs_project_started
+      ON runs(project_id, started_at DESC);
+    CREATE INDEX IF NOT EXISTS idx_runs_session
+      ON runs(source_session_id);
+    CREATE INDEX IF NOT EXISTS idx_runs_fork_origin
+      ON runs(fork_origin_run_id);
+
+    CREATE TABLE IF NOT EXISTS steps (
+      step_id TEXT PRIMARY KEY,
+      run_id TEXT NOT NULL REFERENCES runs(run_id) ON DELETE CASCADE,
+      parent_step_id TEXT,
+      fork_origin_id TEXT,
+      sequence INTEGER NOT NULL,
+      timestamp TEXT NOT NULL,
+      model TEXT NOT NULL,
+      context_snapshot_id TEXT NOT NULL,
+      decision_ref TEXT NOT NULL,
+      action_json TEXT NOT NULL,
+      outcome_json TEXT NOT NULL,
+      tokens_input INTEGER NOT NULL DEFAULT 0,
+      tokens_output INTEGER NOT NULL DEFAULT 0,
+      tokens_cached_read INTEGER NOT NULL DEFAULT 0,
+      tokens_cache_creation INTEGER NOT NULL DEFAULT 0,
+      tokens_cache_creation_1h INTEGER NOT NULL DEFAULT 0,
+      tokens_reasoning INTEGER,
+      latency_ms INTEGER NOT NULL DEFAULT 0,
+      cost_cents REAL NOT NULL DEFAULT 0,
+      status TEXT NOT NULL,
+      tags TEXT NOT NULL DEFAULT '[]',
+      UNIQUE(run_id, sequence)
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_steps_run
+      ON steps(run_id, sequence);
+    CREATE INDEX IF NOT EXISTS idx_steps_context
+      ON steps(context_snapshot_id);
+
+    -- Stored context snapshots. The 'id' is the SHA256 of the canonicalized
+    -- snapshot JSON; the snapshot JSON itself lives in the blob store.
+    CREATE TABLE IF NOT EXISTS context_snapshots (
+      snapshot_id TEXT PRIMARY KEY,
+      blob_ref TEXT NOT NULL,
+      component_count INTEGER NOT NULL DEFAULT 0,
+      created_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS forks (
+      fork_id TEXT PRIMARY KEY,
+      origin_run_id TEXT NOT NULL REFERENCES runs(run_id),
+      origin_step_id TEXT NOT NULL,
+      fork_run_id TEXT NOT NULL REFERENCES runs(run_id),
+      edit_type TEXT NOT NULL,
+      edit_payload_json TEXT NOT NULL,
+      created_at TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_forks_origin
+      ON forks(origin_run_id);
+
+    CREATE TABLE IF NOT EXISTS annotations (
+      annotation_id TEXT PRIMARY KEY,
+      target_kind TEXT NOT NULL,
+      target_id TEXT NOT NULL,
+      author TEXT NOT NULL,
+      verdict TEXT,
+      note TEXT,
+      kind TEXT NOT NULL DEFAULT 'comment'
+        CHECK (kind IN ('comment', 'probe_pause', 'probe_edit', 'capture_skipped')),
+      created_at TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_annotations_target
+      ON annotations(target_kind, target_id);
+    -- idx_annotations_kind is created AFTER ensureColumn below so
+    -- legacy v4 DBs (which lack the kind column at executescript
+    -- time) don't trip on referencing a column that doesn't exist
+    -- yet. For fresh DBs the column is created above so the index
+    -- still fires on the same call path, just a few statements later.
+
+    -- Idempotency aid for the Claude Code adapter: remember the last byte
+    -- offset we ingested per session file so we can resume cheaply.
+    CREATE TABLE IF NOT EXISTS ingest_progress (
+      source_runtime TEXT NOT NULL,
+      source_path TEXT NOT NULL,
+      last_offset INTEGER NOT NULL,
+      last_ingested_at TEXT NOT NULL,
+      PRIMARY KEY (source_runtime, source_path)
+    );
+
+    CREATE TABLE IF NOT EXISTS settings (
+      key TEXT PRIMARY KEY,
+      value TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS redaction_log (
+      blob_ref TEXT NOT NULL,
+      rule TEXT NOT NULL,
+      count INTEGER NOT NULL,
+      created_at TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_redaction_blob
+      ON redaction_log(blob_ref);
+
+    -- \u2500\u2500\u2500 v0.3 Track A: per-step file change capture \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    -- One row per file mutation attributed to a Step. Vendor-neutral \u2014
+    -- Claude Code hook adapter writes v0.3; Codex / SDK / proxy / file
+    -- watcher fill in additional source paths in v0.4. Path-keyed
+    -- queries are core (per v0.3 \xA73.1.2: "show me every change to
+    -- src/auth.ts across this run"), so indexes cover (run_id, path)
+    -- as well as the step join.
+    --
+    -- before_blob_ref / after_blob_ref are content addresses into the
+    -- blob store. NULL sentinels carry meaning: NULL before = 'create'
+    -- (or partial); NULL after = 'delete' (or partial). The
+    -- partial_diff flag distinguishes "we didn't capture this" from
+    -- "this side genuinely doesn't exist" so the UI can render the
+    -- right affordance.
+    --
+    -- CHECK constraints declare the full enum even where v0.3 only
+    -- writes a subset \u2014 see the additive-only note above the schema
+    -- version constant.
+    CREATE TABLE IF NOT EXISTS file_change (
+      file_change_id      TEXT PRIMARY KEY,
+      run_id              TEXT NOT NULL REFERENCES runs(run_id) ON DELETE CASCADE,
+      step_id             TEXT NOT NULL REFERENCES steps(step_id) ON DELETE CASCADE,
+      sequence            INTEGER NOT NULL,
+      tool_call_id        TEXT,
+      derived_from        TEXT NOT NULL
+        CHECK (derived_from IN ('tool_call','filesystem_watch','git_diff')),
+      path                TEXT NOT NULL,
+      old_path            TEXT,
+      op                  TEXT NOT NULL
+        CHECK (op IN ('create','modify','delete','rename','chmod')),
+      before_blob_ref     TEXT,
+      after_blob_ref      TEXT,
+      partial_diff        INTEGER NOT NULL DEFAULT 0,
+      gitignored          INTEGER NOT NULL DEFAULT 0,
+      patch_text          TEXT,
+      patch_format        TEXT
+        CHECK (patch_format IN ('unified','binary','notebook_cell')
+               OR patch_format IS NULL),
+      encoding            TEXT,
+      bom                 INTEGER NOT NULL DEFAULT 0,
+      line_endings        TEXT,
+      mime                TEXT,
+      language            TEXT,
+      size_before         INTEGER,
+      size_after          INTEGER,
+      line_count_before   INTEGER,
+      line_count_after    INTEGER,
+      lines_added         INTEGER NOT NULL DEFAULT 0,
+      lines_removed       INTEGER NOT NULL DEFAULT 0,
+      mode_before         INTEGER,
+      mode_after          INTEGER,
+      source_tool_name    TEXT,
+      source_tool_input   TEXT,
+      redacted            INTEGER NOT NULL DEFAULT 0,
+      normalizer_notes    TEXT,
+      created_at          TEXT NOT NULL,
+      UNIQUE(step_id, sequence)
+    );
+    CREATE INDEX IF NOT EXISTS idx_fc_run_step
+      ON file_change(run_id, step_id);
+    CREATE INDEX IF NOT EXISTS idx_fc_run_path
+      ON file_change(run_id, path);
+    CREATE INDEX IF NOT EXISTS idx_fc_step
+      ON file_change(step_id);
+    CREATE INDEX IF NOT EXISTS idx_fc_path_seq
+      ON file_change(run_id, path, step_id);
+
+    -- \u2500\u2500\u2500 v0.3 Track A: baseline working tree \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    -- Content-addressed snapshot of the project's files at Run start,
+    -- captured lazily on the first FileChange (per v0.3 \xA73.5). The
+    -- replay algorithm (\xA73.6) layers FileChange rows on top of this to
+    -- compute working_tree_at(run, step) in O(touched_paths) instead of
+    -- O(total_files_in_repo).
