@murphai/murph 0.1.14 → 0.1.17

package/node_modules/@murphai/device-syncd/dist/store.js

@@ -0,0 +1,965 @@
+import { applySqliteRuntimeMigrations, openSqliteRuntimeDatabase, tableExists, withImmediateTransaction, } from "@murphai/runtime-state/node";
+import { generatePrefixedId, maybeParseJsonObject, sanitizeStoredDeviceSyncMetadata, stringifyJson, toIsoTimestamp, } from "./shared.js";
+const DEVICE_SYNC_STORE_SQLITE_SCHEMA_VERSION = 2;
+const MINIMIZED_WEBHOOK_TRACE_PAYLOAD_JSON = stringifyJson({});
+function mapAccountRow(row) {
+    if (!row) {
+        return null;
+    }
+    return {
+        id: row.id,
+        provider: row.provider,
+        externalAccountId: row.external_account_id,
+        displayName: row.display_name,
+        status: row.status,
+        scopes: JSON.parse(row.scopes_json ?? "[]"),
+        disconnectGeneration: row.disconnect_generation,
+        accessTokenEncrypted: row.access_token_encrypted,
+        hostedObservedTokenVersion: row.hosted_observed_token_version,
+        hostedObservedUpdatedAt: row.hosted_observed_updated_at,
+        refreshTokenEncrypted: row.refresh_token_encrypted,
+        accessTokenExpiresAt: row.access_token_expires_at,
+        metadata: sanitizeStoredDeviceSyncMetadata(maybeParseJsonObject(row.metadata_json)),
+        connectedAt: row.connected_at,
+        lastWebhookAt: row.last_webhook_at,
+        lastSyncStartedAt: row.last_sync_started_at,
+        lastSyncCompletedAt: row.last_sync_completed_at,
+        lastSyncErrorAt: row.last_sync_error_at,
+        lastErrorCode: row.last_error_code,
+        lastErrorMessage: row.last_error_message,
+        nextReconcileAt: row.next_reconcile_at,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at ?? row.created_at,
+    };
+}
+function mapJobRow(row) {
+    if (!row) {
+        return null;
+    }
+    return {
+        id: row.id,
+        provider: row.provider,
+        accountId: row.account_id,
+        kind: row.kind,
+        payload: maybeParseJsonObject(row.payload_json),
+        priority: row.priority,
+        availableAt: row.available_at,
+        attempts: row.attempts,
+        maxAttempts: row.max_attempts,
+        dedupeKey: row.dedupe_key,
+        status: row.status,
+        leaseOwner: row.lease_owner,
+        leaseExpiresAt: row.lease_expires_at,
+        lastErrorCode: row.last_error_code,
+        lastErrorMessage: row.last_error_message,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+        startedAt: row.started_at,
+        finishedAt: row.finished_at,
+    };
+}
+function mapOAuthStateRow(row) {
+    if (!row) {
+        return null;
+    }
+    return {
+        state: row.state,
+        provider: row.provider,
+        returnTo: row.return_to,
+        metadata: maybeParseJsonObject(row.metadata_json),
+        createdAt: row.created_at,
+        expiresAt: row.expires_at,
+    };
+}
+function resolveHydratedHostedAccountTokens(input) {
+    if (input.inputTokens) {
+        return {
+            accessTokenEncrypted: input.inputTokens.accessTokenEncrypted,
+            refreshTokenEncrypted: input.inputTokens.refreshTokenEncrypted ?? null,
+            accessTokenExpiresAt: input.inputTokens.accessTokenExpiresAt ?? null,
+        };
+    }
+    if (input.shouldClearTokens) {
+        return {
+            accessTokenEncrypted: "",
+            refreshTokenEncrypted: null,
+            accessTokenExpiresAt: null,
+        };
+    }
+    return {
+        accessTokenEncrypted: input.existing?.accessTokenEncrypted ?? "",
+        refreshTokenEncrypted: input.existing?.refreshTokenEncrypted ?? null,
+        accessTokenExpiresAt: input.existing?.accessTokenExpiresAt ?? null,
+    };
+}
+function assertNoLegacyDeviceSyncStore(database) {
+    if (!tableExists(database, "device_account")) {
+        return;
+    }
+    throw new Error("Unsupported legacy device-sync runtime schema detected. Remove the local device-sync database and reconnect devices.");
+}
+function ensureDeviceSyncStoreSchema(database) {
+    database.exec(`
+      create table if not exists oauth_state (
+        state text primary key,
+        provider text not null,
+        return_to text,
+        metadata_json text not null,
+        created_at text not null,
+        expires_at text not null
+      );
+
+      create index if not exists oauth_state_expires_idx
+      on oauth_state (expires_at);
+
+      create table if not exists device_connection (
+        id text primary key,
+        provider text not null,
+        external_account_id text not null,
+        display_name text,
+        status text not null,
+        scopes_json text not null,
+        disconnect_generation integer not null default 0,
+        metadata_json text not null,
+        connected_at text not null,