+    --
+    -- manifest_blob_ref points at a sorted, NUL-separated, newline-
+    -- delimited blob (each record is path + NUL + mode + NUL + blob_ref
+    -- followed by a newline). Sortedness gives byte-identical manifests
+    -- for identical trees, which dedups via SHA naturally \u2014 two runs
+    -- against the same git HEAD share one baseline blob.
+    --
+    -- git_head / git_dirty are advisory metadata only. Meterbility never
+    -- depends on git being present.
+    CREATE TABLE IF NOT EXISTS baseline_tree (
+      baseline_tree_id    TEXT PRIMARY KEY,
+      project_id          TEXT NOT NULL REFERENCES projects(project_id),
+      manifest_blob_ref   TEXT NOT NULL,
+      git_head            TEXT,
+      git_dirty           INTEGER NOT NULL DEFAULT 0,
+      captured_at         TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_bt_project
+      ON baseline_tree(project_id);
+    CREATE INDEX IF NOT EXISTS idx_bt_git
+      ON baseline_tree(project_id, git_head);
+
+    -- Regression suite (v0.1). A test = name + assertion list.
+    -- Optionally references a canonical run that originated the test.
+    CREATE TABLE IF NOT EXISTS regression_tests (
+      test_id TEXT PRIMARY KEY,
+      name TEXT NOT NULL UNIQUE,
+      description TEXT,
+      assertions_json TEXT NOT NULL,
+      canonical_run_id TEXT REFERENCES runs(run_id),
+      created_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS regression_results (
+      result_id TEXT PRIMARY KEY,
+      test_id TEXT NOT NULL REFERENCES regression_tests(test_id) ON DELETE CASCADE,
+      run_id TEXT NOT NULL REFERENCES runs(run_id) ON DELETE CASCADE,
+      passed INTEGER NOT NULL,
+      details_json TEXT NOT NULL,
+      created_at TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_regression_results_test
+      ON regression_results(test_id, created_at DESC);
+  `);
+  ensureColumn(
+    db,
+    "steps",
+    "tokens_cache_creation_1h",
+    "INTEGER NOT NULL DEFAULT 0"
+  );
+  ensureColumn(db, "runs", "baseline_tree_id", "TEXT");
+  ensureColumn(db, "runs", "probe_state", "TEXT");
+  ensureColumn(
+    db,
+    "annotations",
+    "kind",
+    "TEXT NOT NULL DEFAULT 'comment'"
+  );
+  db.exec(
+    "CREATE INDEX IF NOT EXISTS idx_annotations_kind ON annotations(kind)"
+  );
+  const row = db.prepare("SELECT value FROM meta WHERE key = 'schema_version'").get();
+  if (!row) {
+    db.prepare("INSERT INTO meta(key,value) VALUES(?,?)").run(
+      "schema_version",
+      String(SCHEMA_VERSION)
+    );
+  } else if (Number(row.value) < SCHEMA_VERSION) {
+    db.prepare("UPDATE meta SET value = ? WHERE key = 'schema_version'").run(
+      String(SCHEMA_VERSION)
+    );
+  }
+}
+function ensureColumn(db, table, column, ddl) {
+  const cols = db.pragma(`table_info(${table})`);
+  if (cols.find((c) => c.name === column)) return;
+  db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${ddl}`);
+}
+
+// src/blobs.ts
+import { mkdir, writeFile, readFile, stat } from "fs/promises";
+import { dirname } from "path";
+import {
+  blobPath,
+  blobRoot,
+  hashJson,
+  redactBuffer,
+  sha256
+} from "@meterbility/shared";
+function isProbablyText(buf) {
+  for (let i = 0; i < buf.length; i++) {
+    if (buf[i] === 0) return false;
+  }
+  if (buf.length > 0 && Buffer.byteLength(buf.toString("utf-8"), "utf-8") !== buf.length) {
+    return false;
+  }
+  return true;
+}
+var BlobStore = class {
+  constructor(db) {
+    this.db = db;
+  }
+  db;
+  async putString(content, opts) {
+    return this.putBuffer(Buffer.from(content, "utf-8"), opts);
+  }
+  async putJson(value, opts) {
+    return this.putString(JSON.stringify(value), opts);
+  }
+  /**
+   * Hash without persisting — useful when you want a snapshot id before
+   * deciding whether to write.
+   */
+  hashJson(value) {
+    return hashJson(value);
+  }
+  async putBuffer(buf, opts) {
+    const shouldSkip = opts?.skipRedact === true || !isProbablyText(buf);
+    const { buffer: scrubbed, redactions } = shouldSkip ? { buffer: buf, redactions: [] } : redactBuffer(buf);
+    const hash = sha256(scrubbed);
+    const path = blobPath(hash);
+    try {
+      await stat(path);
+      return hash;
+    } catch {
+    }
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, scrubbed);
+    if (redactions.length) {
+      const stmt = this.db.prepare(
+        "INSERT INTO redaction_log(blob_ref, rule, count, created_at) VALUES (?,?,?,?)"
+      );
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      for (const r of redactions) stmt.run(hash, r.rule, r.count, now);
+    }
+    return hash;
+  }
+  async getString(hash) {
+    const buf = await this.getBuffer(hash);
+    return buf.toString("utf-8");
+  }
+  async getJson(hash) {
+    const text = await this.getString(hash);
+    return JSON.parse(text);
+  }
+  async getBuffer(hash) {
+    return readFile(blobPath(hash));
+  }
+  async tryGetString(hash) {
+    try {
+      return await this.getString(hash);
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Binary-safe variant of `tryGetString`. Used by /api/blob/:hash/render
+   * which has to look at raw bytes for MIME sniffing before deciding
+   * whether to render text or serve as image/octet-stream.