+        created_at text not null,
+        updated_at text not null,
+        unique (provider, external_account_id)
+      );
+
+      create index if not exists device_connection_provider_idx
+      on device_connection (provider, updated_at desc);
+
+      create table if not exists device_credential_state (
+        account_id text primary key references device_connection(id) on delete cascade,
+        access_token_encrypted text not null,
+        refresh_token_encrypted text,
+        access_token_expires_at text,
+        created_at text not null,
+        updated_at text not null
+      );
+
+      create table if not exists device_observation_state (
+        account_id text primary key references device_connection(id) on delete cascade,
+        hosted_observed_updated_at text,
+        hosted_observed_token_version integer,
+        last_webhook_at text,
+        last_sync_started_at text,
+        last_sync_completed_at text,
+        last_sync_error_at text,
+        last_error_code text,
+        last_error_message text,
+        next_reconcile_at text,
+        created_at text not null,
+        updated_at text not null
+      );
+
+      create table if not exists device_job (
+        id text primary key,
+        provider text not null,
+        account_id text not null references device_connection(id) on delete cascade,
+        kind text not null,
+        payload_json text not null,
+        priority integer not null default 0,
+        available_at text not null,
+        attempts integer not null default 0,
+        max_attempts integer not null default 5,
+        dedupe_key text,
+        status text not null,
+        lease_owner text,
+        lease_expires_at text,
+        last_error_code text,
+        last_error_message text,
+        created_at text not null,
+        updated_at text not null,
+        started_at text,
+        finished_at text
+      );
+
+      create index if not exists device_job_claim_idx
+      on device_job (status, available_at asc, priority desc, created_at asc);
+
+      create index if not exists device_job_account_idx
+      on device_job (account_id, status, created_at desc);
+
+      create index if not exists device_job_account_running_idx
+      on device_job (account_id, status, lease_expires_at);
+
+      create table if not exists webhook_trace (
+        provider text not null,
+        trace_id text not null,
+        external_account_id text not null,
+        event_type text not null,
+        received_at text not null,
+        payload_json text not null,
+        status text not null default 'processed',
+        processing_expires_at text,
+        primary key (provider, trace_id)
+      );
+
+      create index if not exists webhook_trace_received_idx
+      on webhook_trace (received_at desc);
+    `);
+}
+function latestIsoTimestamp(left, right) {
+    if (!left) {
+        return right;
+    }
+    if (!right) {
+        return left;
+    }
+    return Date.parse(left) >= Date.parse(right) ? left : right;
+}
+const ACCOUNT_ROW_SELECT = `
+  select
+    connection.id as id,
+    connection.provider as provider,
+    connection.external_account_id as external_account_id,
+    connection.display_name as display_name,
+    connection.status as status,
+    connection.scopes_json as scopes_json,
+    connection.disconnect_generation as disconnect_generation,
+    credential.access_token_encrypted as access_token_encrypted,
+    credential.refresh_token_encrypted as refresh_token_encrypted,
+    credential.access_token_expires_at as access_token_expires_at,
+    observation.hosted_observed_updated_at as hosted_observed_updated_at,
+    observation.hosted_observed_token_version as hosted_observed_token_version,
+    connection.metadata_json as metadata_json,
+    connection.connected_at as connected_at,
+    observation.last_webhook_at as last_webhook_at,
+    observation.last_sync_started_at as last_sync_started_at,
+    observation.last_sync_completed_at as last_sync_completed_at,
+    observation.last_sync_error_at as last_sync_error_at,
+    observation.last_error_code as last_error_code,
+    observation.last_error_message as last_error_message,
+    observation.next_reconcile_at as next_reconcile_at,
+    connection.created_at as created_at,
+    max(connection.updated_at, credential.updated_at, observation.updated_at) as updated_at
+  from device_connection as connection
+  join device_credential_state as credential
+    on credential.account_id = connection.id
+  join device_observation_state as observation
+    on observation.account_id = connection.id
+`;
+export class SqliteDeviceSyncStore {
+    databasePath;
+    database;
+    constructor(databasePath) {
+        this.databasePath = databasePath;
+        const database = openSqliteRuntimeDatabase(databasePath);
+        this.database = database;
+        try {
+            assertNoLegacyDeviceSyncStore(database);
+            applySqliteRuntimeMigrations(database, {
+                migrations: [
+                    {
+                        version: DEVICE_SYNC_STORE_SQLITE_SCHEMA_VERSION,
+                        migrate(candidateDatabase) {
+                            ensureDeviceSyncStoreSchema(candidateDatabase);
+                        },
+                    },
+                ],
+                schemaVersion: DEVICE_SYNC_STORE_SQLITE_SCHEMA_VERSION,
+                storeName: "device sync runtime",
+            });
+        }
+        catch (error) {
+            database.close();
+            throw error;
+        }
+    }
+    close() {
+        this.database.close();
+    }
+    summarize() {
+        const row = this.database.prepare(`
+      select
+        (select count(*) from device_connection) as accounts_total,
+        (select count(*) from device_connection where status = 'active') as accounts_active,
+        (select count(*) from device_job where status = 'queued') as jobs_queued,
+        (select count(*) from device_job where status = 'running') as jobs_running,
+        (select count(*) from device_job where status = 'dead') as jobs_dead,
+        (select count(*) from oauth_state) as oauth_states,
+        (select count(*) from webhook_trace) as webhook_traces
+    `).get();
+        return {
+            accountsTotal: row.accounts_total,
+            accountsActive: row.accounts_active,
+            jobsQueued: row.jobs_queued,
+            jobsRunning: row.jobs_running,
+            jobsDead: row.jobs_dead,
+            oauthStates: row.oauth_states,
+            webhookTraces: row.webhook_traces,
+        };
+    }
+    createOAuthState(input) {
+        this.database.prepare(`
+      insert into oauth_state (state, provider, return_to, metadata_json, created_at, expires_at)
+      values (?, ?, ?, ?, ?, ?)
+    `).run(input.state, input.provider, input.returnTo, stringifyJson(input.metadata ?? {}), input.createdAt, input.expiresAt);
+        return input;
+    }
+    deleteExpiredOAuthStates(now) {
+        const result = this.database.prepare("delete from oauth_state where expires_at <= ?").run(now);
+        return result.changes ?? 0;
+    }
+    consumeOAuthState(state, now) {
+        return withImmediateTransaction(this.database, () => {
+            const row = this.database.prepare(`
+        select state, provider, return_to, metadata_json, created_at, expires_at
+        from oauth_state
+        where state = ?
+      `).get(state);
+            if (!row || Date.parse(row.expires_at) <= Date.parse(now)) {
+                this.database.prepare("delete from oauth_state where state = ?").run(state);
+                return null;
+            }
+            this.database.prepare("delete from oauth_state where state = ?").run(state);
+            return mapOAuthStateRow(row);
+        });
+    }
+    listAccounts(provider) {
+        const rows = (provider
+            ? this.database.prepare(`
+          ${ACCOUNT_ROW_SELECT}
+          where connection.provider = ?
+          order by updated_at desc, connection.id desc
+        `).all(provider)
+            : this.database.prepare(`
+          ${ACCOUNT_ROW_SELECT}
+          order by updated_at desc, connection.id desc
+        `).all());
+        return rows.map((row) => mapAccountRow(row)).filter(Boolean);
+    }
+    getAccountById(accountId) {
+        const row = this.database.prepare(`
+      ${ACCOUNT_ROW_SELECT}
+      where connection.id = ?
+    `).get(accountId);
+        return mapAccountRow(row);
+    }
+    getAccountByExternalAccount(provider, externalAccountId) {
+        const row = this.database.prepare(`
+      ${ACCOUNT_ROW_SELECT}
+      where connection.provider = ? and connection.external_account_id = ?
+    `).get(provider, externalAccountId);
+        return mapAccountRow(row);
+    }
+    upsertAccount(input) {
+        return withImmediateTransaction(this.database, () => {
+            const existing = this.getAccountByExternalAccount(input.provider, input.externalAccountId);
+            const now = input.connectedAt;
+            const status = input.status ?? "active";
+            const scopesJson = stringifyJson(input.scopes ?? []);
+            const metadataJson = stringifyJson(sanitizeStoredDeviceSyncMetadata(input.metadata ?? {}));
+            if (existing) {
+                this.database.prepare(`
+          update device_connection
+          set display_name = ?,
+              status = ?,
+              scopes_json = ?,
+              metadata_json = ?,
+              connected_at = ?,
+              updated_at = ?
+          where id = ?