+   */
+  async tryGetBuffer(hash) {
+    try {
+      return await this.getBuffer(hash);
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Write pre-computed HTML (or other text) under a caller-chosen
+   * synthetic key, bypassing the content-addressed hash. Used by the
+   * blob_render cache to store rendered HTML under a key derived
+   * from `sha(blob_hash + lang + RENDER_VERSION)` rather than the
+   * content's own hash — this way two different renders of the same
+   * source code (e.g. lang=auto vs lang=typescript) cache separately
+   * but predictably.
+   *
+   * Skips redaction (renders are derived from already-stored blobs
+   * that went through redaction at put time).
+   */
+  async putWithKey(content, key) {
+    const path = blobPath(key);
+    try {
+      await stat(path);
+      return;
+    } catch {
+    }
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, Buffer.from(content, "utf-8"));
+  }
+  rootDir() {
+    return blobRoot();
+  }
+};
+
+// src/store.ts
+var Store = class _Store {
+  db;
+  blobs;
+  constructor(db) {
+    this.db = db;
+    this.blobs = new BlobStore(db);
+  }
+  static open(opts) {
+    const path = opts?.path ?? dbPath();
+    mkdirSync(meterHome(), { recursive: true });
+    mkdirSync(dirname2(path), { recursive: true });
+    const db = new Database(path);
+    ensureSchema(db);
+    return new _Store(db);
+  }
+  static async openAsync(opts) {
+    const path = opts?.path ?? dbPath();
+    await mkdir2(meterHome(), { recursive: true });
+    await mkdir2(dirname2(path), { recursive: true });
+    return this.open(opts);
+  }
+  close() {
+    this.db.close();
+  }
+};
+
+// src/queries.ts
+import { randomUUID } from "crypto";
+function rowToRun(row) {
+  return {
+    run_id: row.run_id,
+    agent_id: row.agent_id,
+    project_id: row.project_id,
+    source_session_id: row.source_session_id ?? void 0,
+    source_runtime: row.source_runtime,
+    title: row.title ?? void 0,
+    status: row.status,
+    started_at: row.started_at,
+    ended_at: row.ended_at ?? void 0,
+    git_branch: row.git_branch ?? void 0,
+    cwd: row.cwd ?? void 0,
+    fork_origin_run_id: row.fork_origin_run_id ?? void 0,
+    fork_origin_step_id: row.fork_origin_step_id ?? void 0,
+    tokens_total_input: row.tokens_total_input,
+    tokens_total_output: row.tokens_total_output,
+    tokens_total_cached: row.tokens_total_cached,
+    cost_cents: row.cost_cents,
+    step_count: row.step_count,
+    tags: JSON.parse(row.tags),
+    baseline_tree_id: row.baseline_tree_id ?? void 0,
+    probe_state: row.probe_state === "paused" || row.probe_state === "resumed" ? row.probe_state : void 0
+  };
+}
+function rowToStep(row) {
+  return {
+    step_id: row.step_id,
+    run_id: row.run_id,
+    parent_step_id: row.parent_step_id ?? void 0,
+    fork_origin_id: row.fork_origin_id ?? void 0,
+    sequence: row.sequence,
+    timestamp: row.timestamp,
+    model: row.model,
+    context_snapshot_id: row.context_snapshot_id,
+    decision_ref: row.decision_ref,
+    action: JSON.parse(row.action_json),
+    outcome: JSON.parse(row.outcome_json),
+    tokens: {
+      input: row.tokens_input,
+      output: row.tokens_output,
+      cached_read: row.tokens_cached_read,
+      cache_creation: row.tokens_cache_creation,
+      cache_creation_1h: row.tokens_cache_creation_1h ?? 0,
+      reasoning: row.tokens_reasoning ?? void 0
+    },
+    latency_ms: row.latency_ms,
+    cost_cents: row.cost_cents,
+    tags: JSON.parse(row.tags),
+    status: row.status
+  };
+}
+function upsertProjectByCwd(store, cwd, name) {
+  const existing = store.db.prepare("SELECT * FROM projects WHERE cwd = ?").get(cwd);
+  if (existing) return existing;
+  const project = {
+    project_id: `prj_${randomUUID()}`,
+    cwd,
+    name: name ?? cwd.split("/").pop() ?? cwd,
+    created_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  store.db.prepare(
+    "INSERT INTO projects(project_id, name, cwd, created_at) VALUES (?,?,?,?)"
+  ).run(project.project_id, project.name, project.cwd, project.created_at);
+  return project;
+}
+function upsertAgent(store, projectId, name) {
+  const existing = store.db.prepare("SELECT * FROM agents WHERE project_id = ? AND name = ?").get(projectId, name);
+  if (existing) return existing;
+  const agent = {
+    agent_id: `agt_${randomUUID()}`,
+    project_id: projectId,
+    name,
+    created_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  store.db.prepare("INSERT INTO agents(agent_id, project_id, name, created_at) VALUES (?,?,?,?)").run(agent.agent_id, agent.project_id, agent.name, agent.created_at);
+  return agent;
+}
+function insertRun(store, run) {
+  store.db.prepare(
+    `INSERT INTO runs(
+        run_id, agent_id, project_id, source_session_id, source_runtime,
+        title, status, started_at, ended_at, git_branch, cwd,
+        fork_origin_run_id, fork_origin_step_id,
+        tokens_total_input, tokens_total_output, tokens_total_cached,
+        cost_cents, step_count, tags,
+        baseline_tree_id, probe_state
+       ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`
+  ).run(
+    run.run_id,
+    run.agent_id,
+    run.project_id,
+    run.source_session_id ?? null,
+    run.source_runtime,
+    run.title ?? null,
+    run.status,
+    run.started_at,
+    run.ended_at ?? null,
+    run.git_branch ?? null,
+    run.cwd ?? null,
+    run.fork_origin_run_id ?? null,
+    run.fork_origin_step_id ?? null,
+    run.tokens_total_input,
+    run.tokens_total_output,
+    run.tokens_total_cached,
+    run.cost_cents,
+    run.step_count,
+    JSON.stringify(run.tags ?? []),
+    run.baseline_tree_id ?? null,
+    run.probe_state ?? null
+  );
+}
+function updateRunTotals(store, runId) {
+  store.db.prepare(
+    `UPDATE runs SET
+         step_count = (SELECT COUNT(*) FROM steps WHERE run_id = runs.run_id),
+         tokens_total_input = COALESCE(
+           (SELECT SUM(tokens_input) FROM steps WHERE run_id = runs.run_id), 0),
+         tokens_total_output = COALESCE(
+           (SELECT SUM(tokens_output) FROM steps WHERE run_id = runs.run_id), 0),
+         tokens_total_cached = COALESCE(