+        `).run(input.displayName ?? null, status, scopesJson, metadataJson, input.connectedAt, now, existing.id);
+                this.database.prepare(`
+          update device_credential_state
+          set access_token_encrypted = ?,
+              refresh_token_encrypted = ?,
+              access_token_expires_at = ?,
+              updated_at = ?
+          where account_id = ?
+        `).run(input.tokens.accessTokenEncrypted, input.tokens.refreshTokenEncrypted ?? null, input.tokens.accessTokenExpiresAt ?? null, now, existing.id);
+                this.database.prepare(`
+          update device_observation_state
+          set next_reconcile_at = ?,
+              last_sync_error_at = null,
+              last_error_code = null,
+              last_error_message = null,
+              updated_at = ?
+          where account_id = ?
+        `).run(input.nextReconcileAt ?? null, now, existing.id);
+                return this.getAccountById(existing.id);
+            }
+            const id = generatePrefixedId("dsa");
+            this.database.prepare(`
+        insert into device_connection (
+          id,
+          provider,
+          external_account_id,
+          display_name,
+          status,
+          scopes_json,
+          metadata_json,
+          connected_at,
+          created_at,
+          updated_at
+        ) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(id, input.provider, input.externalAccountId, input.displayName ?? null, status, scopesJson, metadataJson, input.connectedAt, now, now);
+            this.database.prepare(`
+        insert into device_credential_state (
+          account_id,
+          access_token_encrypted,
+          refresh_token_encrypted,
+          access_token_expires_at,
+          created_at,
+          updated_at
+        ) values (?, ?, ?, ?, ?, ?)
+      `).run(id, input.tokens.accessTokenEncrypted, input.tokens.refreshTokenEncrypted ?? null, input.tokens.accessTokenExpiresAt ?? null, now, now);
+            this.database.prepare(`
+        insert into device_observation_state (
+          account_id,
+          hosted_observed_updated_at,
+          hosted_observed_token_version,
+          last_webhook_at,
+          last_sync_started_at,
+          last_sync_completed_at,
+          last_sync_error_at,
+          last_error_code,
+          last_error_message,
+          next_reconcile_at,
+          created_at,
+          updated_at
+        ) values (?, null, null, null, null, null, null, null, null, ?, ?, ?)
+      `).run(id, input.nextReconcileAt ?? null, now, now);
+            return this.getAccountById(id);
+        });
+    }
+    patchAccount(accountId, patch) {
+        return withImmediateTransaction(this.database, () => {
+            const existing = this.getAccountById(accountId);
+            if (!existing) {
+                throw new TypeError(`Unknown account ${accountId}`);
+            }
+            const now = toIsoTimestamp(new Date());
+            const metadata = sanitizeStoredDeviceSyncMetadata(patch.metadata ? { ...existing.metadata, ...patch.metadata } : existing.metadata);
+            const nextReconcileAt = Object.prototype.hasOwnProperty.call(patch, "nextReconcileAt")
+                ? patch.nextReconcileAt ?? null
+                : existing.nextReconcileAt;
+            const displayName = Object.prototype.hasOwnProperty.call(patch, "displayName")
+                ? patch.displayName ?? null
+                : existing.displayName;
+            const scopes = Object.prototype.hasOwnProperty.call(patch, "scopes")
+                ? patch.scopes ?? []
+                : existing.scopes;
+            this.database.prepare(`
+        update device_connection
+        set display_name = ?,
+            status = ?,
+            scopes_json = ?,
+            metadata_json = ?,
+            updated_at = ?
+        where id = ?
+      `).run(displayName, patch.status ?? existing.status, stringifyJson(scopes), stringifyJson(metadata), now, existing.id);
+            this.database.prepare(`
+        update device_observation_state
+        set next_reconcile_at = ?,
+            last_sync_error_at = ?,
+            last_error_code = ?,
+            last_error_message = ?,
+            updated_at = ?
+        where account_id = ?
+      `).run(nextReconcileAt, patch.clearErrors ? null : existing.lastSyncErrorAt, patch.clearErrors ? null : existing.lastErrorCode, patch.clearErrors ? null : existing.lastErrorMessage, now, existing.id);
+            return this.getAccountById(existing.id);
+        });
+    }
+    updateAccountTokens(accountId, tokens, disconnectGeneration) {
+        const now = toIsoTimestamp(new Date());
+        const result = this.database.prepare(`
+      update device_credential_state
+      set access_token_encrypted = ?,
+          refresh_token_encrypted = ?,
+          access_token_expires_at = ?,
+          updated_at = ?
+      where account_id = ?
+        and (? is null or exists (
+          select 1
+          from device_connection
+          where device_connection.id = device_credential_state.account_id
+            and device_connection.disconnect_generation = ?
+            and device_connection.status = 'active'
+        ))
+    `).run(tokens.accessTokenEncrypted, tokens.refreshTokenEncrypted ?? null, tokens.accessTokenExpiresAt ?? null, now, accountId, disconnectGeneration ?? null, disconnectGeneration ?? null);
+        if ((result.changes ?? 0) === 0) {
+            return null;
+        }
+        return this.getAccountById(accountId);
+    }
+    hydrateHostedAccount(input) {
+        return withImmediateTransaction(this.database, () => {
+            const existing = this.getAccountByExternalAccount(input.connection.provider, input.connection.externalAccountId);
+            if (!existing && input.tokens === undefined) {
+                return null;
+            }
+            const shouldClearTokens = input.clearTokens === true
+                || (input.connection.status === "disconnected" && input.tokens === undefined);
+            const rowUpdatedAt = latestIsoTimestamp(existing?.updatedAt ?? null, input.connection.updatedAt)
+                ?? input.connection.updatedAt;
+            const { accessTokenEncrypted, refreshTokenEncrypted, accessTokenExpiresAt } = resolveHydratedHostedAccountTokens({
+                existing,
+                inputTokens: input.tokens,
+                shouldClearTokens,
+            });
+            const hostedObservedUpdatedAt = input.hostedObservedUpdatedAt ?? existing?.hostedObservedUpdatedAt ?? null;
+            const hostedObservedTokenVersion = input.hostedObservedTokenVersion ?? existing?.hostedObservedTokenVersion ?? null;
+            const metadata = sanitizeStoredDeviceSyncMetadata(input.connection.metadata);
+            const disconnectGeneration = existing
+                ? input.connection.status === "disconnected" && existing.status !== "disconnected"
+                    ? existing.disconnectGeneration + 1
+                    : existing.disconnectGeneration
+                : input.connection.status === "disconnected"
+                    ? 1
+                    : 0;
+            if (existing) {
+                this.database.prepare(`
+          update device_connection
+          set display_name = ?,
+              status = ?,
+              scopes_json = ?,
+              disconnect_generation = ?,
+              metadata_json = ?,
+              connected_at = ?,
+              updated_at = ?
+          where id = ?
+        `).run(input.connection.displayName, input.connection.status, stringifyJson(input.connection.scopes), disconnectGeneration, stringifyJson(metadata), input.connection.connectedAt, rowUpdatedAt, existing.id);
+                this.database.prepare(`
+          update device_credential_state
+          set access_token_encrypted = ?,
+              refresh_token_encrypted = ?,
+              access_token_expires_at = ?,
+              updated_at = ?
+          where account_id = ?
+        `).run(accessTokenEncrypted, refreshTokenEncrypted, accessTokenExpiresAt, rowUpdatedAt, existing.id);
+                this.database.prepare(`
+          update device_observation_state
+          set hosted_observed_updated_at = ?,
+              hosted_observed_token_version = ?,
+              last_webhook_at = ?,
+              last_sync_started_at = ?,
+              last_sync_completed_at = ?,
+              last_sync_error_at = ?,
+              last_error_code = ?,
+              last_error_message = ?,
+              next_reconcile_at = ?,
+              updated_at = ?
+          where account_id = ?
+        `).run(hostedObservedUpdatedAt, hostedObservedTokenVersion, input.localState.lastWebhookAt, input.localState.lastSyncStartedAt, input.localState.lastSyncCompletedAt, input.localState.lastSyncErrorAt, input.localState.lastErrorCode, input.localState.lastErrorMessage, input.localState.nextReconcileAt, rowUpdatedAt, existing.id);
+                return this.getAccountById(existing.id);
+            }
+            const id = generatePrefixedId("dsa");
+            this.database.prepare(`
+        insert into device_connection (
+          id,
+          provider,
+          external_account_id,
+          display_name,
+          status,
+          scopes_json,
+          disconnect_generation,
+          metadata_json,
+          connected_at,
+          created_at,
+          updated_at
+        ) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(id, input.connection.provider, input.connection.externalAccountId, input.connection.displayName, input.connection.status, stringifyJson(input.connection.scopes), disconnectGeneration, stringifyJson(metadata), input.connection.connectedAt, input.connection.updatedAt, rowUpdatedAt);
+            this.database.prepare(`
+        insert into device_credential_state (
+          account_id,
+          access_token_encrypted,
+          refresh_token_encrypted,
+          access_token_expires_at,
+          created_at,
+          updated_at
+        ) values (?, ?, ?, ?, ?, ?)