+           (SELECT SUM(tokens_cached_read + tokens_cache_creation + tokens_cache_creation_1h)
+              FROM steps WHERE run_id = runs.run_id), 0),
+         cost_cents = COALESCE(
+           (SELECT SUM(cost_cents) FROM steps WHERE run_id = runs.run_id), 0)
+       WHERE run_id = ?`
+  ).run(runId);
+}
+function setRunStatus(store, runId, status, endedAt) {
+  store.db.prepare("UPDATE runs SET status = ?, ended_at = ? WHERE run_id = ?").run(status, endedAt ?? null, runId);
+}
+function insertStep(store, step) {
+  store.db.prepare(
+    `INSERT OR REPLACE INTO steps(
+        step_id, run_id, parent_step_id, fork_origin_id, sequence, timestamp,
+        model, context_snapshot_id, decision_ref, action_json, outcome_json,
+        tokens_input, tokens_output, tokens_cached_read, tokens_cache_creation,
+        tokens_cache_creation_1h, tokens_reasoning, latency_ms, cost_cents,
+        status, tags
+       ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`
+  ).run(
+    step.step_id,
+    step.run_id,
+    step.parent_step_id ?? null,
+    step.fork_origin_id ?? null,
+    step.sequence,
+    step.timestamp,
+    step.model,
+    step.context_snapshot_id,
+    step.decision_ref,
+    JSON.stringify(step.action),
+    JSON.stringify(step.outcome),
+    step.tokens.input,
+    step.tokens.output,
+    step.tokens.cached_read,
+    step.tokens.cache_creation,
+    step.tokens.cache_creation_1h ?? 0,
+    step.tokens.reasoning ?? null,
+    step.latency_ms,
+    step.cost_cents,
+    step.status,
+    JSON.stringify(step.tags ?? [])
+  );
+}
+function recordContextSnapshot(store, snapshotId, blobRef, componentCount) {
+  store.db.prepare(
+    `INSERT OR IGNORE INTO context_snapshots(snapshot_id, blob_ref, component_count, created_at)
+       VALUES (?,?,?,?)`
+  ).run(snapshotId, blobRef, componentCount, (/* @__PURE__ */ new Date()).toISOString());
+}
+function resolveSnapshotBlobRef(store, snapshotId) {
+  const row = store.db.prepare("SELECT blob_ref FROM context_snapshots WHERE snapshot_id = ?").get(snapshotId);
+  return row?.blob_ref ?? snapshotId;
+}
+function getRun(store, runId) {
+  const exact = store.db.prepare("SELECT * FROM runs WHERE run_id = ?").get(runId);
+  if (exact) return rowToRun(exact);
+  if (runId.length < 6) return void 0;
+  const prefix = store.db.prepare("SELECT * FROM runs WHERE run_id LIKE ? LIMIT 2").all(`${runId}%`);
+  if (prefix.length === 1) return rowToRun(prefix[0]);
+  return void 0;
+}
+function listRuns(store, opts = {}) {
+  const params = [];
+  let where = "1=1";
+  if (opts.projectId) {
+    where += " AND project_id = ?";
+    params.push(opts.projectId);
+  }
+  if (opts.agentId) {
+    where += " AND agent_id = ?";
+    params.push(opts.agentId);
+  }
+  if (opts.status) {
+    where += " AND status = ?";
+    params.push(opts.status);
+  }
+  if (opts.containsTool) {
+    where += " AND run_id IN (SELECT run_id FROM steps WHERE action_json LIKE ?)";
+    params.push(`%"tool_name":"${opts.containsTool}"%`);
+  }
+  const limit = opts.limit ?? 50;
+  const rows = store.db.prepare(
+    `SELECT * FROM runs WHERE ${where} ORDER BY started_at DESC LIMIT ?`
+  ).all(...params, limit);
+  return rows.map(rowToRun);
+}
+function listSteps(store, runId) {
+  const rows = store.db.prepare("SELECT * FROM steps WHERE run_id = ? ORDER BY sequence ASC").all(runId);
+  return rows.map(rowToStep);
+}
+function getStep(store, stepId) {
+  const exact = store.db.prepare("SELECT * FROM steps WHERE step_id = ?").get(stepId);
+  if (exact) return rowToStep(exact);
+  if (stepId.length < 6) return void 0;
+  const prefix = store.db.prepare("SELECT * FROM steps WHERE step_id LIKE ? LIMIT 2").all(`${stepId}%`);
+  if (prefix.length === 1) return rowToStep(prefix[0]);
+  return void 0;
+}
+function getStepBySequence(store, runId, sequence) {
+  const row = store.db.prepare("SELECT * FROM steps WHERE run_id = ? AND sequence = ?").get(runId, sequence);
+  return row ? rowToStep(row) : void 0;
+}
+function insertFork(store, args) {
+  const fork_id = `frk_${randomUUID()}`;
+  store.db.prepare(
+    `INSERT INTO forks(fork_id, origin_run_id, origin_step_id, fork_run_id,
+                          edit_type, edit_payload_json, created_at)
+       VALUES (?,?,?,?,?,?,?)`
+  ).run(
+    fork_id,
+    args.originRunId,
+    args.originStepId,
+    args.forkRunId,
+    args.edit.type,
+    JSON.stringify(args.edit.payload ?? null),
+    (/* @__PURE__ */ new Date()).toISOString()
+  );
+  return fork_id;
+}
+function listForks(store, originRunId) {
+  return store.db.prepare(
+    "SELECT fork_id, origin_run_id, origin_step_id, fork_run_id, edit_type, created_at FROM forks WHERE origin_run_id = ? ORDER BY created_at"
+  ).all(originRunId);
+}
+function insertAnnotation(store, args) {
+  const ann = {
+    annotation_id: `ann_${randomUUID()}`,
+    target_kind: args.targetKind,
+    target_id: args.targetId,
+    author: args.author,
+    kind: args.kind ?? "comment",
+    verdict: args.verdict,
+    note: args.note,
+    created_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  store.db.prepare(
+    `INSERT INTO annotations(annotation_id, target_kind, target_id, author, kind, verdict, note, created_at)
+       VALUES (?,?,?,?,?,?,?,?)`
+  ).run(
+    ann.annotation_id,
+    ann.target_kind,
+    ann.target_id,
+    ann.author,
+    ann.kind,
+    ann.verdict ?? null,
+    ann.note ?? null,
+    ann.created_at
+  );
+  return ann;
+}
+function listAnnotations(store, targetKind, targetId) {
+  const rows = store.db.prepare(
+    "SELECT * FROM annotations WHERE target_kind = ? AND target_id = ? ORDER BY created_at"
+  ).all(targetKind, targetId);
+  return rows.map((r) => ({
+    annotation_id: r.annotation_id,
+    target_kind: r.target_kind,
+    target_id: r.target_id,
+    author: r.author,
+    kind: r.kind,
+    verdict: r.verdict ?? void 0,
+    note: r.note ?? void 0,
+    created_at: r.created_at
+  }));
+}
+function getIngestOffset(store, source_runtime, source_path) {
+  const row = store.db.prepare(
+    "SELECT last_offset FROM ingest_progress WHERE source_runtime = ? AND source_path = ?"