+      `).run(id, accessTokenEncrypted, refreshTokenEncrypted, accessTokenExpiresAt, input.connection.updatedAt, rowUpdatedAt);
+            this.database.prepare(`
+        insert into device_observation_state (
+          account_id,
+          hosted_observed_updated_at,
+          hosted_observed_token_version,
+          last_webhook_at,
+          last_sync_started_at,
+          last_sync_completed_at,
+          last_sync_error_at,
+          last_error_code,
+          last_error_message,
+          next_reconcile_at,
+          created_at,
+          updated_at
+        ) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(id, hostedObservedUpdatedAt, hostedObservedTokenVersion, input.localState.lastWebhookAt, input.localState.lastSyncStartedAt, input.localState.lastSyncCompletedAt, input.localState.lastSyncErrorAt, input.localState.lastErrorCode, input.localState.lastErrorMessage, input.localState.nextReconcileAt, input.connection.updatedAt, rowUpdatedAt);
+            return this.getAccountById(id);
+        });
+    }
+    disconnectAccount(accountId, now) {
+        withImmediateTransaction(this.database, () => {
+            this.database.prepare(`
+        update device_connection
+        set status = 'disconnected',
+            disconnect_generation = disconnect_generation + 1,
+            updated_at = ?
+        where id = ?
+      `).run(now, accountId);
+            this.database.prepare(`
+        update device_credential_state
+        set access_token_encrypted = '',
+            refresh_token_encrypted = null,
+            access_token_expires_at = null,
+            updated_at = ?
+        where account_id = ?
+      `).run(now, accountId);
+            this.database.prepare(`
+        update device_observation_state
+        set last_sync_error_at = null,
+            last_error_code = null,
+            last_error_message = null,
+            next_reconcile_at = null,
+            updated_at = ?
+        where account_id = ?
+      `).run(now, accountId);
+        });
+        return this.getAccountById(accountId);
+    }
+    markWebhookReceived(accountId, now) {
+        this.database.prepare(`
+      update device_observation_state
+      set last_webhook_at = ?, updated_at = ?
+      where account_id = ?
+    `).run(now, now, accountId);
+    }
+    markSyncStarted(accountId, now) {
+        this.database.prepare(`
+      update device_observation_state
+      set last_sync_started_at = ?, updated_at = ?
+      where account_id = ?
+    `).run(now, now, accountId);
+    }
+    markSyncSucceeded(accountId, now, disconnectGeneration = null, options = {}) {
+        const existing = this.getAccountById(accountId);
+        if (!existing) {
+            return false;
+        }
+        const metadata = sanitizeStoredDeviceSyncMetadata(options.metadataPatch ? { ...existing.metadata, ...options.metadataPatch } : existing.metadata);
+        const nextReconcileAt = Object.prototype.hasOwnProperty.call(options, "nextReconcileAt")
+            ? options.nextReconcileAt ?? null
+            : existing.nextReconcileAt;
+        return withImmediateTransaction(this.database, () => {
+            const connectionResult = this.database.prepare(`
+        update device_connection
+        set status = case when status = 'disconnected' then status else 'active' end,
+            metadata_json = ?,
+            updated_at = ?
+        where id = ?
+          and (? is null or (disconnect_generation = ? and status = 'active'))
+      `).run(stringifyJson(metadata), now, accountId, disconnectGeneration ?? null, disconnectGeneration ?? null);
+            if ((connectionResult.changes ?? 0) === 0) {
+                return false;
+            }
+            this.database.prepare(`
+        update device_observation_state
+        set next_reconcile_at = ?,
+            last_sync_completed_at = ?,
+            last_sync_error_at = null,
+            last_error_code = null,
+            last_error_message = null,
+            updated_at = ?
+        where account_id = ?
+      `).run(nextReconcileAt, now, now, accountId);
+            return true;
+        });
+    }
+    markSyncFailed(accountId, now, code, message, status) {
+        withImmediateTransaction(this.database, () => {
+            this.database.prepare(`
+        update device_connection
+        set status = ?,
+            updated_at = ?
+        where id = ?
+      `).run(status ?? this.getAccountById(accountId)?.status ?? "active", now, accountId);
+            this.database.prepare(`
+        update device_observation_state
+        set last_sync_error_at = ?,
+            last_error_code = ?,
+            last_error_message = ?,
+            updated_at = ?
+        where account_id = ?