+  ).get(source_runtime, source_path);
+  return row?.last_offset ?? 0;
+}
+function setIngestOffset(store, source_runtime, source_path, offset) {
+  store.db.prepare(
+    `INSERT INTO ingest_progress(source_runtime, source_path, last_offset, last_ingested_at)
+       VALUES(?,?,?,?)
+       ON CONFLICT(source_runtime, source_path) DO UPDATE SET
+         last_offset = excluded.last_offset,
+         last_ingested_at = excluded.last_ingested_at`
+  ).run(source_runtime, source_path, offset, (/* @__PURE__ */ new Date()).toISOString());
+}
+function getRunBySessionId(store, sourceSessionId) {
+  const row = store.db.prepare("SELECT * FROM runs WHERE source_session_id = ? ORDER BY started_at DESC LIMIT 1").get(sourceSessionId);
+  return row ? rowToRun(row) : void 0;
+}
+function aggregateTokens(steps) {
+  return steps.reduce(
+    (acc, s) => ({
+      input: acc.input + s.tokens.input,
+      output: acc.output + s.tokens.output,
+      cached_read: acc.cached_read + s.tokens.cached_read,
+      cache_creation: acc.cache_creation + s.tokens.cache_creation,
+      cache_creation_1h: (acc.cache_creation_1h ?? 0) + (s.tokens.cache_creation_1h ?? 0)
+    }),
+    {
+      input: 0,
+      output: 0,
+      cached_read: 0,
+      cache_creation: 0,
+      cache_creation_1h: 0
+    }
+  );
+}
+function rowToFileChange(row) {
+  return {
+    file_change_id: row.file_change_id,
+    run_id: row.run_id,
+    step_id: row.step_id,
+    sequence: row.sequence,
+    tool_call_id: row.tool_call_id ?? void 0,
+    derived_from: row.derived_from,
+    path: row.path,
+    old_path: row.old_path ?? void 0,
+    op: row.op,
+    before_blob_ref: row.before_blob_ref ?? void 0,
+    after_blob_ref: row.after_blob_ref ?? void 0,
+    partial_diff: row.partial_diff === 1,
+    gitignored: row.gitignored === 1,
+    patch_text: row.patch_text ?? void 0,
+    patch_format: row.patch_format ?? void 0,
+    encoding: row.encoding ?? void 0,
+    bom: row.bom === 1,
+    line_endings: row.line_endings ?? void 0,
+    mime: row.mime ?? void 0,
+    language: row.language ?? void 0,
+    size_before: row.size_before ?? void 0,
+    size_after: row.size_after ?? void 0,
+    line_count_before: row.line_count_before ?? void 0,
+    line_count_after: row.line_count_after ?? void 0,
+    lines_added: row.lines_added,
+    lines_removed: row.lines_removed,
+    mode_before: row.mode_before ?? void 0,
+    mode_after: row.mode_after ?? void 0,
+    source_tool_name: row.source_tool_name ?? void 0,
+    source_tool_input: row.source_tool_input ? safeJsonParse(row.source_tool_input) : void 0,
+    redacted: row.redacted === 1,
+    normalizer_notes: row.normalizer_notes ? safeJsonParse(row.normalizer_notes) : void 0,
+    created_at: row.created_at
+  };
+}
+function safeJsonParse(s) {
+  try {
+    return JSON.parse(s);
+  } catch {
+    return s;
+  }
+}
+var FileChangeInvariantError = class extends Error {
+  constructor(message) {
+    super(`FileChange invariant violation: ${message}`);
+    this.name = "FileChangeInvariantError";
+  }
+};
+function assertFileChangeInvariants(fc) {
+  if (fc.op === "chmod") return;
+  if (fc.partial_diff) {
+    if (fc.before_blob_ref !== void 0) {
+      throw new FileChangeInvariantError(
+        `partial_diff=true requires before_blob_ref to be null (got ${JSON.stringify(fc.before_blob_ref)})`
+      );
+    }
+    if (fc.after_blob_ref !== void 0) {
+      throw new FileChangeInvariantError(
+        `partial_diff=true requires after_blob_ref to be null (got ${JSON.stringify(fc.after_blob_ref)})`
+      );
+    }
+    return;
+  }
+  if (fc.op === "create") {
+    if (fc.before_blob_ref !== void 0) {
+      throw new FileChangeInvariantError(
+        "op='create' requires before_blob_ref to be null"
+      );
+    }
+    if (fc.after_blob_ref === void 0) {
+      throw new FileChangeInvariantError(
+        "op='create' requires after_blob_ref to be set"
+      );
+    }
+    return;
+  }
+  if (fc.op === "delete") {
+    if (fc.before_blob_ref === void 0) {
+      throw new FileChangeInvariantError(
+        "op='delete' requires before_blob_ref to be set"
+      );
+    }
+    if (fc.after_blob_ref !== void 0) {
+      throw new FileChangeInvariantError(
+        "op='delete' requires after_blob_ref to be null"
+      );
+    }
+    return;
+  }
+  if (fc.before_blob_ref === void 0) {
+    throw new FileChangeInvariantError(
+      `op='${fc.op}' requires before_blob_ref to be set (use partial_diff=true if not captured)`
+    );
+  }
+  if (fc.after_blob_ref === void 0) {
+    throw new FileChangeInvariantError(
+      `op='${fc.op}' requires after_blob_ref to be set (use partial_diff=true if not captured)`
+    );
+  }
+  if (fc.op === "rename" && fc.old_path === void 0) {
+    throw new FileChangeInvariantError("op='rename' requires old_path to be set");
+  }
+}
+function insertFileChange(store, fc) {
+  assertFileChangeInvariants(fc);
+  const id = fc.file_change_id ?? `fc_${randomUUID()}`;
+  const created = fc.created_at ?? (/* @__PURE__ */ new Date()).toISOString();
+  store.db.prepare(
+    `INSERT INTO file_change(
+        file_change_id, run_id, step_id, sequence,
+        tool_call_id, derived_from, path, old_path, op,
+        before_blob_ref, after_blob_ref,
+        partial_diff, gitignored,
+        patch_text, patch_format,
+        encoding, bom, line_endings, mime, language,
+        size_before, size_after, line_count_before, line_count_after,
+        lines_added, lines_removed,
+        mode_before, mode_after,
+        source_tool_name, source_tool_input,
+        redacted, normalizer_notes, created_at
+       ) VALUES (
+         ?, ?, ?, ?,
+         ?, ?, ?, ?, ?,
+         ?, ?,
+         ?, ?,
+         ?, ?,
+         ?, ?, ?, ?, ?,
+         ?, ?, ?, ?,
+         ?, ?,
+         ?, ?,
+         ?, ?,
+         ?, ?, ?