+      `).run(now, code, message, now, accountId);
+        });
+    }
+    enqueueJob(input) {
+        return withImmediateTransaction(this.database, () => this.enqueueJobInTransaction(input));
+    }
+    enqueueJobsAndCompleteWebhookTrace(input) {
+        return withImmediateTransaction(this.database, () => {
+            const queuedJobs = input.jobs.map((job) => this.enqueueJobInTransaction({
+                provider: input.provider,
+                accountId: input.accountId,
+                kind: job.kind,
+                payload: job.payload ?? {},
+                priority: job.priority ?? 0,
+                availableAt: job.availableAt,
+                maxAttempts: job.maxAttempts,
+                dedupeKey: job.dedupeKey,
+            }));
+            this.completeWebhookTrace(input.provider, input.traceId);
+            return queuedJobs;
+        });
+    }
+    getJobById(jobId) {
+        const row = this.database.prepare(`select * from device_job where id = ?`).get(jobId);
+        return mapJobRow(row);
+    }
+    readNextActiveReconcileAt() {
+        const row = this.database.prepare(`
+      select observation.next_reconcile_at
+      from device_observation_state as observation
+      join device_connection as connection
+        on connection.id = observation.account_id
+      where connection.status = 'active'
+        and observation.next_reconcile_at is not null
+      order by observation.next_reconcile_at asc, observation.updated_at asc, connection.id asc
+      limit 1
+    `).get();
+        return row?.next_reconcile_at ?? null;
+    }
+    readNextJobWakeAt() {
+        const row = this.database.prepare(`
+      select wake_at
+      from (
+        select available_at as wake_at
+        from device_job
+        where status = 'queued'
+        union all
+        select lease_expires_at as wake_at
+        from device_job
+        where status = 'running'
+          and lease_expires_at is not null
+          and attempts < max_attempts
+      )
+      order by wake_at asc
+      limit 1
+    `).get();
+        return row?.wake_at ?? null;
+    }
+    claimDueJob(workerId, now, leaseMs) {
+        return withImmediateTransaction(this.database, () => {
+            const row = this.database.prepare(`
+        select *
+        from device_job as candidate
+        where (
+          (
+            candidate.status = 'queued' and candidate.available_at <= ?
+          ) or (
+            candidate.status = 'running'
+            and candidate.lease_expires_at is not null
+            and candidate.lease_expires_at <= ?
+            and candidate.attempts < candidate.max_attempts
+          )
+        )
+        and not exists (
+          select 1
+          from device_job as blocking
+          where blocking.account_id = candidate.account_id
+            and blocking.id != candidate.id
+            and blocking.status = 'running'
+            and blocking.lease_expires_at is not null
+            and blocking.lease_expires_at > ?
+        )
+        order by candidate.priority desc, candidate.available_at asc, candidate.created_at asc, candidate.id asc
+        limit 1
+      `).get(now, now, now);
+            if (!row) {
+                return null;
+            }
+            const leaseExpiresAt = new Date(Date.parse(now) + leaseMs).toISOString();
+            this.database.prepare(`
+        update device_job
+        set status = 'running',
+            lease_owner = ?,
+            lease_expires_at = ?,
+            attempts = attempts + 1,
+            started_at = coalesce(started_at, ?),
+            updated_at = ?
+        where id = ?
+      `).run(workerId, leaseExpiresAt, now, now, row.id);
+            return this.getJobById(row.id);
+        });
+    }
+    completeJob(jobId, now) {
+        this.database.prepare(`
+      update device_job
+      set status = 'succeeded',
+          lease_owner = null,
+          lease_expires_at = null,
+          finished_at = ?,
+          updated_at = ?
+      where id = ?
+    `).run(now, now, jobId);
+    }
+    completeJobIfOwned(jobId, workerId, now) {
+        const result = this.database.prepare(`
+      update device_job
+      set status = 'succeeded',
+          lease_owner = null,
+          lease_expires_at = null,
+          finished_at = ?,
+          updated_at = ?
+      where id = ?
+        and status = 'running'
+        and lease_owner = ?
+    `).run(now, now, jobId, workerId);
+        return (result.changes ?? 0) > 0;
+    }
+    failJob(jobId, now, code, message, retryAt, retryable) {
+        const job = this.getJobById(jobId);
+        if (!job) {
+            return;
+        }
+        if (job.status !== "queued" && job.status !== "running") {
+            return;
+        }
+        if (retryable && job.attempts < job.maxAttempts) {
+            this.database.prepare(`
+        update device_job
+        set status = 'queued',
+            available_at = ?,
+            lease_owner = null,
+            lease_expires_at = null,
+            last_error_code = ?,
+            last_error_message = ?,
+            updated_at = ?
+        where id = ?