+       )`
+  ).run(
+    id,
+    fc.run_id,
+    fc.step_id,
+    fc.sequence,
+    fc.tool_call_id ?? null,
+    fc.derived_from,
+    fc.path,
+    fc.old_path ?? null,
+    fc.op,
+    fc.before_blob_ref ?? null,
+    fc.after_blob_ref ?? null,
+    fc.partial_diff ? 1 : 0,
+    fc.gitignored ? 1 : 0,
+    fc.patch_text ?? null,
+    fc.patch_format ?? null,
+    fc.encoding ?? null,
+    fc.bom ? 1 : 0,
+    fc.line_endings ?? null,
+    fc.mime ?? null,
+    fc.language ?? null,
+    fc.size_before ?? null,
+    fc.size_after ?? null,
+    fc.line_count_before ?? null,
+    fc.line_count_after ?? null,
+    fc.lines_added,
+    fc.lines_removed,
+    fc.mode_before ?? null,
+    fc.mode_after ?? null,
+    fc.source_tool_name ?? null,
+    fc.source_tool_input !== void 0 ? JSON.stringify(fc.source_tool_input) : null,
+    fc.redacted ? 1 : 0,
+    fc.normalizer_notes !== void 0 ? JSON.stringify(fc.normalizer_notes) : null,
+    created
+  );
+  return {
+    file_change_id: id,
+    run_id: fc.run_id,
+    step_id: fc.step_id,
+    sequence: fc.sequence,
+    tool_call_id: fc.tool_call_id,
+    derived_from: fc.derived_from,
+    path: fc.path,
+    old_path: fc.old_path,
+    op: fc.op,
+    before_blob_ref: fc.before_blob_ref,
+    after_blob_ref: fc.after_blob_ref,
+    partial_diff: fc.partial_diff,
+    gitignored: fc.gitignored,
+    patch_text: fc.patch_text,
+    patch_format: fc.patch_format,
+    encoding: fc.encoding,
+    bom: fc.bom,
+    line_endings: fc.line_endings,
+    mime: fc.mime,
+    language: fc.language,
+    size_before: fc.size_before,
+    size_after: fc.size_after,
+    line_count_before: fc.line_count_before,
+    line_count_after: fc.line_count_after,
+    lines_added: fc.lines_added,
+    lines_removed: fc.lines_removed,
+    mode_before: fc.mode_before,
+    mode_after: fc.mode_after,
+    source_tool_name: fc.source_tool_name,
+    source_tool_input: fc.source_tool_input,
+    redacted: fc.redacted,
+    normalizer_notes: fc.normalizer_notes,
+    created_at: created
+  };
+}
+function listFileChanges(store, opts = {}) {
+  const params = [];
+  let where = "1=1";
+  if (opts.runId) {
+    where += " AND fc.run_id = ?";
+    params.push(opts.runId);
+  }
+  if (opts.stepId) {
+    where += " AND fc.step_id = ?";
+    params.push(opts.stepId);
+  }
+  if (opts.path) {
+    where += " AND (fc.path = ? OR fc.old_path = ?)";
+    params.push(opts.path, opts.path);
+  }
+  if (opts.maxStepSeqExclusive !== void 0) {
+    where += " AND s.sequence < ?";
+    params.push(opts.maxStepSeqExclusive);
+  }
+  const rows = store.db.prepare(
+    `SELECT fc.*
+         FROM file_change fc
+         JOIN steps s ON s.step_id = fc.step_id
+        WHERE ${where}
+        ORDER BY s.sequence ASC, fc.sequence ASC`
+  ).all(...params);
+  return rows.map(rowToFileChange);
+}
+function getFileChange(store, fileChangeId) {
+  const row = store.db.prepare("SELECT * FROM file_change WHERE file_change_id = ?").get(fileChangeId);
+  return row ? rowToFileChange(row) : void 0;
+}
+function rowToBaselineTree(row) {
+  return {
+    baseline_tree_id: row.baseline_tree_id,
+    project_id: row.project_id,
+    manifest_blob_ref: row.manifest_blob_ref,
+    git_head: row.git_head ?? void 0,
+    git_dirty: row.git_dirty === 1,
+    captured_at: row.captured_at
+  };
+}
+function insertBaselineTree(store, bt) {
+  const id = bt.baseline_tree_id ?? `bt_${randomUUID()}`;
+  const captured = bt.captured_at ?? (/* @__PURE__ */ new Date()).toISOString();
+  store.db.prepare(
+    `INSERT INTO baseline_tree(
+         baseline_tree_id, project_id, manifest_blob_ref,
+         git_head, git_dirty, captured_at
+       ) VALUES (?, ?, ?, ?, ?, ?)`
+  ).run(
+    id,
+    bt.project_id,
+    bt.manifest_blob_ref,
+    bt.git_head ?? null,
+    bt.git_dirty ? 1 : 0,
+    captured
+  );
+  return {
+    baseline_tree_id: id,
+    project_id: bt.project_id,
+    manifest_blob_ref: bt.manifest_blob_ref,
+    git_head: bt.git_head,
+    git_dirty: bt.git_dirty,
+    captured_at: captured
+  };
+}
+function getBaselineTree(store, baselineTreeId) {
+  const row = store.db.prepare("SELECT * FROM baseline_tree WHERE baseline_tree_id = ?").get(baselineTreeId);
+  return row ? rowToBaselineTree(row) : void 0;
+}
+function findBaselineByManifest(store, projectId, manifestBlobRef) {
+  const row = store.db.prepare(
+    "SELECT * FROM baseline_tree WHERE project_id = ? AND manifest_blob_ref = ? LIMIT 1"
+  ).get(projectId, manifestBlobRef);
+  return row ? rowToBaselineTree(row) : void 0;
+}
+function setRunBaselineTree(store, runId, baselineTreeId) {
+  store.db.prepare("UPDATE runs SET baseline_tree_id = ? WHERE run_id = ?").run(baselineTreeId, runId);
+}
+function setRunProbeState(store, runId, state) {
+  store.db.prepare("UPDATE runs SET probe_state = ? WHERE run_id = ?").run(state, runId);
+}
+
+// src/settings.ts
+function getSetting(store, key) {
+  const row = store.db.prepare("SELECT value FROM settings WHERE key = ?").get(key);
+  return row?.value;
+}
+function setSetting(store, key, value) {
+  store.db.prepare(
+    `INSERT INTO settings(key, value, updated_at) VALUES (?, ?, ?)
+       ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`
+  ).run(key, value, (/* @__PURE__ */ new Date()).toISOString());
+}
+function deleteSetting(store, key) {
+  store.db.prepare("DELETE FROM settings WHERE key = ?").run(key);
+}
+function listSettings(store) {
+  return store.db.prepare("SELECT key, value, updated_at FROM settings ORDER BY key").all();
+}
+function resolveSetting(store, key, envVar) {
+  return process.env[envVar] ?? getSetting(store, key);
+}
+function isSecret(key) {
+  return /api_key|webhook|password|token|secret|url$/i.test(key);
+}
+function maskSecret(value) {
+  if (value.length <= 8) return "\u2022".repeat(value.length);
+  return `${value.slice(0, 7)}${"\u2022".repeat(8)}${value.slice(-4)}`;
+}
+
+// src/replay.ts
+var FIELD_SEP = 0;
+var RECORD_SEP = 10;
+function serializeManifest(entries) {
+  const sorted = [...entries].sort((a, b) => {
+    const ab = Buffer.from(a.path, "utf-8");
+    const bb = Buffer.from(b.path, "utf-8");
+    return Buffer.compare(ab, bb);
+  });
+  const parts = [];
+  for (const e of sorted) {
+    const pathBuf = Buffer.from(e.path, "utf-8");
+    if (pathBuf.includes(FIELD_SEP) || pathBuf.includes(RECORD_SEP)) {
+      throw new Error(
+        `serializeManifest: path contains illegal byte (NUL or newline): ${JSON.stringify(e.path)}`
+      );
+    }
+    const refBuf = Buffer.from(e.blob_ref, "utf-8");
+    if (refBuf.includes(FIELD_SEP) || refBuf.includes(RECORD_SEP)) {
+      throw new Error(
+        `serializeManifest: blob_ref contains illegal byte: ${JSON.stringify(e.blob_ref)}`
+      );
+    }
+    parts.push(pathBuf);
+    parts.push(Buffer.from([FIELD_SEP]));
+    parts.push(Buffer.from(String(e.mode), "utf-8"));
+    parts.push(Buffer.from([FIELD_SEP]));
+    parts.push(refBuf);
+    parts.push(Buffer.from([RECORD_SEP]));
+  }
+  return Buffer.concat(parts);
+}
+function parseManifest(buf) {
+  if (buf.length === 0) return [];
+  const entries = [];
+  let cursor = 0;
+  while (cursor < buf.length) {
+    const nl = buf.indexOf(RECORD_SEP, cursor);
+    const end = nl === -1 ? buf.length : nl;
+    if (end === cursor) {
+      cursor = end + 1;
+      continue;
+    }
+    const record = buf.subarray(cursor, end);
+    const sep1 = record.indexOf(FIELD_SEP);
+    if (sep1 === -1) {
+      throw new Error(
+        `parseManifest: malformed record at offset ${cursor} (no NUL separator)`
+      );
+    }
+    const sep2 = record.indexOf(FIELD_SEP, sep1 + 1);
+    if (sep2 === -1) {
+      throw new Error(
+        `parseManifest: malformed record at offset ${cursor} (missing second NUL)`
+      );
+    }
+    const path = record.subarray(0, sep1).toString("utf-8");
+    const modeStr = record.subarray(sep1 + 1, sep2).toString("utf-8");
+    const blob_ref = record.subarray(sep2 + 1).toString("utf-8");
+    const mode = Number.parseInt(modeStr, 10);
+    if (!Number.isFinite(mode)) {
+      throw new Error(
+        `parseManifest: invalid mode "${modeStr}" at offset ${cursor}`
+      );
+    }
+    entries.push({ path, mode, blob_ref });
+    if (nl === -1) break;
+    cursor = nl + 1;
+  }
+  return entries;
+}
+async function loadBaselineTree(store, baseline) {
+  const tree = /* @__PURE__ */ new Map();
+  const buf = await store.blobs.getBuffer(baseline.manifest_blob_ref).catch(
+    () => void 0
+  );
+  if (!buf) return tree;
+  for (const e of parseManifest(buf)) {
+    tree.set(e.path, { blob_ref: e.blob_ref, mode: e.mode });
+  }
+  return tree;
+}
+async function workingTreeAt(store, runId, opts = {}) {
+  const run = getRun(store, runId);
+  if (!run) return /* @__PURE__ */ new Map();
+  const tree = run.baseline_tree_id ? await (async () => {
+    const bt = getBaselineTree(store, run.baseline_tree_id);
+    return bt ? await loadBaselineTree(store, bt) : /* @__PURE__ */ new Map();
+  })() : /* @__PURE__ */ new Map();
+  const fcs = listFileChanges(store, {
+    runId: run.run_id,
+    maxStepSeqExclusive: opts.stepSeq
+  });
+  for (const fc of fcs) {
+    applyFileChange(tree, fc);
+  }
+  return tree;
+}
+function applyFileChange(tree, fc) {
+  if (fc.partial_diff) return;
+  if (fc.op === "delete") {
+    tree.delete(fc.path);
+    return;
+  }
+  if (fc.op === "rename") {
+    if (fc.old_path) tree.delete(fc.old_path);
+    if (fc.after_blob_ref) {
+      const existing = tree.get(fc.path);
+      tree.set(fc.path, {
+        blob_ref: fc.after_blob_ref,
+        mode: fc.mode_after ?? existing?.mode ?? 33188
+      });
+    }
+    return;
+  }
+  if (fc.op === "chmod") {
+    const existing = tree.get(fc.path);
+    if (existing && fc.mode_after !== void 0) {
+      tree.set(fc.path, { ...existing, mode: fc.mode_after });
+    }
+    return;
+  }
+  if (fc.after_blob_ref) {
+    const existing = tree.get(fc.path);
+    tree.set(fc.path, {
+      blob_ref: fc.after_blob_ref,
+      mode: fc.mode_after ?? existing?.mode ?? 33188
+    });
+  }
+}
+
+// src/baseline.ts
+import { readdir, readFile as readFile2, stat as stat2 } from "fs/promises";
+import { spawnSync } from "child_process";
+import { availableParallelism } from "os";
+import { join, relative, sep } from "path";
+import { IgnoreMatcher } from "@meterbility/shared";
+var MAX_BASELINE_FILE_BYTES = 5 * 1024 * 1024;
+var HASH_CONCURRENCY = Math.min(8, Math.max(1, availableParallelism()));
+async function captureBaseline(store, projectId, cwd, opts = {}) {
+  try {
+    const s = await stat2(cwd);
+    if (!s.isDirectory()) return void 0;
+  } catch {
+    return void 0;
+  }
+  const matcher = opts.matcher ?? await buildDefaultMatcher(cwd);
+  const maxBytes = opts.maxFileBytes ?? MAX_BASELINE_FILE_BYTES;
+  const candidates = await walk(cwd, matcher);
+  const entries = [];
+  let skipped = 0;
+  const queue = [...candidates];
+  await Promise.all(
+    Array.from({ length: HASH_CONCURRENCY }, async () => {
+      for (; ; ) {
+        const c = queue.shift();