+      `).run(retryAt ?? now, code, message, now, jobId);
+            return;
+        }
+        this.database.prepare(`
+      update device_job
+      set status = 'dead',
+          lease_owner = null,
+          lease_expires_at = null,
+          last_error_code = ?,
+          last_error_message = ?,
+          finished_at = ?,
+          updated_at = ?
+      where id = ?
+    `).run(code, message, now, now, jobId);
+    }
+    markPendingJobsDeadForAccount(accountId, now, code, message) {
+        const result = this.database.prepare(`
+      update device_job
+      set status = 'dead',
+          lease_owner = null,
+          lease_expires_at = null,
+          last_error_code = ?,
+          last_error_message = ?,
+          finished_at = ?,
+          updated_at = ?
+      where account_id = ? and status in ('queued', 'running')
+    `).run(code, message, now, now, accountId);
+        return result.changes ?? 0;
+    }
+    claimWebhookTrace(input) {
+        return withImmediateTransaction(this.database, () => {
+            const existing = this.database.prepare(`
+        select provider, trace_id, status, processing_expires_at
+        from webhook_trace
+        where provider = ?
+          and trace_id = ?
+      `).get(input.provider, input.traceId);
+            if (!existing) {
+                this.database.prepare(`
+          insert into webhook_trace (
+            provider,
+            trace_id,
+            external_account_id,
+            event_type,
+            received_at,
+            payload_json,
+            status,
+            processing_expires_at
+          ) values (?, ?, ?, ?, ?, ?, 'processing', ?)
+        `).run(input.provider, input.traceId, input.externalAccountId, input.eventType, input.receivedAt, MINIMIZED_WEBHOOK_TRACE_PAYLOAD_JSON, input.processingExpiresAt);
+                return "claimed";
+            }
+            if ((existing.status ?? "processed") === "processed") {
+                return "processed";
+            }
+            if (existing.processing_expires_at
+                && Date.parse(existing.processing_expires_at) > Date.parse(input.receivedAt)) {
+                return "processing";
+            }
+            const result = this.database.prepare(`
+        update webhook_trace
+        set external_account_id = ?,
+            event_type = ?,
+            received_at = ?,
+            payload_json = ?,
+            status = 'processing',
+            processing_expires_at = ?
+        where provider = ?
+          and trace_id = ?
+          and coalesce(status, 'processed') = 'processing'
+          and (
+            processing_expires_at is null
+            or processing_expires_at <= ?
+          )
+      `).run(input.externalAccountId, input.eventType, input.receivedAt, MINIMIZED_WEBHOOK_TRACE_PAYLOAD_JSON, input.processingExpiresAt, input.provider, input.traceId, input.receivedAt);
+            return (result.changes ?? 0) > 0 ? "claimed" : "processing";
+        });
+    }
+    completeWebhookTrace(provider, traceId) {
+        this.database.prepare(`
+      update webhook_trace
+      set payload_json = ?,
+          status = 'processed',
+          processing_expires_at = null
+      where provider = ?
+        and trace_id = ?
+        and coalesce(status, 'processed') = 'processing'
+    `).run(MINIMIZED_WEBHOOK_TRACE_PAYLOAD_JSON, provider, traceId);
+    }
+    releaseWebhookTrace(provider, traceId) {
+        this.database.prepare(`
+      delete from webhook_trace
+      where provider = ?
+        and trace_id = ?
+        and coalesce(status, 'processed') = 'processing'
+    `).run(provider, traceId);
+    }
+    enqueueJobInTransaction(input) {
+        if (input.dedupeKey) {
+            const existing = this.database.prepare(`
+        select *
+        from device_job
+        where account_id = ? and provider = ? and dedupe_key = ? and status in ('queued', 'running')
+        order by created_at desc, id desc
+        limit 1
+      `).get(input.accountId, input.provider, input.dedupeKey);
+            if (existing) {
+                return mapJobRow(existing);
+            }
+        }
+        const now = toIsoTimestamp(new Date());
+        const id = generatePrefixedId("dsj");
+        this.database.prepare(`
+      insert into device_job (
+        id,
+        provider,
+        account_id,
+        kind,
+        payload_json,
+        priority,
+        available_at,
+        attempts,
+        max_attempts,
+        dedupe_key,
+        status,
+        created_at,
+        updated_at
+      ) values (?, ?, ?, ?, ?, ?, ?, 0, ?, ?, 'queued', ?, ?)
+    `).run(id, input.provider, input.accountId, input.kind, stringifyJson(input.payload ?? {}), input.priority ?? 0, input.availableAt ?? now, input.maxAttempts ?? 5, input.dedupeKey ?? null, now, now);
+        return this.getJobById(id);
+    }
+}
+//# sourceMappingURL=store.js.map