+        if (!c) return;
+        const absPath = join(cwd, ...c.repoPath.split("/"));
+        try {
+          const buf = await readFile2(absPath);
+          if (buf.length > maxBytes) {
+            skipped += 1;
+            continue;
+          }
+          const blob_ref = await store.blobs.putBuffer(buf);
+          entries.push({ path: c.repoPath, mode: c.mode, blob_ref });
+        } catch {
+          skipped += 1;
+        }
+      }
+    })
+  );
+  const manifestBuf = serializeManifest(entries);
+  const manifest_blob_ref = await store.blobs.putBuffer(manifestBuf, {
+    skipRedact: true
+  });
+  const existing = findBaselineByManifest(store, projectId, manifest_blob_ref);
+  const { git_head, git_dirty } = readGitAdvisory(cwd);
+  if (existing) {
+    return {
+      baseline_tree_id: existing.baseline_tree_id,
+      manifest_blob_ref,
+      file_count: entries.length,
+      skipped,
+      reused_existing: true,
+      git_head: existing.git_head ?? git_head,
+      git_dirty: existing.git_dirty
+    };
+  }
+  const row = insertBaselineTree(store, {
+    project_id: projectId,
+    manifest_blob_ref,
+    git_head,
+    git_dirty
+  });
+  return {
+    baseline_tree_id: row.baseline_tree_id,
+    manifest_blob_ref,
+    file_count: entries.length,
+    skipped,
+    reused_existing: false,
+    git_head,
+    git_dirty
+  };
+}
+async function walk(rootCwd, matcher) {
+  const out = [];
+  const stack = [rootCwd];
+  while (stack.length > 0) {
+    const dir = stack.pop();
+    let entries;
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const abs = join(dir, entry.name);
+      const repoRel = toRepoRelative(rootCwd, abs);
+      const isDir = entry.isDirectory();
+      if (matcher.matches(repoRel, isDir)) continue;
+      if (isDir) {
+        stack.push(abs);
+      } else if (entry.isFile()) {
+        let mode = 33188;
+        try {
+          const s = await stat2(abs);
+          mode = s.mode;
+        } catch {
+        }
+        out.push({ repoPath: repoRel, mode });
+      }
+    }
+  }
+  return out;
+}
+function toRepoRelative(rootCwd, abs) {
+  return relative(rootCwd, abs).split(sep).join("/");
+}
+async function buildDefaultMatcher(cwd) {
+  const userMeterbility = await readLines(join(cwd, ".meterbilityignore"));
+  const gitignore = await readLines(join(cwd, ".gitignore"));
+  return IgnoreMatcher.fromDefaultsPlus(userMeterbility, gitignore);
+}
+async function readLines(path) {
+  try {
+    const text = await readFile2(path, "utf-8");
+    return text.split(/\r?\n/);
+  } catch {
+    return void 0;
+  }
+}
+function readGitAdvisory(cwd) {
+  const head = spawnSync("git", ["rev-parse", "HEAD"], {
+    cwd,
+    encoding: "utf-8",
+    // Suppress noisy "not a git repository" output from stderr.
+    stdio: ["ignore", "pipe", "ignore"]
+  });
+  const git_head = head.status === 0 ? head.stdout.trim() || void 0 : void 0;
+  if (!git_head) return { git_head: void 0, git_dirty: false };
+  const status = spawnSync("git", ["status", "--porcelain"], {
+    cwd,
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "ignore"]
+  });
+  const git_dirty = status.status === 0 && status.stdout.trim().length > 0;
+  return { git_head, git_dirty };
+}
+
+// src/file_size_policy.ts
+var DEFAULT_MAX_PARTIAL_BYTES = 5e6;
+var DEFAULT_MAX_SKIP_BYTES = 5e7;
+function enforceFileSizePolicy(input) {
+  const maxPartial = input.settings?.max_partial_bytes ?? DEFAULT_MAX_PARTIAL_BYTES;
+  const maxSkip = input.settings?.max_skip_bytes ?? DEFAULT_MAX_SKIP_BYTES;
+  if (maxSkip <= maxPartial) {
+    throw new Error(
+      `file_size_policy: misconfig \u2014 max_skip_bytes (${maxSkip}) must exceed max_partial_bytes (${maxPartial})`
+    );
+  }
+  const sizeBefore = input.beforeBuf?.length;
+  const sizeAfter = input.afterBuf?.length;
+  const largerSize = Math.max(sizeBefore ?? 0, sizeAfter ?? 0);
+  if (sizeBefore === void 0 && sizeAfter === void 0) {
+    return {
+      beforeBuf: void 0,
+      afterBuf: void 0,
+      partial_diff: false,
+      redacted: false,
+      size_before: void 0,
+      size_after: void 0
+    };
+  }
+  if (largerSize > maxSkip) {
+    return {
+      beforeBuf: void 0,
+      afterBuf: void 0,
+      partial_diff: false,
+      redacted: true,
+      size_before: sizeBefore,
+      size_after: sizeAfter
+    };
+  }
+  if (largerSize > maxPartial) {
+    const dropBefore = (sizeBefore ?? 0) >= (sizeAfter ?? 0);
+    return {
+      beforeBuf: dropBefore ? void 0 : input.beforeBuf,
+      afterBuf: dropBefore ? input.afterBuf : void 0,
+      partial_diff: true,
+      redacted: false,
+      size_before: sizeBefore,
+      size_after: sizeAfter
+    };
+  }
+  return {
+    beforeBuf: input.beforeBuf,
+    afterBuf: input.afterBuf,
+    partial_diff: false,
+    redacted: false,
+    size_before: sizeBefore,
+    size_after: sizeAfter
+  };
+}
+export {
+  BlobStore,
+  DEFAULT_MAX_PARTIAL_BYTES,
+  DEFAULT_MAX_SKIP_BYTES,
+  FileChangeInvariantError,
+  SCHEMA_VERSION,
+  Store,
+  aggregateTokens,
+  applyFileChange,
+  assertFileChangeInvariants,
+  captureBaseline,
+  deleteSetting,
+  enforceFileSizePolicy,
+  ensureSchema,
+  findBaselineByManifest,
+  getBaselineTree,
+  getFileChange,
+  getIngestOffset,
+  getRun,
+  getRunBySessionId,
+  getSetting,
+  getStep,
+  getStepBySequence,
+  insertAnnotation,
+  insertBaselineTree,
+  insertFileChange,
+  insertFork,
+  insertRun,
+  insertStep,
+  isProbablyText,
+  isSecret,
+  listAnnotations,
+  listFileChanges,
+  listForks,
+  listRuns,
+  listSettings,
+  listSteps,
+  loadBaselineTree,
+  maskSecret,
+  parseManifest,
+  recordContextSnapshot,
+  resolveSetting,
+  resolveSnapshotBlobRef,
+  serializeManifest,
+  setIngestOffset,
+  setRunBaselineTree,
+  setRunProbeState,
+  setRunStatus,
+  setSetting,
+  updateRunTotals,
+  upsertAgent,
+  upsertProjectByCwd,
+  workingTreeAt
+};